Third-Party Advertising and Analytics Vendor Sharing

What it is

Mixpanel shares personal data including identifiers and behavioral information with outside companies that provide advertising, analytics, and marketing services on Mixpanel's behalf.

Why it matters (compliance & governance perspective)

This provision authorizes disclosure of personal data to advertising and analytics third parties, which may result in your behavioral data being used to inform targeted advertising outside of Mixpanel's own platform.

Consumer impact (what this means for users)

The policy authorizes sharing of identifiers, behavioral data, and usage information with advertising and analytics vendors; California residents have the right to opt out of the sale or sharing of personal information for cross-context behavioral advertising under CCPA/CPRA.

What you can do

Institutional analysis (Compliance & governance intelligence)

1) REGULATORY LANDSCAPE: Sharing personal data with advertising and analytics vendors engages GDPR's requirements for lawful basis (Article 6) and, where cookies or device identifiers are involved, the ePrivacy Directive. Under CCPA/CPRA, sharing personal data with advertising partners for cross-context behavioral advertising may constitute 'sharing' subject to opt-out rights, enforceable by the California Privacy Protection Agency and California Attorney General. The FTC has authority over deceptive data sharing practices under Section 5 of the FTC Act. 2) GOVERNANCE EXPOSURE: Medium. The breadth of the vendor sharing authorization requires that organizations deploying Mixpanel assess whether their own privacy notices accurately reflect downstream advertising data flows. For EU deployments, each advertising or analytics vendor receiving personal data must be covered by an appropriate transfer mechanism if located outside the EEA. 3) JURISDICTION FLAGS: EU and UK users are protected by GDPR and UK GDPR consent requirements for advertising-related data sharing; California residents hold opt-out rights under CCPA/CPRA. Sharing with advertising vendors may also engage state privacy laws in Virginia, Colorado, Connecticut, and Texas, among others, depending on user geography. 4) CONTRACT AND VENDOR IMPLICATIONS: Business customers using Mixpanel should confirm that their own vendor agreements and data flows account for Mixpanel's sub-processor and advertising partner relationships. Where Mixpanel's advertising vendor sharing occurs in the context of Mixpanel acting as a processor, customers should review the sub-processor list for advertising-related entities. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should review whether Mixpanel's advertising partner sharing is reflected in their own privacy notices and consent banners. California-resident-facing products should surface Mixpanel's opt-out mechanism or ensure their own opt-out flows include Mixpanel's tracking.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Controller and Processor Dual-Role Structure high
• CCPA Opt-Out of Sale or Sharing of Personal Information medium
• EU-U.S. Data Privacy Framework Certification medium
• Data Retention Policy medium
• Data Subject Rights (Access, Correction, Deletion, Portability) medium
• Cookies and Tracking Technologies medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.