Third-Party Data Sharing for Advertising

What it is

Airbnb shares your personal information and browsing behavior with advertising partners so that you can be shown targeted ads both on Airbnb and on other websites and apps.

Why it matters (compliance & governance perspective)

This type of data sharing means your activity on Airbnb, including searches, listings viewed, and booking behavior, may be used to profile you for advertising purposes across the broader internet, not just within Airbnb's platform.

Consumer impact (what this means for users)

This provision means that your behavioral data from using Airbnb, including search history, listing interactions, and device identifiers, may be shared with third-party advertising networks, enabling targeted advertising that follows you across other platforms and websites.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: Third-party data sharing for behavioral advertising engages CPRA for California residents, which defines such sharing as 'sharing personal information' subject to an opt-out right regardless of monetary consideration. GDPR requires a valid legal basis (typically consent) for behavioral advertising involving personal data, and the ePrivacy Directive governs cookie-based tracking in the EU. The FTC has increasing interest in data broker and advertising ecosystem practices under its unfair and deceptive practices authority. Relevant enforcement authorities include the California Privacy Protection Agency, EU/UK data protection authorities, and the FTC. GOVERNANCE EXPOSURE: Medium to High. The CPRA 'Do Not Share' right operationally requires Airbnb to honor opt-out signals including Global Privacy Control, and to maintain records of sharing relationships with advertising partners. GDPR consent requirements for behavioral advertising cookies must be implemented through a compliant consent management platform. Non-compliance with CPRA sharing opt-out obligations has been an active enforcement priority for the California Privacy Protection Agency. JURISDICTION FLAGS: California (CPRA), EU/EEA (GDPR and ePrivacy Directive), UK (UK GDPR and PECR), and Colorado, Virginia, and Connecticut (state consumer privacy laws with opt-out rights) create the most significant exposure. The provision applies globally but its legal consequences vary materially by jurisdiction. CONTRACT AND VENDOR IMPLICATIONS: Advertising partners receiving personal data must be covered by appropriate data processing or sharing agreements. For GDPR purposes, any transfer to US-based advertising technology providers requires an Article 46 transfer mechanism. Organizations using Airbnb's platform for business purposes should assess whether employee data flows to advertising partners create obligations under applicable employment privacy law. COMPLIANCE CONSIDERATIONS: Compliance teams should audit whether Airbnb's cookie consent mechanism meets GDPR and ePrivacy standards in EU/UK deployments, including granular consent by purpose category. The CPRA opt-out right for sharing must be operationally supported and accessible without requiring account creation. Data mapping should document all advertising partner relationships, data types shared, and retention periods at the partner level.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Biometric Data and Government ID Collection high
• Geolocation Data Collection medium
• Data Sharing with Hosts and Guests medium
• California Resident Rights Under CPRA medium
• GDPR Rights for EU and UK Users medium
• Communications Content Collection medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.