Luma may buy or obtain personal information about you from data brokers, marketing partners, and public sources, and combine it with data it already holds about you.
This analysis describes what Luma AI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Users may not be aware that Luma can build a more detailed profile of them by combining data from external sources with account and usage data, potentially without direct interaction from the user.
Interpretive note: The provision does not specify the categories or sources of third-party data, making it difficult to assess the full scope of data combined with user profiles; GDPR Article 14 notice adequacy depends on how this is implemented in practice.
Luma may augment your profile with personal information obtained from third-party data providers and marketing partners, meaning the data Luma holds about you could be broader than what you directly provided. This is disclosed but no specific opt-out mechanism for third-party data sourcing is described in the policy.
How other platforms handle this
We will also provide an individual opt-out choice, or opt-in for sensitive data, before we share your data with third parties other than our agents, or before we use it for a purpose other than which it was originally collected.
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
"Other Sources. We may obtain your personal information from other third parties, such as marketing partners, publicly available sources, and data providers, and combine it with other information we have about you.Excerpt from Luma AI's Privacy Policy
REGULATORY LANDSCAPE: This provision engages GDPR Article 14, which requires that data controllers notify individuals when personal data is obtained from sources other than the data subject, including the categories of data and the source.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Users may not be aware that Luma can build a more detailed profile of them by combining data from external sources with account and usage data, potentially without direct interaction from the user.
Luma may augment your profile with personal information obtained from third-party data providers and marketing partners, meaning the data Luma holds about you could be broader than what you directly provided. This is disclosed but no specific opt-out mechanism for third-party data sourcing is described in the policy.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Luma AI.