Third-Party Sharing for Advertising and Analytics

What it is

Datadog states it may share your personal information with advertising partners, analytics companies, and other third-party service providers.

Why it matters (compliance & governance perspective)

The policy authorizes sharing personal data with advertising and analytics partners, which may constitute a sale or sharing of personal information under CCPA and requires a valid lawful basis under GDPR, depending on the nature of the sharing arrangement.

Consumer impact (what this means for users)

Personal data including identifiers and behavioral data may be shared with advertising and analytics partners under this provision; California residents have the right to opt out of the sale or sharing of their personal information by contacting Datadog at privacy@datadoghq.com.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: Sharing personal data with advertising and analytics partners engages GDPR Article 6 lawful basis requirements (particularly the legitimate interests assessment for behavioral advertising), the ePrivacy Directive regarding cookie-based tracking, CCPA sections governing the right to opt out of sale and sharing, and FTC Act standards for deceptive data practices. The California Privacy Protection Agency and EU data protection authorities are relevant enforcement bodies. GOVERNANCE EXPOSURE: High. The disclosure that data is shared with advertising partners triggers CCPA opt-out obligations and may require explicit consent or a valid legitimate interests assessment under GDPR. If the sharing constitutes a sale under CCPA (which includes transfers for valuable consideration), a Do Not Sell or Share link and opt-out mechanism must be made available to California consumers. JURISDICTION FLAGS: California residents have the highest immediate exposure, as CCPA grants them the right to opt out of sale and sharing of personal information with advertising partners. EU and UK users are protected by GDPR and ePrivacy requirements regarding consent for behavioral advertising. Virginia (VCDPA), Colorado (CPA), and other state privacy law jurisdictions may also create opt-out rights for targeted advertising. CONTRACT AND VENDOR IMPLICATIONS: Legal teams should review the specific list of advertising and analytics partners (typically disclosed via a cookie policy or subprocessor list) and assess whether data transfer agreements with those partners comply with GDPR Chapter V requirements for international transfers and CCPA service provider contract requirements. The breadth of the sharing authorization may require periodic vendor risk assessments. COMPLIANCE CONSIDERATIONS: Organizations should audit whether Datadog's cookie consent mechanism on the website provides a genuine opt-out from advertising-related tracking before consent is given, and whether the privacy policy's disclosure of advertising sharing is sufficiently specific to satisfy GDPR transparency requirements and CCPA disclosure obligations.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Data Collection Scope medium
• Controller and Processor Dual Role high
• International Data Transfers medium
• California Consumer Privacy Act Rights medium
• Data Retention low
• Cookies and Tracking Technologies medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.