Third-Party Advertising Cookies and Cross-Site Tracking

What it is

The policy states that Oscar uses third-party advertising cookies and related technologies to share identifying information and online activity with advertising partners for interest-based advertising, and that ad technology companies may track users across multiple websites over time. The policy explicitly states this advertising activity does not involve Protected Health Information.

Why it matters (compliance & governance perspective)

This provision establishes that cross-site behavioral tracking and sharing of online activity with advertising partners occurs through Oscar's Sites; the policy provides an opt-out mechanism via the 'Your Privacy Choices' footer link and states that GPC signals are processed, though it acknowledges GPC technology is not fully developed and not supported by all browsers.

Consumer impact (what this means for users)

Under this provision, identifying information and online activity from Oscar's Sites may be shared with advertising partners who track users across multiple websites to build interest-based profiles. Users may opt out by selecting 'Your Privacy Choices' in the site footer, toggling off Targeting Cookies, and confirming choices; this process must be repeated on each browser and device.

What you can do

Institutional analysis (regulatory & governance intelligence)

1) REGULATORY LANDSCAPE: This provision implicates CCPA and CPRA opt-out of sale or sharing requirements, the FTC Act's authority over unfair or deceptive advertising practices, and state consumer privacy statutes in the approximately eighteen additional named states. The policy's acknowledgment that it processes GPC signals engages California's enforceable GPC requirement under the CPRA. The FTC has issued guidance on cross-context behavioral advertising. 2) GOVERNANCE EXPOSURE: Medium. The policy's acknowledgment that GPC technology is 'not fully developed' and 'not yet supported by all browsers' may be evaluated by regulators against California's requirement that GPC signals be honored as valid opt-out requests. Compliance teams should assess whether GPC processing is operationally implemented to the standard required by the California Privacy Protection Agency. 3) JURISDICTION FLAGS: California creates the highest exposure given CPPA enforcement of GPC signal requirements. Colorado's and Connecticut's privacy statutes also include opt-out of targeted advertising requirements. The policy's explicit carve-out stating that advertising cookies do not involve PHI should be verified against actual data flows to confirm that health-adjacent inferences are not flowing through the advertising technology stack. 4) CONTRACT AND VENDOR IMPLICATIONS: Ad technology vendor contracts should be reviewed to confirm that they include data use restrictions consistent with the policy's stated carve-out on PHI and that they do not create data flows that would constitute a sale or sharing of PHI. The policy notes that third-party cookies and technologies are governed by each third party's privacy notice, which shifts some governance responsibility to those vendors. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should conduct a technical audit of the opt-out mechanism to confirm that Targeting Cookie blocking is fully functional across all browsers and devices and that GPC signals are processed consistently. The opt-out workflow described in the policy (three steps including confirmation) should be tested for accessibility and functionality. Records of opt-out requests should be maintained consistent with applicable state law retention requirements.

Applicable agencies

Provision details

Other risks in this policy

• Use of PI for marketing and advertising medium
• Account permanently terminated upon deletion request high
• Acknowledgment of notice terms by use high
• California PI sold or shared with third parties high
• Collection of direct personal identifiers high
• Disclosure to third party ad networks high