Third-Party Data Sharing for Advertising and Analytics

What it is

MyFitnessPal shares your personal data, potentially including health and fitness information, with outside companies for advertising, marketing, and analytics purposes.

Why it matters (compliance & governance perspective)

Sharing health-related data with advertising and analytics partners extends the reach of your personal information beyond MyFitnessPal and into third-party systems where your control over that data is significantly reduced.

Consumer impact (what this means for users)

Your fitness and dietary data may be shared with advertising and analytics companies, meaning information you log for personal health purposes could influence how you are targeted by advertisers across the broader internet.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: Third-party data sharing for advertising engages CCPA/CPRA's definition of 'sharing' personal information for cross-context behavioral advertising, triggering opt-out rights for California residents. Under GDPR, transfers of personal data to third-party advertising partners require a valid legal basis and, for transfers outside the EU/EEA, appropriate transfer mechanisms such as Standard Contractual Clauses. The FTC Act applies to any deceptive representations about data sharing practices. GOVERNANCE EXPOSURE: High. The combination of sensitive health data and advertising-purpose third-party sharing creates compounded regulatory exposure. California's CPRA introduced specific rules around sharing (distinct from sale) of personal information, and the California Privacy Protection Agency has indicated advertising data sharing is a priority enforcement area. JURISDICTION FLAGS: California residents have a statutory right to opt out of sharing for cross-context behavioral advertising under CPRA. EU/EEA users require a valid GDPR legal basis for each third-party recipient, and international data transfers require compliant transfer mechanisms. States including Virginia, Colorado, and Connecticut have analogous opt-out rights for targeted advertising that may apply. CONTRACT AND VENDOR IMPLICATIONS: Each advertising and analytics partner receiving MyFitnessPal user data should have a data processing agreement in place. Procurement teams evaluating MyFitnessPal as a platform should assess whether downstream data flows comply with applicable data localization and transfer rules. The breadth of the partner category (advertising, analytics, data enrichment) suggests a large vendor ecosystem warranting audit. COMPLIANCE CONSIDERATIONS: Legal teams should verify that MyFitnessPal's opt-out mechanisms for data sharing are functional, prominent, and effective across all channels (web and mobile). A review of the advertising technology stack should confirm that sensitive health data is appropriately flagged and restricted from certain programmatic advertising contexts, consistent with IAB and NAI guidelines and applicable law.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Collection and Use of Health and Fitness Data high
• Connected Third-Party Apps and Wearables Data Collection medium
• California Residents' Privacy Rights medium
• EU/EEA Users Data Subject Rights medium
• Data Retention medium
• Use of Cookies and Tracking Technologies medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.