Third-Party Advertising SDK Data Sharing

What it is

Paramount+ embeds tracking tools from companies like Facebook, Google, Microsoft, Kochava, and Branch directly in its platform, which means these companies receive data about your activity on the service, including what you watch.

Why it matters (compliance & governance perspective)

This provision matters because your streaming behavior is shared with multiple advertising companies simultaneously, not just used internally by Paramount+, which can result in detailed advertising profiles being built about you across the internet.

Consumer impact (what this means for users)

Your viewing history and behavioral data on Paramount+ may be transmitted to Facebook, Google, Microsoft, Kochava, and other advertising analytics providers through embedded tracking technologies, potentially without a separate opt-in for each vendor.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision implicates the Video Privacy Protection Act (VPPA), which prohibits knowing disclosure of personally identifiable video viewing records to third parties without informed written consent obtained at the time of disclosure. Recent federal litigation against streaming services embedding Meta Pixel and similar trackers has established a litigation risk profile for this practice. The FTC Act's prohibition on unfair or deceptive practices also applies if the scope of third-party data sharing is not adequately disclosed. CCPA/CPRA may classify this sharing as a 'sale' or 'share' of personal information triggering opt-out rights. GOVERNANCE EXPOSURE: High. The simultaneous embedding of advertising SDKs from Meta, Google, Microsoft, Kochava, Branch, and Adobe within the platform infrastructure creates compounded VPPA exposure because each SDK transmission of viewing data to a third party may independently constitute a VPPA disclosure. Active VPPA class action litigation against streaming platforms using Meta Pixel is well-documented in federal courts and represents a material litigation risk. JURISDICTION FLAGS: Heightened exposure exists in California (CCPA/CPRA sale or share opt-out requirements), the EU/EEA (GDPR consent requirements for behavioral advertising), Illinois (BIPA if biometric data is incidentally collected), and any jurisdiction where VPPA applies to digital streaming. The VPPA applies federally across the United States. CONTRACT AND VENDOR IMPLICATIONS: Data processing agreements must be in place with each embedded SDK vendor. The terms governing what each vendor can do with received data (Meta, Google, Kochava, Branch, Microsoft, Adobe) must be reviewed to confirm they do not permit onward sharing or use for purposes beyond service delivery. Standard commercial practice requires DPAs; absence of or non-compliant DPAs creates liability exposure under GDPR and CCPA. COMPLIANCE CONSIDERATIONS: Compliance teams should audit each embedded SDK to document data elements transmitted, whether consent is obtained prior to SDK activation, and whether a VPPA-compliant consent mechanism is in place for video viewing data disclosures specifically. CCPA opt-out signal processing (Global Privacy Control) should be tested for functionality across all platform surfaces.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Video Viewing History Collection and Use high
• Children's Data Collection via Nickelodeon and Nick Jr. Content high
• Account Registration Data Collection medium
• Location Data Collection medium
• Subscription Billing and Payment Data Collection medium
• Parental Controls and Age Verification high

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.