Third-Party Business Partner Data Sharing for Marketing

What it is

GOAT can share your personal data with business partners who may use it for their own marketing, meaning companies outside GOAT could receive your information and use it to target you with their own ads or promotions.

Why it matters (compliance & governance perspective)

This clause means your GOAT shopping data may end up with third-party companies for purposes unrelated to your GOAT transactions, potentially affecting the ads and offers you see across other platforms.

Consumer impact (what this means for users)

Your purchase history, preferences, and identifiers collected on GOAT may be shared with third-party business partners who can use this data for their own marketing campaigns, extending the reach of your data beyond the GOAT platform.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision directly engages the California Privacy Rights Act's definition of 'sharing' personal information for cross-context behavioral advertising, which triggers opt-out rights under CPRA regardless of monetary consideration. The California Privacy Protection Agency enforces CPRA. For EU and UK users, sharing personal data with third parties for their own marketing purposes requires a valid legal basis under GDPR Article 6 and, where applicable, consent under Article 7; 'legitimate interests' as a basis for third-party marketing sharing faces heightened scrutiny from EU data protection authorities. The FTC Act's prohibition on unfair or deceptive practices is also relevant if the scope of sharing exceeds consumer expectations based on the notice provided. GOVERNANCE EXPOSURE: High. The authorization to share personal data with business partners for their own marketing is one of the most operationally significant provisions in the policy. It creates direct CPRA exposure if the opt-out mechanism is not fully functional or prominently disclosed, and it raises GDPR compliance questions regarding lawful basis and data subject rights for EU users whose data is shared with third-party marketers. JURISDICTION FLAGS: California residents have an affirmative right to opt out of this sharing under CPRA. EU and UK users may have the right to object to this processing under GDPR. In jurisdictions without comprehensive privacy law (most US states outside California, Colorado, Connecticut, Virginia, Texas, and others with enacted privacy statutes), users may have limited recourse. The breadth of the 'business partners' category warrants review in each operating jurisdiction. CONTRACT AND VENDOR IMPLICATIONS: Procurement and legal teams should ensure that data sharing agreements with each business partner category include contractual limitations on downstream use, purpose limitation clauses, and audit rights consistent with applicable law. GDPR Article 28 requires formal data processing agreements where partners process data on GOAT's behalf; where partners process for their own purposes, they act as independent controllers, requiring a different contractual framework. COMPLIANCE CONSIDERATIONS: Compliance teams should confirm that the 'Do Not Sell or Share My Personal Information' mechanism covers this category of sharing for California users, that all business partners are inventoried in the data map with documented legal bases, and that EU-specific consent or legitimate interests assessments are documented for each partner relationship. Regular review of partner agreements for alignment with stated policy purposes is advised.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Behavioral Inference Collection and Use medium
• California Opt-Out Rights (Sale and Sharing) medium
• Geolocation Data Collection medium
• Children's Privacy Restriction medium
• Cookie and Tracking Technology Use medium
• Data Retention medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.