For EEA users, PayPal maintains a published list of third-party recipients of personal information, updated quarterly. Users who do not object within 30 days of a quarterly update are stated to have accepted the new disclosures, with account closure as the stated alternative to acceptance.
This analysis describes what PayPal's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a deemed consent mechanism for third-party data disclosure changes in the EEA, under which silence within a 30-day window following a quarterly list update constitutes acceptance of new data sharing arrangements. The interaction between this deemed consent mechanism and GDPR's requirements for explicit consent for certain processing activities may require evaluation, particularly given that GDPR supervisory authorities have expressed skepticism toward implied consent mechanisms in digital service contexts.
⚠ Failure to object within 30 days of a quarterly third-party list publication is stated by the terms to constitute acceptance of the updated data sharing arrangements for EEA users
Cross-platform context
See how other platforms handle EEA Third-Party Disclosure List with Quarterly Update and Deemed Consent and similar clauses.
Compare across platforms →"By accepting this Privacy Statement and maintaining an account with PayPal, you expressly agree to the transfer of your Personal Information to those third parties for the purposes listed. PayPal may update the list of third parties referred to above on the first business day of every quarter (January, April, July and October). PayPal will only start transferring any Personal Information to any of the new entities or for the new purposes or Personal Information types indicated in each update after 30 days from the date when that list is made public through this Privacy Statement. You should review the list each quarter on the PayPal website on the dates stated above. If you do not object to the new Personal Information disclosure, within 30 days after the publication of the updated list of third parties, you are deemed to have accepted the changes to the list and to this Privacy Statement. If you do not agree with the changes, you may close your account and stop using our services.Excerpt from PayPal's Privacy Statement
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes a deemed consent mechanism for third-party data disclosure changes in the EEA, under which silence within a 30-day window following a quarterly list update constitutes acceptance of new data sharing arrangements. The interaction between this deemed consent mechanism and GDPR's requirements for explicit consent for certain processing activities may require evaluation, particularly given that GDPR supervisory authorities …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by PayPal.