Third-Party Data Sharing with Business Partners and Advertising Partners

What it is

Anyscale shares your personal information with business partners and advertising companies for marketing and targeted advertising. This is separate from data shared with service providers who process data on Anyscale's behalf.

Why it matters (compliance & governance perspective)

Sharing with advertising and business partners means your personal information may be used by organizations beyond Anyscale for their own marketing and advertising purposes, potentially outside of Anyscale's direct control.

Consumer impact (what this means for users)

Your personal information, including behavioral and contact data, may be shared with third-party advertising partners and business partners who may use it for their own marketing purposes. This sharing is distinct from service provider relationships where data use is limited to Anyscale's instructions.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: Sharing personal data with advertising partners for cross-context behavioral advertising implicates CCPA/CPRA's 'sharing' definition, which does not require monetary exchange. The California Privacy Protection Agency enforces CPRA opt-out requirements. GDPR requires a valid legal basis and, for sharing with third parties acting as independent controllers, transparency about those third parties' identities or categories. The FTC Act applies to representations about data sharing practices. GOVERNANCE EXPOSURE: Medium. The policy does not name specific advertising or business partners, which limits the ability of data subjects to exercise rights against those third parties directly. Under GDPR, data subjects may have the right to object to processing for direct marketing purposes, which extends to profiling for direct marketing. The lack of a named partner list creates transparency challenges. JURISDICTION FLAGS: California residents have the most explicit statutory opt-out right for this type of sharing under CPRA. EU/EEA residents may rely on GDPR Article 21 to object to processing for direct marketing. Virginia, Colorado, and Connecticut residents have similar opt-out rights under their respective state privacy laws, though the policy does not explicitly address these states. CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should assess whether Anyscale's business partner agreements include appropriate data use restrictions to prevent onward transfer of personal data by partners beyond agreed purposes. The absence of a named partner list in the policy may complicate vendor risk assessments. COMPLIANCE CONSIDERATIONS: Legal teams should verify that Anyscale maintains a current list of advertising and business partners and that appropriate data processing agreements or partner agreements are in place. For EU deployments, the legal basis for sharing with business partners as independent controllers should be documented and communicated to data subjects.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Cross-Context Behavioral Advertising Disclosure medium
• Customer Data Carve-Out medium
• EU-U.S. Data Privacy Framework Participation medium
• Automatic Collection of Device and Behavioral Data medium
• Privacy Notice Updates at Sole Discretion low
• Data Retention at Company Discretion low

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.