Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy explicitly states that the website may sell sensitive personal data, and that users have a right to opt out of the sale or sharing of their personal information and to limit use of sensitive personal information to service delivery purposes only.
This analysis describes what Noom's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision constitutes a formal notice under CPRA and analogous state statutes that sensitive personal information, which the policy defines to include health data and demographic data such as racial or ethnic origin and religion, may be sold to third parties, including advertising partners. The opt-out right is available but requires affirmative user action through the 'Your Privacy Choices' mechanism.
The agreement discloses that sensitive personal data, including health and demographic information, may be sold or shared with advertising and marketing partners, and that users may opt out of this disclosure by visiting the 'Your Privacy Choices' page. Without taking this opt-out action, the terms authorize continued sale or sharing of sensitive personal information for marketing and advertising purposes.
Cross-platform context
See how other platforms handle Sale of Sensitive Personal Data to Advertising Partners and similar clauses.
Compare across platforms →Monitoring
Noom has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"NOTICE: This website may sell your sensitive personal data. You have a right to opt-out from the 'sale' or 'sharing' of your personal information. You also have a right to limit our use of sensitive personal information for purposes other than to provide Noom. Please visit Your Privacy Choices if you do not wish for us or our partners to share information relating to you and your use of Noom for marketing and advertising purposes.Excerpt from Noom's Privacy Policy
(1) REGULATORY LANDSCAPE: The explicit notice that 'this website may sell your sensitive personal data' is a disclosure required under CPRA for businesses that sell or share sensitive personal information. Under CPRA, consumers have the right to opt out of sale or sharing and the right to limit use of sensitive personal information. Washington's My Health My Data Act may impose consent requirements (rather than opt-out) for certain health data disclosures to advertising partners, creating a potential tension with Noom's opt-out model. The FTC has issued guidance and enforcement actions regarding health data sharing practices by consumer technology platforms. (2) GOVERNANCE EXPOSURE: High. The combination of health data and sensitive demographic data categories in advertising-related data flows is subject to heightened scrutiny under both CPRA and emerging state health data statutes. Washington's My Health My Data Act reference in the policy suggests Noom has identified this exposure, but the nature of consent mechanisms in that context warrants independent review. (3) JURISDICTION FLAGS: California (CPRA sensitive data sale opt-out); Washington state (My Health My Data Act, which may require affirmative consent rather than opt-out for health data sharing with advertisers); Nevada (SB 370, referenced in the policy); other states with comprehensive privacy laws recognizing sensitive data categories. (4) CONTRACT AND VENDOR IMPLICATIONS: Advertising and analytics vendors receiving sensitive personal information must be assessed for compliance with applicable state law restrictions on downstream use of sensitive data. Data processing agreements should specify that sensitive personal information received through Noom's advertising data flows may not be used for purposes beyond those permitted under applicable law. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should verify that the 'Your Privacy Choices' opt-out mechanism satisfies the technical requirements of CPRA and applicable state frameworks; confirm whether Washington My Health My Data Act requires opt-in consent rather than opt-out for health data shared with advertisers; and assess whether the categories of sensitive data flowing to advertising partners are disclosed with sufficient specificity in the notice at collection.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision constitutes a formal notice under CPRA and analogous state statutes that sensitive personal information, which the policy defines to include health data and demographic data such as racial or ethnic origin and religion, may be sold to third parties, including advertising partners. The opt-out right is available but requires affirmative user action through the 'Your Privacy Choices' mechanism.
The agreement discloses that sensitive personal data, including health and demographic information, may be sold or shared with advertising and marketing partners, and that users may opt out of this disclosure by visiting the 'Your Privacy Choices' page. Without taking this opt-out action, the terms authorize continued sale or sharing of sensitive personal information for marketing and advertising purposes.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Noom.