For EEA users, PayPal updates its third-party disclosure list quarterly, and failure to object within 30 days of publication is deemed acceptance of new disclosures. The sole stated remedy for non-acceptance is account closure.
This analysis describes what PayPal's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a deemed-consent mechanism for EEA users under which silence for 30 days constitutes acceptance of expanded third-party data disclosures. This mechanism may require evaluation under GDPR Articles 6 and 7, which require that consent be freely given, specific, informed, and expressed through an unambiguous affirmative act; EDPB guidance has consistently indicated that consent by inaction does not satisfy GDPR consent standards.
⚠ Failure to object within 30 days of a quarterly third-party list update will be treated as acceptance of any new personal information disclosures added to that list, as stated in the policy
Cross-platform context
See how other platforms handle EEA Deemed Consent for Third-Party Disclosure List Updates and similar clauses.
Compare across platforms →"PayPal may update the list of third parties referred to above on the first business day of every quarter (January, April, July and October). PayPal will only start transferring any Personal Information to any of the new entities or for the new purposes or Personal Information types indicated in each update after 30 days from the date when that list is made public through this Privacy Statement. You should review the list each quarter on the PayPal website on the dates stated above. If you do not object to the new Personal Information disclosure, within 30 days after the publication of the updated list of third parties, you are deemed to have accepted the changes to the list and to this Privacy Statement. If you do not agree with the changes, you may close your account and stop using our services.Excerpt from PayPal's Privacy Statement
1) REGULATORY LANDSCAPE: This provision directly engages GDPR Articles 6 and 7 regarding lawful processing and consent validity.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
This provision establishes a deemed-consent mechanism for EEA users under which silence for 30 days constitutes acceptance of expanded third-party data disclosures. This mechanism may require evaluation under GDPR Articles 6 and 7, which require that consent be freely given, specific, informed, and expressed through an unambiguous affirmative act; EDPB guidance has consistently indicated that consent by inaction does not …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by PayPal.