Behavioral Inference Collection and Use

What it is

GOAT builds a profile of your interests and preferences based on how you use the platform, including what you search for, browse, and buy, and uses these inferences to inform how it markets to you.

Why it matters (compliance & governance perspective)

Behavioral inferences are a distinct category of personal data that can reveal sensitive information about your lifestyle, spending habits, and interests, and their use for marketing or sharing with partners may go beyond what users expect from a shopping platform.

Consumer impact (what this means for users)

Every search, browse, and purchase on GOAT may contribute to an inferred profile of your preferences and characteristics, which the policy permits to be used for targeted marketing and potentially shared with business partners.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: Under CPRA, 'inferences drawn from personal information' constitute a defined category of personal information subject to consumer rights including access and deletion. The California Privacy Protection Agency enforces these rights. Under GDPR, profiling of individuals for marketing purposes requires either consent or a legitimate interests assessment, and data subjects have the right not to be subject to solely automated decision-making that produces legal or similarly significant effects. The FTC has issued guidance on behavioral advertising and the use of inferred data. GOVERNANCE EXPOSURE: Medium. The collection and use of behavioral inferences is common in e-commerce, but the explicit acknowledgment that inferences are drawn and used for marketing purposes creates a compliance obligation to disclose these inferences in response to CPRA access requests and to honor deletion requests that cover inferred data categories. JURISDICTION FLAGS: California users have a right to know about and request deletion of inferences held about them under CPRA. EU users may invoke GDPR rights to object to profiling for marketing. In other US states with enacted privacy laws (Colorado, Virginia, Connecticut, Texas), similar but varying profiling rights may apply. The extraterritorial reach of these obligations depends on user location at time of data collection. CONTRACT AND VENDOR IMPLICATIONS: If inferences are shared with analytics or advertising vendors, vendor agreements should specify whether those vendors receive raw behavioral data or derived inferences, and whether they may independently profile users. Data processing agreements should address inference data as a distinct category. COMPLIANCE CONSIDERATIONS: Legal teams should confirm that GOAT's data subject access request process is capable of producing inference data in response to consumer requests, and that deletion workflows extend to derived inference records. Internal data maps should categorize inference data separately from raw behavioral data to support accurate rights fulfillment.

Applicable agencies

Provision details

Other risks in this policy

• Third-Party Business Partner Data Sharing for Marketing high
• California Opt-Out Rights (Sale and Sharing) medium
• Geolocation Data Collection medium
• Children's Privacy Restriction medium
• Cookie and Tracking Technology Use medium
• Data Retention medium