DocuSign updated its Privacy Statement on May 21, 2026 to expand the scope of personal information collection and describe data sources more explicitly. The updated language now states that DocuSign collects personal information from individuals 'with whom we otherwise communicate in connection with the Services' (broader than website and app users alone) and explicitly identifies 'Marketing Contact Data' collected from third-party provider Clay to support sales and marketing efforts. The policy also clarifies that DocuSign maintains opt-out list data to honor email marketing preferences.
The updated privacy statement explicitly discloses that DocuSign collects marketing contact data (professional details such as email, phone number, job title, employer, and location) from third-party provider Clay to support sales and marketing activities. The policy now clarifies that its data collection scope includes individuals with whom DocuSign communicates about services, extending beyond active website or app users. The policy states DocuSign maintains minimal data (such as email address on an opt-out list) when users have opted out of email marketing to honor that request.
The updated privacy statement adds explicit disclosure of where DocuSign obtains marketing contact data (third-party provider Clay) and clarifies its data collection scope extends to individuals who communicate with the company about services, not just active platform users. This transparency addition enables data subjects to understand the sources and breadth of DocuSign's personal data collection practices.
→ Review DocuSign's privacy notice to understand that marketing contact data may be collected from Clay
→ Contact DocuSign if you wish to opt out of marketing communications and have your details maintained on their opt-out list
→ DocuSign will continue to collect and use marketing contact data from third-party sources as permitted under the updated policy
→ If you do not opt out of email marketing, DocuSign will maintain your contact information for marketing communications as stated in the terms
Explicitly discloses collection of marketing contact data from third-party provider Clay to support sales and marketing efforts
Privacy statement now covers individuals with whom DocuSign communicates about services, extending beyond active platform users
Clarifies DocuSign maintains minimal data (e.g., email on opt-out list) to honor email marketing opt-out requests
This change record describes what was added, removed, or modified in the document. Analysis reflects what the updated agreement states or permits. It does not constitute a legal determination about enforceability. Applicability may vary by jurisdiction. Methodology
DocuSign's updated privacy statement adds explicit disclosure of third-party marketing data collection from Clay and clarifies its scope to include individuals who communicate with the company about services beyond direct platform users. This is primarily a disclosure and clarification change with low operational complexity. Organizations that maintain data relationships with DocuSign or conduct marketing via DocuSign platforms may need to confirm their own privacy notices accurately reflect this third-party data flow if they reference DocuSign's practices. No new regulatory obligation is apparent from the change itself, though data subjects in GDPR or CCPA jurisdictions may assert rights regarding this disclosed processing.
GDPR (Articles 13, 14 regarding fairness and transparency of processing), CCPA/CPRA (disclosure of data sources and collection practices)
Full compliance analysis
Obligation analysis, escalation trigger, board language, and recommended action.
Monitor: regulatory citations + obligations. Compliance: full compliance memo.
ConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-C-002216.
This new provision explicitly discloses that DocuSign collects and processes the actual content of documents, which is material for users to understand what data is collected beyond metadata.
This provision consolidates EU/UK data subject rights and cross-border transfer mechanisms in one location with explicit reference to Standard Contractual Clauses, providing critical GDPR/UK GDPR compliance information.
This standalone provision was removed, though its content appears to be partially absorbed into the new EU/UK-specific provision and California-specific provision, potentially fragmenting global user rights information.
Removal of this provision eliminates explicit disclosure about age restrictions and children's data handling, which is typically required by privacy regulations like COPPA and GDPR.
Removal of this standalone provision means law enforcement disclosure practices are no longer explicitly highlighted, though may be covered in the combined third-party sharing provision.
Previous version had no excerpt; current version adds detailed explanation of the distinction between controller and processor roles with specific examples.
Previous version title focused on 'advertising' whereas current version provides comprehensive enumeration of all third-party sharing scenarios, removing the specific advertising emphasis.
Previous version had no excerpt; current version adds specific detail about types of tracking technologies (web beacons, pixel tags) and scope of tracking.
Previous version had no excerpt; current version adds explicit enumeration of CCPA/CPRA rights including opt-out of sale/sharing and limitation of sensitive data use.
Previous version had no excerpt; current version adds specific purposes for retention including legal, accounting, and reporting requirements.
Previous version had no excerpt; current version adds detailed description of marketing channels and explicit opt-out mechanisms.
1 provision unchanged.
Cross-platform context
See how other platforms handle similar provisions across the ConductAtlas archive.
See the full side-by-side comparison of every sentence added, removed, and modified.
🔒 Full diff — MonitorDocuSign removed 'English' from the list of languages in which its Privacy Statement is available. The Privacy Statement itself remains …
DocuSign's privacy policy now displays language indicating available translations (French, German, Japanese, Portuguese, Spanish, Dutch, Italian, and English) at the …
We read the privacy policies and terms of service of 38 AI platforms. Here is what they say about training, retention, arbitration, and lia…
Get alerted when this policy changes again — including what changed and why it matters.
Prefer a weekly summary instead?
Get the biggest policy changes across 352+ platforms every Sunday.