Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that Oscar may sell or share identifiers, commercial information, online activity, non-precise geolocation data, and inferences with marketing partners, advertising services, analytics providers, social networks, and consumer data resellers for online advertising and content personalization purposes. Residents of California and approximately eighteen other named states have the right to opt out of this activity.
This analysis describes what Oscar Health's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision creates opt-out obligations under CCPA, the California Privacy Rights Act, and analogous statutes in the approximately eighteen additional states named in the policy, and the explicit inclusion of consumer data resellers as recipients is a materially specific disclosure that compliance teams should map against data processing agreements and vendor classifications.
Under this provision, Oscar may disclose identifiers, browsing activity, commercial information, and inferences to third-party ad networks, social networks, analytics providers, and consumer data resellers. Residents of the approximately nineteen named states, including California, may submit an opt-out request by selecting 'Your Privacy Choices' in the website footer or calling 1-855-672-2755.
Cross-platform context
See how other platforms handle Data Sale and Sharing with Third Parties and similar clauses.
Compare across platforms →Monitoring
Oscar Health has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"The following information may be 'sold' or 'shared' with third parties (as such terms are defined under applicable state privacy laws) such as marketing partners, online advertising services, third party data analytics providers, social networks and/or consumer data resellers – primarily identifiers, commercial information, online activity, (non-precise) geolocation data, and inferences. These activities are primarily to engage in online advertising activities and provide tailored content and ads that may be of interest to you. You have the right to opt out of this disclosure of your information, as detailed above.Excerpt from Oscar Health's Privacy Policy
1) REGULATORY LANDSCAPE: This provision implicates the California Consumer Privacy Act and California Privacy Rights Act, enforced by the California Privacy Protection Agency and California Attorney General, as well as state privacy statutes in Colorado, Connecticut, Texas, Virginia, Oregon, and approximately fifteen additional named states. The use of the terms 'sold' and 'shared' tracks CCPA statutory definitions and triggers opt-out notice and mechanism requirements. The FTC Act may also be relevant where data sharing with consumer data resellers involves practices that could be evaluated as unfair or deceptive. 2) GOVERNANCE EXPOSURE: High. The explicit disclosure that personal data is sold or shared with consumer data resellers is a specific and operationally significant admission that triggers verified opt-out mechanism requirements under multiple state frameworks. Failure to maintain functional opt-out mechanisms, including GPC signal processing as referenced in the policy, creates direct regulatory exposure in California and other active enforcement states. 3) JURISDICTION FLAGS: California creates the highest enforcement exposure given CPPA rulemaking and enforcement activity. Colorado, Connecticut, Virginia, and Texas also have active statutory frameworks requiring opt-out mechanisms for data sales and targeted advertising. The policy's geographic scope is limited to U.S. users; EU/EEA users are not addressed for GDPR consent-based sharing requirements, which may be relevant if any EU-resident users access the platform. 4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should verify that data processing agreements with consumer data resellers, ad networks, and analytics providers include adequate use restrictions and that vendor classifications align with the policy's service provider versus third-party distinction. The policy states that service providers are required by contract to protect personal information, but does not apply that contractual protection language to the third-party sale and sharing category, which is a material distinction. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should audit the functionality of the 'Your Privacy Choices' opt-out mechanism and GPC signal processing to confirm they operate as described in the policy. Data mapping should confirm that the categories listed as sold or shared align with actual data flows to named third-party categories. Opt-out request logs and response timelines should be reviewed against applicable state law requirements.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision creates opt-out obligations under CCPA, the California Privacy Rights Act, and analogous statutes in the approximately eighteen additional states named in the policy, and the explicit inclusion of consumer data resellers as recipients is a materially specific disclosure that compliance teams should map against data processing agreements and vendor classifications.
Under this provision, Oscar may disclose identifiers, browsing activity, commercial information, and inferences to third-party ad networks, social networks, analytics providers, and consumer data resellers. Residents of the approximately nineteen named states, including California, may submit an opt-out request by selecting 'Your Privacy Choices' in the website footer or calling 1-855-672-2755.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Oscar Health.