PayPal reserves the right to update its list of third-party data recipients quarterly for EEA users; if users do not object within 30 days of each quarterly update, they are deemed to have consented to the updated disclosures. The only stated alternative to deemed acceptance is account closure.
This analysis describes what PayPal's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes an inaction-based deemed-consent mechanism for updates to third-party data disclosure for EEA users, which may require evaluation under GDPR consent standards. GDPR generally requires that consent be freely given, specific, informed, and unambiguous; deemed consent derived from failure to object within a 30-day window may not satisfy these requirements, depending on regulatory interpretation.
⚠ Failure to object within 30 days of a quarterly third-party list update constitutes deemed acceptance of the new data disclosures and Privacy Statement changes, as stated in the terms
Cross-platform context
See how other platforms handle EEA Quarterly Third-Party List Update with Deemed Consent and similar clauses.
Compare across platforms →"PayPal may update the list of third parties referred to above on the first business day of every quarter (January, April, July and October). PayPal will only start transferring any Personal Information to any of the new entities or for the new purposes or Personal Information types indicated in each update after 30 days from the date when that list is made public through this Privacy Statement. You should review the list each quarter on the PayPal website on the dates stated above. If you do not object to the new Personal Information disclosure, within 30 days after the publication of the updated list of third parties, you are deemed to have accepted the changes to the list and to this Privacy Statement. If you do not agree with the changes, you may close your account and stop using our services.Excerpt from PayPal's Privacy Statement
REGULATORY LANDSCAPE: GDPR requires that consent be freely given, specific, informed, and indicated by a clear affirmative act.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
This provision establishes an inaction-based deemed-consent mechanism for updates to third-party data disclosure for EEA users, which may require evaluation under GDPR consent standards. GDPR generally requires that consent be freely given, specific, informed, and unambiguous; deemed consent derived from failure to object within a 30-day window may not satisfy these requirements, depending on regulatory interpretation.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by PayPal.