Third-Party Data Sharing Including Advertising and Data Brokers

What it is

NVIDIA may share your personal data with advertising companies, analytics providers, business partners, and data brokers, which may result in targeted advertising or further data processing by those third parties.

Why it matters (compliance & governance perspective)

The policy authorizes sharing of personal data with data brokers and advertising networks, which may result in your information being used or combined with other data sets beyond NVIDIA's direct control.

Consumer impact (what this means for users)

Under this provision, personal data including identifiers, browsing activity, and device information may be shared with advertising partners, analytics vendors, and data brokers; California residents have the right to opt out of the sale or sharing of their personal information under CPRA.

What you can do

Institutional analysis (Compliance & governance intelligence)

1) REGULATORY LANDSCAPE: This provision implicates CCPA/CPRA, which grants California residents the right to opt out of the sale or sharing of personal information with third parties for cross-context behavioral advertising; sharing with data brokers triggers CPRA's expanded opt-out provisions. GDPR Articles 6 and 28 require a lawful basis and data processing agreements for sharing with third-party processors and controllers. The FTC Act Section 5 applies to disclosures regarding third-party sharing practices. State consumer protection statutes in Virginia (CDPA), Colorado (CPA), Connecticut, and Texas may also engage depending on user location. 2) GOVERNANCE EXPOSURE: Medium. The authorization to share with data brokers and advertising networks is operationally significant and requires that opt-out mechanisms are functional, prominently disclosed, and jurisdiction-compliant. Under CPRA, sharing personal information for cross-context behavioral advertising constitutes a sharing event triggering opt-out rights regardless of monetary exchange, and failure to honor opt-out requests within 15 business days creates regulatory exposure with the California Privacy Protection Agency. 3) JURISDICTION FLAGS: California creates the most defined regulatory exposure given CPRA's explicit opt-out of sale and sharing rights and the CPPA's enforcement authority. EU/EEA users are protected by GDPR's consent or legitimate interests requirements for behavioral advertising; the ePrivacy Directive applies to cookie-based advertising tracking. Virginia, Colorado, Connecticut, and other US states with comprehensive privacy laws also engage. 4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should verify that all named categories of third-party recipients have signed data processing agreements or controller-to-controller agreements as appropriate. Data broker relationships require particular scrutiny under CPRA's broker registry requirements in California. B2B customers integrating NVIDIA services should assess whether downstream sharing with NVIDIA's advertising partners is disclosed in their own user-facing privacy documentation. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should audit the list of advertising and analytics vendors receiving data to ensure current agreements are in place; verify that opt-out of sale and sharing mechanisms for California users are functional and honored within required timelines; review cookie consent mechanisms for EU/EEA users to ensure behavioral advertising consent is obtained before data is shared with advertising partners; and update data maps to reflect all third-party sharing relationships disclosed in this policy.

Applicable agencies

Provision details

Other risks in this policy

• AI Training Data Use high
• Consumer Data Subject Rights (Access, Deletion, Portability, Objection) medium
• Cross-Border Data Transfers medium
• Children and Minors Data Restriction low
• Data Retention low