Third-Party Advertising and Analytics Data Sharing

What it is

Headspace shares user data with advertising technology companies, analytics providers, and social media platforms, and acknowledges this may legally qualify as selling or sharing personal information under privacy laws like California's CCPA.

Why it matters (compliance & governance perspective)

The sharing of personal information with advertising and analytics vendors in the context of a mental health platform is particularly sensitive because usage patterns, session frequency, and feature engagement may reveal or infer mental health status or treatment-seeking behavior.

Consumer impact (what this means for users)

Your behavioral data from using Headspace, including which features you engage with, how frequently, and usage patterns that may infer mental health status, may be shared with advertising and analytics third parties; California residents have the right to opt out of this sale or sharing, and EU users can object to processing for advertising purposes under GDPR.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision implicates the CCPA and CPRA (California), which require disclosure of data sales and sharing, provide opt-out rights, and impose restrictions on the sharing of sensitive personal information including health data for advertising purposes. GDPR Article 6 and Article 9 apply for EU users, requiring a lawful basis for processing and explicit consent for special category health data used in advertising. The FTC's unfair or deceptive practices authority applies to the representation of data sharing practices. State consumer health data laws in Washington, Nevada, and Connecticut may impose consent requirements for sharing health-related behavioral data with advertising vendors. GOVERNANCE EXPOSURE: High. The combination of mental health context and advertising data sharing creates elevated regulatory and reputational exposure. CPRA's sensitive personal information framework restricts the use of health and mental health data for advertising purposes, and the policy's own acknowledgment that this sharing may constitute a 'sale' or 'sharing' under applicable law confirms that opt-out mechanisms must be operationally available and effective. JURISDICTION FLAGS: California creates the highest US exposure given CPRA's sensitive personal information restrictions. EU and UK users are protected by GDPR and UK GDPR requirements for explicit consent before processing health-adjacent data for advertising. Washington State users may have specific rights under the My Health MY Data Act if the shared data qualifies as consumer health data. Illinois BIPA is not directly implicated unless biometric data is involved. CONTRACT AND VENDOR IMPLICATIONS: Data sharing agreements with advertising technology vendors, social media platforms, and analytics providers should be reviewed to confirm they comply with applicable privacy law restrictions on health and sensitive data, including GDPR data processing agreements and CCPA/CPRA contracts with service providers versus third parties. The characterization of these relationships as sales or sharing versus service provider arrangements has direct implications for opt-out obligations and contractual terms. COMPLIANCE CONSIDERATIONS: Compliance teams should verify that opt-out mechanisms for data sale and sharing are functional and accessible, that sensitive personal information used for advertising is appropriately restricted under CPRA, and that consent signals from cookie consent tools are correctly communicated to all downstream advertising and analytics vendors. A vendor audit of advertising technology partners should assess whether any receive data that could constitute consumer health data under applicable state law.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• HIPAA Business Associate Status and Clinical Health Data Governance medium
• Consumer Health Data and Separate Health Data Privacy Policy medium
• Collection of Sensitive Health and Mental Health Information high
• Children's Privacy Age Restriction medium
• User Privacy Rights and Data Subject Requests medium
• English Version Prevails Over Translations low

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.