Behavioral Advertising and Cookie-Based Tracking

What it is

Calm allows third-party advertising and analytics companies to place tracking technologies on your devices to collect information about your behavior across the web and use it to serve targeted ads.

Why it matters (compliance & governance perspective)

Third-party tracking extends beyond Calm's own services and may result in your browsing behavior across other websites being collected and used to target you with ads.

Clause Stability Stable

Consumer impact (what this means for users)

Third-party ad and analytics partners may track your online activity across websites and apps using cookies and device identifiers, and this data is used to serve you targeted advertising on other platforms.

What you can do

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: Cookie-based tracking and behavioral advertising engage the EU ePrivacy Directive (Cookie Directive), GDPR consent requirements, the UK Privacy and Electronic Communications Regulations, and CPRA's 'sharing' opt-out provisions. The FTC also has authority over unfair or deceptive tracking practices. Under GDPR and ePrivacy, non-essential cookies generally require prior informed consent; the policy's provision of a Cookie Preferences Manager and opt-out page is consistent with this requirement but the adequacy of the implementation depends on the specific consent mechanism deployed. (2) GOVERNANCE EXPOSURE: Medium. The scope of third-party tracking described is standard for consumer technology platforms but is substantive; the combination of cross-site tracking with Calm's wellness data context may attract heightened regulatory attention. The policy's reference to Global Privacy Control as a recognized opt-out signal for California users is a positive compliance indicator. (3) JURISDICTION FLAGS: EU/EEA and UK users require prior consent for non-essential cookies under ePrivacy rules. California users under CPRA are entitled to opt out of 'sharing' for cross-context behavioral advertising. The opt-out mechanism at calm.com/optout and the Cookie Preferences Manager should be evaluated to confirm they function correctly for each jurisdiction. (4) CONTRACT AND VENDOR IMPLICATIONS: Each third-party analytics and advertising partner receiving tracking data should be assessed under appropriate data processing or controller agreements. The volume and diversity of third-party partners implied by the policy's disclosure warrants a vendor inventory and periodic assessment. (5) COMPLIANCE CONSIDERATIONS: A cookie audit should be conducted to confirm that all tracking technologies deployed on Calm's web and app properties are disclosed in the Cookie Preferences Manager and that consent is obtained prior to non-essential cookie placement for EU/UK users. The California-specific opt-out page and GPC signal response should be tested for accuracy and completeness.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Cross-Platform Ad Targeting Using Email or Phone Identifiers medium
• Health App Data Collection (Apple HealthKit and Google Health Connect) medium
• Inferred Characteristics Including Age and Gender Estimates medium
• Disclosure of Data in Business Transactions medium
• Employer-Provided Subscription Disclosure low
• International Data Transfer Mechanisms medium

Related Analysis

• OpenAI Changed Its Privacy Policy 4 Times in One Week. Here Is What Actually Changed.

  Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.