The policy authorizes Brex to share personal information with advertising and analytics vendors for targeted advertising and campaign measurement, and discloses that this sharing may qualify as a sale or sharing under CCPA/CPRA, triggering opt-out rights for California residents.
This analysis describes what Brex's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision creates a CCPA/CPRA opt-out obligation and requires Brex to provide and honor a 'Do Not Sell or Share My Personal Information' mechanism; failure to do so creates enforcement exposure with the California Privacy Protection Agency.
Interpretive note: The source document was truncated; verbatim language reflects available policy content. The exact opt-out mechanism URL may differ from the policy landing page.
Under this clause, personal information may be shared with advertising and analytics partners for targeted advertising purposes, and California residents may opt out of this sharing through the mechanism described in the policy.
How other platforms handle this
We may display advertisements on our Services and those advertisements may be targeted to your interests based on your personal information. We may share your personal information with advertising partners for interest-based advertising purposes. You may opt out of interest-based advertising by visi...
src="https://trc.taboola.com/1142432/trc/3/json" ... src="https://www.googletagmanager.com/gtag/js?id=DC-15299257" ... src="https://tr.snapchat.com/config/com/af90c7f8-bd28-4988-b1ce-1711aad792f4.js" ... src="https://tr.snapchat.com/config/com/8fbe1595-8c5a-46b1-bbb2-66f3d57debde.js" ... src="https:...
TrustArcWrapper.withTrustArc(analytics, { alwaysLoadSegment: true }).load(segmentKey, cookieConfig);
Monitoring
Brex has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We may share your personal information with third-party advertising and analytics partners to deliver targeted advertisements and measure the effectiveness of advertising campaigns. This sharing may constitute a 'sale' or 'sharing' of personal information under California law. California residents have the right to opt out of the sale or sharing of their personal information.— Excerpt from Brex's Brex Privacy Policy
(1) REGULATORY LANDSCAPE: This provision directly engages CPRA, which grants California residents an opt-out right over sale and sharing of personal information for cross-context behavioral advertising, enforced by the California Privacy Protection Agency. The FTC Act applies to accuracy of representations about advertising data practices. GDPR and UK GDPR require a lawful basis (such as consent or legitimate interests with opt-out) for behavioral advertising involving EU and UK user data. (2) GOVERNANCE EXPOSURE: High for California compliance. The explicit acknowledgment that sharing may constitute a sale or sharing under California law triggers mandatory opt-out infrastructure, Global Privacy Control signal recognition, and annual data protection assessment requirements under CPRA for applicable processing activities. (3) JURISDICTION FLAGS: California creates the highest compliance exposure due to CPRA opt-out requirements. EU and UK users may require consent or a compliant legitimate interests assessment for behavioral advertising data transfers. Other US states with comprehensive privacy laws (such as Virginia, Colorado, Connecticut) may have analogous opt-out rights. (4) CONTRACT AND VENDOR IMPLICATIONS: Advertising and analytics vendor agreements must include appropriate data processing terms; under CPRA, contracts with third parties receiving personal information for advertising must include specific prohibitions and use limitations. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should audit whether the opt-out mechanism is functional and prominently placed; verify that Global Privacy Control signals are recognized and honored; confirm that advertising vendor contracts include required CPRA-compliant terms; and assess whether EU advertising data transfers have a documented lawful basis.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision creates a CCPA/CPRA opt-out obligation and requires Brex to provide and honor a 'Do Not Sell or Share My Personal Information' mechanism; failure to do so creates enforcement exposure with the California Privacy Protection Agency.
Under this clause, personal information may be shared with advertising and analytics partners for targeted advertising purposes, and California residents may opt out of this sharing through the mechanism described in the policy.
ConductAtlas has identified this type of provision across 5 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Brex.