Data Sharing with Advertising Partners and Data Brokers

What it is

Adobe shares your behavioral data, including which pages you visit and which ads you saw, with social media platforms and advertisers for targeted advertising. This sharing can occur without your specific consent in some cases, depending on the applicable legal framework.

Why it matters (compliance & governance perspective)

This provision means your Adobe usage activity may be disclosed to third-party ad networks, social media platforms, and data brokers for their own marketing purposes, potentially enabling detailed behavioral profiling across platforms.

Consumer impact (what this means for users)

Your browsing and usage behavior within Adobe's websites and apps may be shared with advertising partners including social media platforms for targeted advertising purposes, and this sharing may occur without requiring your explicit consent in jurisdictions where legitimate interests is an available legal basis.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision engages CCPA and CPRA, which define sharing personal information for cross-context behavioral advertising as a regulated activity requiring opt-out rights regardless of whether monetary consideration is exchanged. Under GDPR, sharing data with joint controllers for advertising purposes requires a valid lawful basis and a joint controller agreement under Article 26. The FTC has regulatory authority over unfair or deceptive data practices, and has increased scrutiny of data broker and advertising data sharing practices. The California Privacy Protection Agency enforces CPRA opt-out requirements. GOVERNANCE EXPOSURE: Medium-High. The policy's assertion that sharing for third-party marketing purposes may proceed where 'consent is not required' relies on legitimate interests as the legal basis, which under GDPR requires a documented balancing test and may not be available in all EU member states. Under CPRA, the sharing of behavioral data for cross-context behavioral advertising is an opt-out right that must be operationalized through a 'Do Not Sell or Share My Personal Information' mechanism. Joint controller arrangements with social media platforms require formal agreements specifying each party's responsibilities. JURISDICTION FLAGS: California residents have CPRA opt-out rights for data sharing for behavioral advertising. EU and EEA users may have stronger protections depending on the lawful basis used and the outcome of any legitimate interests assessment. Minors are subject to heightened protections under COPPA and CPRA, and sharing data about users under 16 for advertising purposes without consent is prohibited under CPRA. CONTRACT AND VENDOR IMPLICATIONS: B2B customers using Adobe analytics or marketing tools should assess whether data flowing from their users to Adobe is subject to downstream sharing with advertising partners, and whether their own privacy disclosures to end users adequately cover this. Procurement teams should verify that data processing agreements with Adobe address advertising data flows and joint controller arrangements. COMPLIANCE CONSIDERATIONS: Compliance teams should verify that Adobe's opt-out mechanisms for advertising data sharing are surfaced in a manner that satisfies CPRA's requirement for a clear and conspicuous 'Do Not Sell or Share' link. Legal teams should assess whether joint controller agreements with social media platforms and advertising partners are in place and whether they meet GDPR Article 26 requirements. Data mapping should capture advertising-related data flows as a distinct sharing category.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Cloud Content Analytics and Human Review medium
• Biometric Data Collection high
• Business Email Account Sharing with Employers medium
• Inferred Data and Third-Party Data Broker Sourcing medium
• Legitimate Interests as Default Legal Basis for Marketing and Processing medium
• Children's Privacy and Age Restrictions medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.