Third-Party Data Sharing

What it is

Afterpay shares your personal information with third parties in certain circumstances, which the policy describes in a dedicated section covering the types of recipients and the conditions for sharing.

Why it matters (compliance & governance perspective)

For a buy-now-pay-later provider handling financial and purchase data, the scope of third-party sharing determines how broadly your financial behavior and personal details may flow to retail partners, data analytics providers, and other entities.

Consumer impact (what this means for users)

Your financial transaction data, purchase history, and personal information may be shared with Afterpay's retail partners, affiliates, service providers, and potentially other third parties depending on the terms of the sharing section. The specific categories of recipients and the conditions under which sharing occurs are disclosed in the policy but were not fully readable in the provided document.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: Third-party data sharing by a financial services provider is regulated under GLBA, which requires annual privacy notices and opt-out rights for sharing with non-affiliated third parties for marketing purposes. The FTC enforces GLBA privacy rule compliance for non-bank financial institutions. State privacy laws including CPRA grant California consumers the right to opt out of the sale or sharing of personal information and require disclosure of sharing categories and recipients. The CFPB has also issued guidance on data sharing practices among BNPL providers and their retail partners. GOVERNANCE EXPOSURE: High. Data sharing in the BNPL context involves financial transaction data, purchase history, and behavioral profiles that are commercially valuable and subject to multiple overlapping regulatory frameworks. Sharing with retail partners, which is a core operational feature of the Afterpay model, must be disclosed with sufficient specificity under CPRA and GLBA. Any sharing that constitutes a 'sale' under California law triggers opt-out rights regardless of whether monetary consideration is exchanged. JURISDICTION FLAGS: California residents have the right to opt out of the sale or sharing of personal information under CPRA. Virginia, Colorado, Connecticut, and other states with comprehensive privacy laws provide analogous opt-out rights for certain sharing activities. GLBA opt-out rights apply to sharing with non-affiliated third parties for marketing. The intersection of these frameworks requires careful mapping of each sharing relationship to the applicable legal basis. CONTRACT AND VENDOR IMPLICATIONS: Each third-party sharing relationship should be governed by a data processing agreement or comparable contract that specifies permitted uses, security requirements, and deletion obligations. Retail partners receiving Afterpay customer data should be assessed as data processors or joint controllers depending on the nature of the sharing arrangement. COMPLIANCE CONSIDERATIONS: Compliance teams should audit all active third-party data sharing relationships against the categories disclosed in the notice and verify that opt-out mechanisms are operational and effective. GLBA-compliant opt-out notices should be assessed for adequacy. Any sharing classified as a 'sale' under state law requires a functioning opt-out link or mechanism.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Continuing-Use Consent medium
• Scope of Personal Information Collection medium
• State-Specific Privacy Rights medium
• Children's Personal Information low
• Cookies and Automated Tracking Technologies medium
• U.S. Consumer Privacy Notice medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.