Behavioral Advertising and Data Sharing with Advertising Partners

What it is

Airbnb may share your device identifiers, platform browsing activity, and inferred interest data with advertising partners so that you can be shown targeted ads on other websites and apps beyond Airbnb.

Why it matters (compliance & governance perspective)

The policy authorizes sharing of behavioral and interest data with third-party advertising networks, which constitutes 'sharing' of personal information under CPRA subject to an opt-out right, and which extends the use of personal data beyond the platform for commercial advertising purposes.

Consumer impact (what this means for users)

The terms authorize Airbnb to share device identifiers, browsing behavior, and inferred preferences with advertising and analytics partners for cross-platform targeted advertising; California residents have a statutory right to opt out of this sharing, and EU users may have consent-based rights depending on applicable national law.

What you can do

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: This provision engages CPRA's definition of 'sharing' personal information for cross-context behavioral advertising (Civil Code Section 1798.120), which triggers an opt-out right independent of whether monetary consideration is exchanged. It also engages GDPR/ePrivacy Directive consent requirements for behavioral advertising cookies and tracking, and FTC Act Section 5 standards for unfair or deceptive advertising data practices. The California Privacy Protection Agency and state AG enforce CPRA; national DPAs enforce GDPR/ePrivacy. (2) GOVERNANCE EXPOSURE: Medium. The behavioral advertising data sharing practices described are common across consumer platform operators, but CPRA has introduced enforceable opt-out-of-sharing rights and the California Privacy Protection Agency has indicated active enforcement interest in this area. Failure to honor opt-out signals including Global Privacy Control may constitute a CPRA violation. (3) JURISDICTION FLAGS: California creates the highest US exposure under CPRA's sharing opt-out and sensitive data provisions. EU/EEA users require consent under ePrivacy and GDPR for behavioral advertising tracking. Colorado, Virginia, Connecticut, Texas, and other states with comprehensive privacy laws also provide opt-out rights for targeted advertising. (4) CONTRACT AND VENDOR IMPLICATIONS: Advertising and analytics partners receiving personal data should be assessed under CPRA's service provider versus third-party distinction; if these partners use data for their own purposes, they qualify as third parties under CPRA, and the sharing is subject to opt-out rather than service provider contractual protections. Vendor contracts should be reviewed to confirm this classification. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should verify that: (a) a functional opt-out-of-sharing mechanism is available to California users and honors Global Privacy Control signals; (b) consent management platforms capture valid GDPR/ePrivacy consent for EU users before behavioral advertising trackers fire; (c) advertising partner contracts reflect CPRA third-party or service provider designations accurately; and (d) the privacy policy accurately categorizes advertising partners under CPRA disclosure requirements.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Government-Issued ID and Biometric Data Collection high
• Data Sharing with Hosts and Guests medium
• Location Data Collection medium
• User Rights: Access, Deletion, and Portability medium
• Data Retention medium
• Cross-Border Data Transfers medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.