Third-Party Data Sharing for Marketing and Analytics

What it is

One Identity can share your personal data with affiliated companies, outside vendors, and business partners, including for marketing purposes and not just to deliver services you requested.

Why it matters (compliance & governance perspective)

Data sharing with business partners for promotions goes beyond what most users expect from an identity management vendor and may result in your contact information being used for third-party marketing purposes.

This document changed recently

Consumer impact (what this means for users)

Your contact information and usage data may be shared with business partners who can use it to offer you products or services unrelated to the One Identity service you signed up for. This sharing is disclosed but may not require your active consent in all jurisdictions.

What you can do

Institutional analysis (Compliance & governance intelligence)

1) REGULATORY LANDSCAPE: This provision implicates GDPR Articles 6 and 13 regarding lawful basis and transparency for data sharing, CCPA/CPRA provisions on disclosure of data sharing with third parties and the right to opt out of sale or sharing, and FTC Act principles on unfair or deceptive practices. The relevant enforcement authorities are EU Data Protection Authorities, the California Privacy Protection Agency, and the FTC. The breadth of 'business partners' sharing for promotional purposes may require evaluation under GDPR's purpose limitation principle and CCPA's definition of 'sharing' for cross-context behavioral advertising. 2) GOVERNANCE EXPOSURE: Medium. The provision broadly authorizes sharing with business partners for promotions without specifying the categories of partners or the controls applied to such sharing. Under CCPA/CPRA, sharing personal information for cross-context behavioral advertising constitutes 'sharing' subject to opt-out rights regardless of monetary exchange, which may require an opt-out mechanism if One Identity shares data with advertising or analytics partners. 3) JURISDICTION FLAGS: California residents have a right to opt out of sharing under CPRA. EU/EEA users are entitled to know the specific legal basis for sharing with business partners; legitimate interests assertions for promotional sharing may face scrutiny from DPAs. UK GDPR imposes similar transparency obligations. Organizations processing employee data through One Identity may face additional obligations under local employment data protection laws. 4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise procurement teams should request a sub-processor list and Data Processing Agreement that clearly delineates which third-party vendors receive personal data, the purposes for which they receive it, and what contractual restrictions apply. The reference to 'business partners' for promotions is distinct from sub-processors and should be evaluated separately in vendor risk assessments. 5) COMPLIANCE CONSIDERATIONS: Legal teams should assess whether One Identity's business partner sharing for promotional purposes triggers CPRA opt-out obligations and whether a 'Do Not Sell or Share My Personal Information' link is required on properties targeting California users. Data mapping should be updated to reflect all third-party recipients and the purposes of transfer. GDPR-covered organizations should verify that legitimate interests assessments or consent mechanisms are documented for promotional data sharing.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Data Retention Without Fixed Periods medium
• International Data Transfers via Standard Contractual Clauses medium
• Cookie and Tracking Technology Use low
• GDPR and CCPA Data Subject Rights medium
• Data Collection from Third-Party Sources medium
• Marketing Communications and Opt-Out low

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.