Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that OnlyFans does not sell personal data, does not share personal data for targeted or cross-context behavioural advertising, and does not use cross-site tracking technologies, while disclosing that sensitive information including partial payment card data, government identifiers, usernames and passwords, and biometric data may be disclosed to service providers for business purposes.
This analysis describes what OnlyFans's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision makes explicit data practice representations that engage CCPA opt-out rights and Nevada law requirements. The policy simultaneously confirms no data sale or targeted advertising while disclosing that sensitive information categories are shared with service providers for operational purposes, which the policy characterizes as business purpose disclosures rather than sales.
Under this clause, users' personal data is not sold or shared for targeted advertising or cross-context behavioural advertising purposes, and no cross-site tracking technologies are stated to be in use. Sensitive information including government identifiers, partial payment card data, and biometric information processed by third parties may be disclosed to service providers for operational purposes as described in the policy.
Cross-platform context
See how other platforms handle Sensitive Information and No Targeted Advertising Disclosure and similar clauses.
Compare across platforms →Monitoring
OnlyFans has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"No sales for targeted advertising: We do not sell or share Personal Data for the purpose of displaying advertisements that are selected based on Personal Data obtained or inferred over time from an individual's activities across businesses or distinctly-branded websites, applications, or other services (otherwise known as 'targeted advertising'). [...] We currently do not use any cross-site tracking technologies and we do not sell Personal Data collected about you, or share Personal Data collected about you for cross-context behavioural advertising.Excerpt from OnlyFans's Privacy Policy
1) REGULATORY LANDSCAPE: This provision directly engages CCPA/CPRA definitions of 'sale' and 'sharing' for cross-context behavioural advertising, Nevada SB 220 opt-out requirements, and the FTC Act's prohibition on unfair or deceptive practices as applied to data sharing representations. The policy's Nevada-specific disclosure acknowledges the opt-out right while stating no sale occurs. CPRA's sensitive personal information framework applies to the enumerated sensitive categories disclosed. 2) GOVERNANCE EXPOSURE: Medium. The explicit no-sale and no-targeted-advertising representations create material accuracy obligations: if future operational practices involve data sharing arrangements that meet the CCPA/CPRA definitions of 'sale' or 'sharing,' the policy would require update. The policy's treatment of Referral Program personal data processing and the associated Notice of Financial Incentives disclosure may require evaluation under CCPA financial incentive disclosure requirements. 3) JURISDICTION FLAGS: California CPRA imposes opt-in consent requirements for use of sensitive personal information beyond specified purposes. The policy's enumeration of sensitive information categories aligns with CPRA definitions. Nevada SB 220 is addressed by a specific disclosure. Virginia VCDPA, Colorado CPA, and Connecticut CTDPA contain analogous targeted advertising opt-out rights that the policy's no-sharing statement would address by operation. 4) CONTRACT AND VENDOR IMPLICATIONS: Legal teams should confirm that service provider agreements include CCPA-required contractual prohibitions on further sale or use of personal data beyond the specified business purpose, and that the characterization of third-party sharing as 'business purpose disclosure' rather than 'sale' is supported by compliant contract language with each recipient category. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should evaluate: whether the Cookie Notice referenced in the policy is consistent with the no-cross-site-tracking representation; whether the Referral Program Notice of Financial Incentives valuation methodology satisfies CCPA requirements; whether sensitive information handling by service providers is governed by CPRA-compliant contractual restrictions; and whether any future changes to advertising or tracking practices would trigger policy update and re-consent obligations.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision makes explicit data practice representations that engage CCPA opt-out rights and Nevada law requirements. The policy simultaneously confirms no data sale or targeted advertising while disclosing that sensitive information categories are shared with service providers for operational purposes, which the policy characterizes as business purpose disclosures rather than sales.
Under this clause, users' personal data is not sold or shared for targeted advertising or cross-context behavioural advertising purposes, and no cross-site tracking technologies are stated to be in use. Sensitive information including government identifiers, partial payment card data, and biometric information processed by third parties may be disclosed to service providers for operational purposes as described in the policy.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OnlyFans.