Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The policy authorizes disclosure of personal data including identifiers, usage data, and device information to advertising partners and analytics companies engaged to support platform operations.
This analysis describes what ElevenLabs's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes data flows to advertising and analytics third parties, which may trigger GDPR data processing agreement requirements, CCPA opt-out rights for sale or sharing of personal information, and disclosure obligations at the point of collection.
Interpretive note: The policy does not identify specific advertising or analytics partners by name, which creates ambiguity about the scope of actual data flows and whether the disclosure satisfies GDPR transparency requirements.
Added explicit confidentiality requirement for third parties ('agree to keep this information confidential') and consolidated separate vendor/analytics language into unified provision.
View full change record →Under this clause, personal data including identifiers, usage activity, and device information may be shared with advertising and analytics partners. California residents may have the right to opt out of the sharing of personal information for cross-context behavioral advertising under CPRA.
How other platforms handle this
The types of third parties your information may be disclosed to include: our resellers and other sales and advertising partners, retailers, advertisers, ad agencies, advertising networks and platforms, information service providers, fraud monitoring and prevention providers, and publishers.
Protect us, our business, our users, and others, for example to enforce our terms of service, prevent spam or other unwanted communications, and investigate or protect against fraud
we may use, retain or share information with law enforcement or others in circumstances where a person's vital interests require protection, such as in the case of emergencies.
Monitoring
ElevenLabs has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"We may share your personal information with third-party service providers, analytics companies, and advertising partners who assist us in operating our Services, conducting our business, or serving our users, so long as those parties agree to keep this information confidential.Excerpt from ElevenLabs's Privacy Policy
1. REGULATORY LANDSCAPE: This provision implicates GDPR (requiring data processing agreements with all processors and, where applicable, joint controller arrangements with advertising partners), CCPA/CPRA (the sharing of personal information with advertising partners for cross-context behavioral advertising constitutes 'sharing' under CPRA and triggers opt-out rights), and FTC Act Section 5 (deceptive or unfair data sharing practices). Enforcement authorities include EU/UK data protection authorities and the California Privacy Protection Agency. 2. GOVERNANCE EXPOSURE: Medium. Sharing with advertising partners is common across consumer-facing platforms, but CPRA's 'sharing' definition and GDPR's requirements for lawful data transfer to third-party processors create documented compliance obligations. The policy's confidentiality qualifier does not by itself satisfy GDPR processor agreement requirements. 3. JURISDICTION FLAGS: California users have CPRA opt-out rights for sharing with advertising partners. EU users require GDPR-compliant transfer mechanisms and processor agreements. The breadth of the 'advertising partners' category without specific identification of recipients may create transparency compliance questions under GDPR's information obligation requirements. 4. CONTRACT AND VENDOR IMPLICATIONS: Procurement and legal teams should verify that data processing agreements are executed with each identified category of third-party recipient. The policy's confidentiality qualifier may not be sufficient to satisfy GDPR Article 28 processor agreement requirements or CCPA service provider contractual restrictions. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should map the specific advertising and analytics vendors receiving data, confirm GDPR-compliant agreements are in place, implement a CPRA-compliant opt-out mechanism for advertising data sharing, and ensure that the privacy policy's disclosures are consistent with actual data flows documented in the company's data inventory.
Regulatory citations, enforcement risk, and due diligence action items.
ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.
Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision authorizes data flows to advertising and analytics third parties, which may trigger GDPR data processing agreement requirements, CCPA opt-out rights for sale or sharing of personal information, and disclosure obligations at the point of collection.
Under this clause, personal data including identifiers, usage activity, and device information may be shared with advertising and analytics partners. California residents may have the right to opt out of the sharing of personal information for cross-context behavioral advertising under CPRA.
ConductAtlas has identified this type of provision across 288 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by ElevenLabs.