Data Sale and Targeted Advertising Opt-Out

What it is

You can ask FanDuel not to sell or share your personal information for advertising purposes, but this opt-out only applies to the specific browser and device you use to submit it, and you must redo it if you clear your cookies.

Why it matters (compliance & governance perspective)

The cookie-dependent opt-out mechanism means your data sale opt-out can be inadvertently reset simply by clearing your browser history or cookies, requiring ongoing vigilance to maintain the protection.

This document changed recently

Consumer impact (what this means for users)

If you opt out of data sales but later clear your cookies or switch devices, your opt-out is lost and your data may resume being shared with advertisers and third-party commercial partners until you opt out again on each affected device and browser.

What you can do

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: The CPRA requires that opt-out of data sales and sharing be implemented in a manner that is durable and that companies honor browser-based opt-out signals including the Global Privacy Control (GPC). The policy acknowledges GPC recognition but describes a cookie-dependent opt-out that may conflict with CPRA guidance on durable opt-out implementation issued by the California Privacy Protection Agency. Similar tensions may exist under Colorado and Connecticut privacy laws. The FTC may assess this mechanism under its unfair or deceptive practices authority if opt-outs are not reliably maintained. (2) GOVERNANCE EXPOSURE: Medium to High. While the policy discloses the cookie-dependency limitation, the practical effect is that users who comply with standard data hygiene practices (clearing cookies) inadvertently waive their opt-out. This design choice may face regulatory scrutiny regarding whether it constitutes a durable opt-out as required under applicable law. (3) JURISDICTION FLAGS: California creates the highest exposure given CPRA's explicit durability requirements and the California Privacy Protection Agency's rulemaking authority. Colorado and Connecticut privacy laws with similar opt-out requirements may also apply. Users across multiple states who use FanDuel on multiple devices face the greatest practical burden. (4) CONTRACT AND VENDOR IMPLICATIONS: If opt-outs are not reliably transmitted to downstream advertising and analytics vendors following cookie clearing events, those vendors may continue receiving data in violation of the user's asserted preference, creating potential liability in the data sharing chain. Vendor contracts should specify how opt-out signals are communicated and honored in real time. (5) COMPLIANCE CONSIDERATIONS: Legal teams should evaluate whether the current opt-out mechanism satisfies California Privacy Protection Agency guidance on durable opt-outs and GPC implementation. A technical audit of how opt-out signals are propagated to advertising and analytics vendors, and how cookie-clearing events are handled in the opt-out system, is recommended.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Disclosure to Sports Leagues, Employers, and Governing Bodies high
• Precise GPS Location Collection and Third-Party Sharing high
• Identity Document Collection as Mandatory Condition high
• Audio Recording of Customer Communications medium
• Third-Party Targeted Advertising and Cross-Device Tracking medium
• Corporate Transaction Data Transfer medium