Third-Party Data Sharing and Advertising Partners

What it is

Monday.com shares your personal data with outside companies that help run its services, including advertising and analytics firms that use your data to show you targeted ads.

Why it matters (compliance & governance perspective)

Sharing personal data with advertising partners means your usage information and identifiers may be used to build advertising profiles, which goes beyond the core purpose of using a work management tool.

Consumer impact (what this means for users)

Your personal data, including behavioral usage signals, may be shared with advertising networks and analytics providers, potentially enabling cross-context behavioral advertising based on how you use monday.com.

What you can do

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: This provision engages GDPR Article 6 (lawful basis for sharing with third parties) and Article 28 (processor agreements), CCPA/CPRA (which requires disclosure of categories of third parties data is shared with and provides opt-out rights for sale or sharing with advertising partners), and the EU ePrivacy Directive (where sharing with ad tech partners involves cookie-based identifiers). The FTC, California Privacy Protection Agency, and relevant EU supervisory authorities are the primary enforcement bodies. (2) GOVERNANCE EXPOSURE: High for organizations subject to GDPR or CPRA. Sharing data with advertising partners as a controller function requires either user consent or a documented legitimate interests assessment under GDPR. Under CPRA, sharing personal information with advertising partners for cross-context behavioral advertising is considered a 'share' that triggers opt-out rights, and monday.com must honor Global Privacy Control (GPC) signals. Failure to implement these mechanisms adequately creates enforcement exposure. (3) JURISDICTION FLAGS: EEA and UK users may have the right to object to processing for advertising purposes under GDPR Article 21. California residents under CPRA have the right to opt out of sharing personal information with advertising partners without needing to characterize the activity as a 'sale.' Organizations in other US states with comprehensive privacy laws (Virginia, Colorado, Connecticut, Texas) should evaluate whether similar opt-out rights apply to their employees or users. (4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers should confirm in the Data Processing Addendum whether monday.com's advertising data flows apply to customer account data or are limited to visitor and marketing data. The scope of sub-processor agreements with advertising partners should be reviewed for adequacy of data protection obligations. Organizations should assess whether their acceptable use policies permit employee work data to flow into advertising analytics pipelines. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should audit the cookie consent mechanism to confirm that advertising and analytics cookies are only activated upon affirmative consent in GDPR-regulated jurisdictions. The 'Do Not Sell or Share' opt-out mechanism should be tested to confirm it functions correctly and that GPC signals are honored. Internal privacy notices to employees using monday.com as a corporate tool should disclose third-party advertising data sharing if applicable.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Data Collection Scope medium
• Cross-Border Data Transfers medium
• Controller vs. Processor Distinction medium
• Cookies and Tracking Technologies medium
• User Rights and Data Access Requests medium
• AI Feature Data Processing medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.