Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that NVIDIA collects personal data including names, titles, work areas, publication histories, funding histories, mentions of NVIDIA technology, email addresses, phone numbers, and organizational affiliations from publicly available internet sources without direct interaction from the data subject, relying on legitimate interest as the lawful basis.
This analysis describes what NVIDIA NIM's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes data collection on individuals who have not directly engaged with NVIDIA, using legitimate interest as the stated lawful basis, which may require evaluation under GDPR's balancing test and transparency obligations for EU and UK data subjects. The data categories collected include contact information and professional histories sourced from public internet content.
The updated Privacy Policy removes all disclosure language about how NVIDIA and third-party partners use cookies and other tracking technologies. Previously, the policy stated that cookies were used 'to collect and record information' for 'performance improvement, analytics, and to assist in our marketing efforts' and described consent mechanisms like 'Accept All' and 'Manage Settings'. The updated policy contains no equivalent disclosure of these tracking practices, data collection methods, or consent options. You can review NVIDIA's full Privacy Policy at their Privacy Center, though the updated version no longer describes cookie and tracking technology practices that were previously disclosed.
View change record →This new provision discloses unsolicited scraping and collection of personal data from public sources for lead generation without explicit consent, which may not have been clearly disclosed in the previous version.
View full change record →Under this clause, NVIDIA states it may collect personal data about individuals from publicly available internet sources for marketing and market research purposes without a direct relationship with those individuals. The agreement states that hashed versions of this data may also be shared with advertising providers such as Google if the individual has consented to receive marketing communications.
Cross-platform context
See how other platforms handle Lead Generation from Publicly Available Sources and similar clauses.
Compare across platforms →Monitoring
NVIDIA NIM has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"We collect certain personal data from publicly available sources (e.g., the internet) to find individuals and organizations that may be interested in our products or services. The personal data we collect includes names, titles, areas of work, publication or funding histories, mentions of NVIDIA technology, and contact information including emails, phone numbers, and associated organizations or collaborations. We use this data to understand the market for our products and to communicate with potential customers or partners. We process this data based on our legitimate interest in market research and in finding and communicating with potential customers.Excerpt from NVIDIA NIM's NVIDIA Privacy Policy
1) REGULATORY LANDSCAPE: This provision engages GDPR Article 6 legitimate interest provisions and Article 14 transparency obligations for data not obtained directly from the data subject. EU and UK data protection authorities have issued guidance on the requirements for legitimate interest assessments in marketing contexts, including the requirement to provide notice to data subjects whose information is collected from third-party or public sources. The FTC may also have jurisdiction over the collection and use of publicly available personal data for commercial marketing purposes under its unfair or deceptive practices authority. 2) GOVERNANCE EXPOSURE: High for EU and UK operations. The policy asserts legitimate interest as the lawful basis for collecting publicly available personal data for lead generation, which requires a documented legitimate interest assessment under GDPR and may face challenge from EU data protection authorities, particularly where data subjects have not received Article 14 notice. For US operations, this practice is more commonly accepted and regulated primarily through opt-out and anti-spam frameworks. 3) JURISDICTION FLAGS: EU and UK data subjects have a right to object to processing based on legitimate interest under GDPR, and NVIDIA's ability to continue processing after such objection is constrained by applicable law. California residents whose publicly available data is collected may have CCPA notice-at-collection rights. The practice of collecting data from public sources including publication and funding histories may intersect with research and academic institution privacy policies in EU member states. 4) CONTRACT AND VENDOR IMPLICATIONS: The policy discloses that data collected through this provision is shared with identity enrichment providers such as 6Sense and Leadspace. Procurement teams should assess whether their organization's employees' publicly available data may be collected under this provision and whether that creates obligations under enterprise data protection agreements. B2B partners whose employees appear in public databases should confirm whether their DPAs with NVIDIA address this data collection pathway. 5) COMPLIANCE CONSIDERATIONS: Legal teams in EU and UK jurisdictions should assess whether NVIDIA's legitimate interest basis for this collection is supported by a documented balancing test and whether Article 14 notice obligations are being fulfilled. Organizations that have received unsolicited communications from NVIDIA based on publicly sourced data should evaluate whether an objection right exists under applicable law. Data mapping exercises should account for data collected about individuals who are not direct NVIDIA customers or account holders.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision authorizes data collection on individuals who have not directly engaged with NVIDIA, using legitimate interest as the stated lawful basis, which may require evaluation under GDPR's balancing test and transparency obligations for EU and UK data subjects. The data categories collected include contact information and professional histories sourced from public internet content.
Under this clause, NVIDIA states it may collect personal data about individuals from publicly available internet sources for marketing and market research purposes without a direct relationship with those individuals. The agreement states that hashed versions of this data may also be shared with advertising providers such as Google if the individual has consented to receive marketing communications.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by NVIDIA NIM.