Third-Party Advertising Data Sharing

What it is

DraftKings shares your personal identifiers, browsing behavior, and purchase records with named advertising companies including Facebook, TikTok, LiveRamp, and The Trade Desk so they can serve you targeted ads on DraftKings and across other websites and apps.

Why it matters (compliance & governance perspective)

This data sharing with advertising technology vendors, particularly through tools like LiveRamp's identity graph, enables cross-context behavioral advertising and may constitute 'selling' or 'sharing' personal information under CCPA/CPRA, giving California residents the right to opt out.

Consumer impact (what this means for users)

Your email address, browsing behavior, and purchase history on DraftKings may be shared with a network of advertising vendors who use it to track you across other websites and apps and serve targeted ads. Under CPRA, California residents can opt out of this sharing, which the notice must facilitate.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision engages CCPA/CPRA under which sharing personal information with third-party advertising vendors for cross-context behavioral advertising constitutes 'sharing' subject to consumer opt-out rights. The California Privacy Protection Agency (CPPA) and California AG are the primary enforcement authorities. The FTC Act applies to the overall advertising data practices. EU/EEA users engaging DraftKings through any available channels would trigger GDPR legitimate interest or consent requirements for behavioral advertising. The provision's reference to LiveRamp specifically implicates identity resolution practices that have drawn regulatory scrutiny. GOVERNANCE EXPOSURE: High. The named vendors include platforms (TikTok, Facebook) subject to their own regulatory scrutiny regarding data handling, and identity resolution providers (LiveRamp) whose practices have been the subject of CPPA enforcement interest. The breadth of data categories shared (unique personal identifiers including email, commercial purchase records, browsing data) combined with the non-exhaustive vendor list creates ongoing vendor management obligations. JURISDICTION FLAGS: California creates the highest exposure due to CPRA opt-out rights and CPPA enforcement authority. Colorado, Connecticut, Virginia, and other states with consumer privacy laws also provide opt-out rights for targeted advertising using personal data. EU/EEA users require consent under GDPR for behavioral advertising. The inclusion of TikTok as a named vendor may attract additional regulatory attention given ongoing federal and state scrutiny of that platform's data practices. CONTRACT AND VENDOR IMPLICATIONS: Data processing agreements with named advertising vendors should be reviewed to confirm they include CPRA-compliant contractual limitations, prohibit vendors from using DraftKings user data for their own commercial purposes beyond the stated purpose, and include audit rights. The non-exhaustive vendor list ('including, but not limited to') means the actual scope of sharing is broader than what is disclosed, which may complicate data mapping obligations. COMPLIANCE CONSIDERATIONS: The opt-out mechanism for sale and sharing of personal information must be clearly accessible and functional, including a 'Do Not Sell or Share My Personal Information' link as required by CPRA. Compliance teams should audit whether the advertising data sharing described triggers 'sale' definitions under applicable state laws beyond California. The non-exhaustive vendor list should be reviewed for completeness in the context of annual privacy notice update obligations.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Biometric Data Collection and Verification high
• Authorization for Third-Party Disclosure of Financial and Government Data high
• Contact Importer and Third-Party Consent Delegation medium
• Responsible Play Monitoring medium
• De-Identified Data Unrestricted Use medium
• SMS and Call Consent via Privacy Notice Acceptance medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.