Third-Party Advertising and Analytics Sharing

What it is

ClickUp shares your personal data with outside companies for purposes including marketing and analytics, and in some cases those third parties may use your data for their own marketing.

Why it matters (compliance & governance perspective)

Sharing data with third parties for their own marketing purposes goes beyond typical service-provider sharing and means your data may be used in ways you did not directly anticipate when signing up for ClickUp.

This document changed recently

Consumer impact (what this means for users)

Your personal data, including behavioral and account information, may be disclosed to advertising and analytics partners who use it for their own purposes, which under CPRA may constitute a 'share' of personal information even if not a traditional sale.

What you can do

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: This provision engages CPRA's definition of 'sharing' personal information for cross-context behavioral advertising, which triggers opt-out rights regardless of whether monetary consideration is exchanged. GDPR Article 6 requires a valid lawful basis for each disclosure to third parties; where the basis is legitimate interest, a balancing test is required. The California Privacy Protection Agency and FTC are the primary enforcement authorities. (2) GOVERNANCE EXPOSURE: High for California-based deployments. The disclosure that data may be shared with third parties for their own marketing purposes, combined with CPRA's expanded definition of sharing, requires a clear opt-out mechanism and accurate disclosure in the CPRA-required categories notice. The phrase 'subject to your choices' implies an opt-out exists but the mechanism's accessibility and effectiveness require verification. (3) JURISDICTION FLAGS: California residents have a statutory right to opt out of sharing for cross-context behavioral advertising under CPRA. EU users are entitled to object to processing based on legitimate interests under GDPR Article 21. UK users have equivalent rights under UK GDPR. This provision has limited enforceability against ClickUp under GDPR without a valid lawful basis documented for each third-party disclosure. (4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise agreements should specify whether ClickUp's third-party marketing sharing applies to business account data or is limited to free-tier or individual users. Procurement teams should clarify contractually whether Customer Data as defined in ClickUp's terms is excluded from third-party marketing sharing. (5) COMPLIANCE CONSIDERATIONS: Organizations should verify the list of third-party advertising and analytics partners ClickUp uses, assess whether current consent or opt-out mechanisms satisfy applicable law, and update privacy notices to employees and customers if ClickUp data flows interact with third-party marketing networks.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Personal Data Collection Categories medium
• Business Transfer Data Disclosure medium
• Customer Data vs. ClickUp-Collected Data Distinction high
• California Consumer Privacy Rights medium
• International Data Transfers medium
• Data Retention medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.