Cross-Context Behavioral Advertising and Data Sharing

What it is

Databricks shares your identifiers, browsing behavior, location data, and inferred profile information with advertising partners so they can target you with ads across the internet based on your Databricks interactions.

Why it matters (compliance & governance perspective)

This type of data sharing is what most privacy laws define as a 'sale' or 'sharing' triggering opt-out rights, meaning your online behavior may follow you across platforms unless you actively opt out.

Consumer impact (what this means for users)

Your browsing activity on Databricks websites, along with inferences Databricks draws about your interests and characteristics, may be shared with advertising partners for targeted advertising across third-party platforms unless you exercise your opt-out right.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision directly engages CPRA's definition of 'sharing' personal information for cross-context behavioral advertising, which triggers opt-out rights under California law enforced by the California Privacy Protection Agency and California AG. Colorado, Connecticut, Texas, Oregon, and other state laws with similar targeted advertising opt-out provisions are also implicated. Under GDPR, sharing data with advertising partners for behavioral profiling requires a valid lawful basis, typically consent, and compliance with ePrivacy Directive requirements for cookie-based tracking. GOVERNANCE EXPOSURE: High. The combination of identifier sharing, behavioral data, and inference data with advertising partners is a core CPRA and multi-state privacy law trigger. Failure to honor opt-out requests within required timeframes or failure to recognize universal opt-out signals (GPC) creates direct regulatory exposure. JURISDICTION FLAGS: California creates the highest exposure given CPRA's broad definition of sharing and the CPPA's active enforcement posture. EU/EEA users require consent for behavioral advertising cookies under the ePrivacy Directive and GDPR Article 6. Colorado, Connecticut, and Virginia residents have analogous opt-out rights under their respective state privacy laws. CONTRACT AND VENDOR IMPLICATIONS: Organizations that integrate Databricks marketing tools or co-marketing arrangements should assess whether their own privacy disclosures accurately reflect Databricks' downstream data sharing. Advertising partner contracts should include appropriate data use restrictions consistent with the purposes disclosed in this notice. COMPLIANCE CONSIDERATIONS: Compliance teams should verify that Databricks' cookie consent banner satisfies GDPR consent standards for EU visitors, that the opt-out mechanism for US users is functional and timely, and that universal opt-out signals such as GPC are recognized as required under CPRA and Colorado law.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Platform Customer Data Carve-Out medium
• Inference Data Collection medium
• Data Subject Rights and Opt-Out Mechanisms low
• Cross-Border Data Transfers medium
• Cookie and Tracking Technologies medium
• Data Retention low

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.