Third-Party Advertising Partner Data Sharing

What it is

Hulu and Disney share your browsing and viewing activity with outside advertising companies that use this data to show you targeted ads across the internet, not just on Disney or Hulu properties.

Why it matters (compliance & governance perspective)

This clause means your Hulu activity can follow you to unrelated websites in the form of targeted ads, and the advertising companies receiving your data operate under their own privacy policies, which may differ from Disney's.

Consumer impact (what this means for users)

Your viewing and browsing activity on Hulu may be shared with third-party advertising networks that track you across the broader internet, resulting in targeted advertising on non-Disney websites and apps based on your Hulu usage.

What you can do

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: This provision engages the FTC Act's unfair or deceptive practices standards regarding cross-context behavioral advertising disclosure. Under the CCPA/CPRA, sharing personal information with advertising partners for cross-context behavioral advertising constitutes 'sharing' and triggers opt-out obligations for California residents. The use of pixel tags and web beacons also engages the EU's ePrivacy Directive for EU users, requiring consent for non-essential cookies and tracking technologies. (2) GOVERNANCE EXPOSURE: Medium. The practice of sharing user data with advertising technology vendors via cookies and pixel tags is widespread, but the CPRA's definition of 'sharing' means this practice must be covered by an accessible opt-out mechanism for California residents. The policy acknowledges this practice and provides opt-out mechanisms, reducing governance exposure, but ongoing monitoring is required to ensure all advertising technology integrations are reflected in disclosures. (3) JURISDICTION FLAGS: California residents have the right to opt out of sharing for cross-context behavioral advertising under the CPRA. EU and UK users require consent for non-essential tracking technologies under the ePrivacy Directive, which must be implemented through a compliant cookie consent mechanism. Global users should be aware that third-party advertising companies operate under their own privacy policies. (4) CONTRACT AND VENDOR IMPLICATIONS: Advertising technology vendors and data analytics companies receiving data through pixel tags and web beacons should be classified as third parties rather than service providers if they use the data for their own commercial purposes, which has implications for CPRA opt-out obligations and the scope of data processing agreements. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should audit all active advertising technology integrations to confirm they are reflected in the policy's disclosures, verify that the cookie consent mechanism for EU/UK users complies with ePrivacy Directive requirements, and confirm that California opt-out signals are technically propagated to all advertising technology vendors receiving user data.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• VPPA Video Viewing Record Disclosure and Opt-Out high
• Do Not Sell or Share My Personal Information (California) medium
• Cross-Disney-Service Data Integration and Profiling medium
• Children's Data Collection and COPPA Compliance medium
• Precise Geolocation Data Collection medium
• EU and UK User Rights Under GDPR medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.