Third-Party Advertising and Analytics Data Sharing

What it is

AI21 uses tracking technologies from multiple advertising companies including Meta, Google, LinkedIn, Reddit, and Twitter that collect your device and browsing data and may use it to show you targeted ads across the internet.

Why it matters (compliance & governance perspective)

Your browsing behavior on AI21's website is shared with multiple advertising platforms, which may use it to build profiles about you and target you with ads on other websites and apps, often without requiring your awareness.

Consumer impact (what this means for users)

Visiting AI21's website results in data being transmitted to at least five major advertising platforms (Meta, Google, LinkedIn, Reddit, Twitter/X) that may use this data for behavioral advertising profiles independent of AI21's own systems. This sharing of device-level and behavioral data with advertising partners is a significant aspect of the privacy posture for general website visitors.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision engages GDPR Article 6 (lawful basis, with consent typically required for advertising-related processing in the EU), the ePrivacy Directive as implemented in EU member states (governing cookie-based tracking), CCPA's right to opt out of the sale or sharing of personal information for cross-context behavioral advertising, and the UK GDPR. The FTC Act applies to US users regarding accuracy of disclosure. Each of the named advertising platforms is an independent data controller for data received through their tags. GOVERNANCE EXPOSURE: High. The simultaneous use of five major advertising tracking technologies creates a large surface area of third-party data sharing. Under GDPR, behavioral advertising tracking typically requires prior, informed, specific consent, and the adequacy of AI21's OneTrust cookie consent implementation should be assessed. Under CPRA, California users have a right to opt out of sharing personal information for cross-context behavioral advertising, and this right must be honored via a clear opt-out mechanism. JURISDICTION FLAGS: EU and EEA users face the highest regulatory exposure given GDPR and ePrivacy Directive requirements for consent before advertising cookies are set. UK users are subject to equivalent UK GDPR and PECR requirements. California users have CPRA opt-out rights. Other US states with comprehensive privacy laws (Virginia, Colorado, Connecticut, Texas) may also create opt-out obligations. The volume of advertising partners makes consistent compliance across jurisdictions operationally complex. CONTRACT AND VENDOR IMPLICATIONS: Each advertising platform (Meta, Google, LinkedIn, Reddit, Twitter/X) operates as an independent data controller and applies its own data practices to information received. AI21's vendor assessment should confirm that data processing agreements or platform terms with each advertising partner are current and compliant with applicable law. Procurement teams using AI21 services should note that website tracking technologies may capture employee behavioral data if employees access AI21's website from corporate devices. COMPLIANCE CONSIDERATIONS: A cookie consent audit is warranted to confirm that advertising tracking scripts are not loaded prior to user consent for EU, UK, and applicable US state users. Data mapping should identify each advertising vendor, the data transmitted, and the applicable legal basis. AI21's privacy team should confirm that CPRA 'Do Not Sell or Share My Personal Information' rights are operationally implemented. Organizations in regulated sectors should assess whether employee data sent to advertising platforms creates additional compliance risk.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Prompt and Interaction Data Collection and Model Training Use medium
• International Data Transfers medium
• Data Subject Rights (GDPR and CCPA) medium
• Enterprise API Data Processing Agreement medium
• Data Retention low
• Cookies and Tracking Technologies medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.