Third-Party Advertising Partner Data Sharing

What it is

BeReal can share your personal data with advertising companies so they can show you targeted ads, and those advertising companies then handle your data under their own separate privacy rules.

Why it matters (compliance & governance perspective)

Once your data is shared with advertising partners who operate under their own policies, BeReal's privacy commitments no longer govern how that data is used, creating a potential gap in user protections.

Consumer impact (what this means for users)

This provision means your usage behaviour, device identifiers, and potentially location data may be passed to advertising companies, which can use it to build profiles for targeted advertising under terms you have not directly agreed to.

What you can do

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: Under GDPR, sharing personal data with advertising partners for behavioural targeting requires either freely given, specific, informed, and unambiguous consent (Article 6(1)(a)) or a valid legitimate interests assessment (Article 6(1)(f)), with the latter facing significant regulatory resistance for advertising purposes following EDPB guidance. Under CCPA/CPRA, sharing personal data with advertising partners for cross-context behavioural advertising constitutes 'sharing' triggering the opt-out right. The FTC Act Section 5 applies to any deceptive or unfair data sharing practices. The ePrivacy Directive requires prior consent for placing or reading cookies used for advertising. (2) GOVERNANCE EXPOSURE: High. The statement that advertising partners 'may use this information in accordance with their own privacy policies' is a standard but compliance-significant clause: it effectively removes BeReal's data governance obligations once data is transferred, while GDPR's joint controllership framework (Article 26) and controller-to-controller obligations may require more formal accountability arrangements depending on the nature of the sharing relationship. (3) JURISDICTION FLAGS: EU/EEA users are most exposed given GDPR's strict consent requirements for behavioural advertising; California users have a specific CPRA opt-out right for sharing; UK users are protected under UK GDPR and the UK ICO's guidance on advertising data. The extent to which data is shared with US-based advertising platforms may also implicate EU-US data transfer adequacy requirements. (4) CONTRACT AND VENDOR IMPLICATIONS: Each advertising partner receiving personal data should have a documented legal relationship with BeReal specifying the controller or processor role, the data types transferred, the purposes permitted, and the applicable transfer mechanism for cross-border flows. Where advertising partners act as independent controllers, GDPR may require a joint controllership agreement or at minimum a documented allocation of responsibilities. (5) COMPLIANCE CONSIDERATIONS: Legal teams should audit the current list of advertising technology vendors receiving BeReal user data, confirm the legal basis for each sharing relationship, and verify that the CPRA 'Do Not Share' signal (Global Privacy Control) is honoured. The consent management platform used by BeReal should be assessed for compliance with GDPR's consent validity standards, particularly the requirement that consent be as easy to withdraw as to give.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Dual-Camera Simultaneous Image Capture high
• Location Data Collection high
• User Rights for EU, UK, and California Residents medium
• Corporate Transaction Disclosure medium
• Data Retention medium
• Minors and Age Restrictions high

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.