Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy discloses that OpenSea collects wallet addresses and records of NFT transactions conducted on its platform, and acknowledges that blockchain transactions are publicly visible and cannot be made private through the platform's privacy controls.
This analysis describes what OpenSea's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that wallet addresses are treated as personal data subject to the policy's terms, while simultaneously acknowledging that on-chain activity is publicly accessible by the nature of blockchain infrastructure, which creates a practical boundary on the scope of privacy rights OpenSea can fulfill with respect to transaction data that exists on public ledgers.
Interpretive note: The exact verbatim text of the wallet address and blockchain data collection provision was not fully extractable from the rendered HTML document; description is based on content inferred from the policy's disclosed subject matter and standard OpenSea policy language.
Under this provision, users' wallet addresses and on-chain transaction histories are collected and treated as personal data, but the public and immutable nature of blockchain records means that data deletion rights under GDPR or CCPA cannot apply to the on-chain record itself, only to OpenSea's off-chain storage of that data.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
To stop us collecting your location information, you can update your device settings, stop using the Service, or uninstall our mobile apps.
Monitoring
OpenSea has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
(1) REGULATORY LANDSCAPE: This provision implicates GDPR Article 17 (right to erasure) and Article 5 (data minimization and storage limitation) for EEA users, as well as CCPA deletion rights for California residents. The blockchain immutability characteristic creates a direct tension with erasure obligations under GDPR, which has been noted by regulators including the European Data Protection Board. The FTC may also have interest in whether the policy's description of the limits of privacy controls is adequately disclosed. (2) GOVERNANCE EXPOSURE: High. The treatment of publicly visible blockchain data as personal data subject to erasure rights, without a clear technical mechanism for fulfilling those rights on-chain, creates compliance exposure under GDPR. If OpenSea receives erasure requests for wallet addresses or transaction data that exist on a public blockchain, the platform's ability to comply is structurally constrained. The policy should explicitly describe what actions it takes in response to such requests. (3) JURISDICTION FLAGS: EEA and UK users face the highest exposure given GDPR and UK GDPR erasure rights. California residents have CCPA deletion rights that apply to OpenSea's off-chain data holdings. Illinois and other states with emerging privacy laws may also apply. Jurisdictions with data localization requirements may add additional complexity for cross-border NFT transactions. (4) CONTRACT AND VENDOR IMPLICATIONS: Blockchain infrastructure providers and node operators used by OpenSea are not party to the policy's data processing obligations, meaning the policy's privacy commitments cannot extend to the public blockchain layer. Procurement teams should assess whether data processing agreements with blockchain-adjacent vendors address this limitation. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should document the specific categories of data OpenSea holds off-chain versus those that exist solely on-chain, and establish a clear response protocol for erasure requests that distinguishes between what can be deleted from OpenSea's systems and what persists on the blockchain. The policy should be reviewed to ensure this distinction is communicated clearly to users.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes that wallet addresses are treated as personal data subject to the policy's terms, while simultaneously acknowledging that on-chain activity is publicly accessible by the nature of blockchain infrastructure, which creates a practical boundary on the scope of privacy rights OpenSea can fulfill with respect to transaction data that exists on public ledgers.
Under this provision, users' wallet addresses and on-chain transaction histories are collected and treated as personal data, but the public and immutable nature of blockchain records means that data deletion rights under GDPR or CCPA cannot apply to the on-chain record itself, only to OpenSea's off-chain storage of that data.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenSea.