Cross-Context Behavioral Advertising

What it is

Amazon uses your browsing and purchase history to show you targeted ads both on Amazon and on other websites, and allows some third parties to collect data on Amazon's site to target ads to you elsewhere online.

Why it matters (compliance & governance perspective)

This means your shopping behavior on Amazon follows you across the internet through advertising networks, which can feel intrusive and extends Amazon's commercial use of your data beyond its own platform.

Clause Stability Stable

Consumer impact (what this means for users)

This provision means that what you browse and buy on Amazon can be used to target you with ads on third-party websites and apps, and advertising partners may place tracking technologies on Amazon's site to facilitate this cross-site targeting.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision directly engages CPRA's definition of sharing personal information for cross-context behavioral advertising, which California residents have a right to opt out of regardless of whether monetary consideration is exchanged. Under GDPR, interest-based advertising based on behavioral profiling requires either explicit consent or a carefully balanced legitimate interests assessment; the ePrivacy Directive additionally governs cookie-based tracking used to enable this advertising. The FTC has ongoing policy focus on cross-context behavioral advertising and data broker practices. GOVERNANCE EXPOSURE: High for California and EU-facing operations. CPRA's explicit right to opt out of sharing for cross-context behavioral advertising applies to Amazon's described practices, and failure to honor opt-out requests is enforceable by the California Privacy Protection Agency. EU regulators have imposed significant fines on major platforms for consent failures in behavioral advertising contexts. JURISDICTION FLAGS: California residents have an explicit opt-out right under CPRA. EU and UK residents require consent for behavioral advertising cookies and profiling under GDPR and ePrivacy rules. Colorado, Connecticut, Virginia, and other US states with comprehensive privacy laws also provide opt-out rights for targeted advertising. The cross-site data collection component may also implicate state laws governing data brokers. CONTRACT AND VENDOR IMPLICATIONS: Third-party advertising partners collecting data on Amazon's properties must operate under data processing agreements that comply with applicable law; the adequacy of these agreements for GDPR purposes depends on whether consent is the lawful basis and whether consent flows are properly managed. Businesses advertising on Amazon should assess whether their own data practices in connection with Amazon's advertising tools create independent compliance obligations. COMPLIANCE CONSIDERATIONS: Compliance teams should verify that Amazon's interest-based advertising opt-out mechanism at www.amazon.com/adprefs is functional, prominent, and honored in practice; review whether consent management for EU users complies with current GDPR enforcement standards; assess whether Amazon's advertising pixel and cookie disclosures satisfy ePrivacy and state law transparency requirements; and determine whether CPRA opt-out signals such as Global Privacy Control are honored.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Voice and Device Data Collection via Alexa high
• Third-Party Seller Data Sharing medium
• Data Retention for Legal and Operational Purposes medium
• Jurisdiction-Specific Consumer Data Rights medium
• Sharing with Business Partners and Affiliated Entities medium

Related Analysis

• OpenAI Changed Its Privacy Policy 4 Times in One Week. Here Is What Actually Changed.

  Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.