Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The document states that Marqeta supplements internally collected data with personal data obtained from data providers and aggregators, social media sources, co-branded marketing partners, third-party service providers acting on Marqeta's behalf, and public sources including social networking websites.
This analysis describes what Marqeta's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The use of data providers and aggregators to supplement first-party data collection is a practice that may require evaluation under applicable law, particularly regarding notice and consent obligations in jurisdictions where data subjects have not directly provided their information to Marqeta. GDPR's transparency requirements under Article 14 apply where personal data is not obtained directly from the data subject.
Interpretive note: The document identifies categories of third-party data sources but does not name specific vendors or aggregators; the specific data types obtained from each source category cannot be determined from the document language alone.
Under this provision, Marqeta's profile of an individual may include personal data sourced from data brokers, aggregators, social media platforms, marketing partners, and public sources in addition to data the individual directly provided, without requiring the individual to have a direct interaction with those third-party sources.
Cross-platform context
See how other platforms handle Third-Party Data Sources and Supplementation and similar clauses.
Compare across platforms →Monitoring
Marqeta has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Certain personal data may be collected or obtained from third-party sources, such as marketing vendors, social media sources, participation in industry conferences and events, and other sources to the extent permitted by applicable law, including: 1) data providers and aggregators from whom we obtain personal data to supplement the information we collect; 2) third-party applications and services, including social networks you choose to connect with or interact with through our Services; 3) partners with whom we offer co-branded services or engage in joint marketing activities; 4) third parties that collect or provide information in connection with work they do on our behalf; and 5) public sources of information, such as social networking websites.Excerpt from Marqeta's Privacy Policy
1. REGULATORY LANDSCAPE: This provision engages GDPR Article 14, which requires that where personal data is not obtained directly from the data subject, the controller must provide the data subject with specific information about the data source within a reasonable period. The FTC's enforcement posture on data broker practices and the CCPA's provisions on categories of sources of personal information are also relevant. Canadian privacy law under PIPEDA requires that collection be for purposes a reasonable person would consider appropriate. 2. GOVERNANCE EXPOSURE: Medium. The use of data aggregators and marketing vendors to supplement first-party data creates exposure under GDPR Article 14 notice requirements for EEA and UK residents whose data is obtained indirectly. Compliance teams should confirm that supplemental data obtained from third-party sources is disclosed in records of processing activities and that appropriate notice is provided where required. 3. JURISDICTION FLAGS: GDPR Article 14 notice obligations for indirectly obtained data apply to EEA and UK residents. California's CCPA requires disclosure of categories of sources from which personal information is collected, which this document satisfies in the CCPA data summary table. Residents of other U.S. states with enacted privacy laws may also have rights to know the categories of sources of their personal data. 4. CONTRACT AND VENDOR IMPLICATIONS: Data processing agreements with data aggregators and marketing vendors must address the lawful basis for the transfer of personal data to Marqeta, the accuracy and currency of the data supplied, and compliance with applicable data protection law in the jurisdictions where the data subjects are located. Procurement teams should assess whether data aggregator vendors maintain appropriate data subject notice mechanisms. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should confirm that GDPR Article 14 notice obligations for indirectly obtained data are met, including disclosure of the categories of personal data, the purposes and legal bases for processing, and information about the data source. Data mapping exercises should document which categories of personal data are sourced from third parties and which vendors supply that data, to support both rights request responses and regulatory inquiry.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The use of data providers and aggregators to supplement first-party data collection is a practice that may require evaluation under applicable law, particularly regarding notice and consent obligations in jurisdictions where data subjects have not directly provided their information to Marqeta. GDPR's transparency requirements under Article 14 apply where personal data is not obtained directly from the data subject.
Under this provision, Marqeta's profile of an individual may include personal data sourced from data brokers, aggregators, social media platforms, marketing partners, and public sources in addition to data the individual directly provided, without requiring the individual to have a direct interaction with those third-party sources.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Marqeta.