Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that PayPal discloses Personal Information collected after November 27, 2024 to Partners and Merchants for personalized shopping experiences in the United States by default, without requiring affirmative consent, unless applicable law requires consent. Users may opt out through the Data and Privacy setting in their PayPal account.
This analysis describes what PayPal's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a default data sharing program for U.S. users under which Personal Information including products, preferences, sizes, and styles is disclosed to Partners and Merchants for personalized shopping without requiring opt-in consent. The opt-out mechanism and the November 27, 2024 cutoff date are operationally significant for both user-facing privacy controls and compliance assessments under U.S. privacy law.
⚠ Personal Information collected after November 27, 2024 will continue to be disclosed to Partners and Merchants for personalized shopping experiences as described in the policy until the user opts out
Cross-platform context
See how other platforms handle Personalized Shopping Data Sharing with Partners and Merchants and similar clauses.
Compare across platforms →Monitoring
PayPal has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Unless we are required by law to obtain your consent, we disclose Personal Information collected from you after November 27, 2024 (or from earlier if you consent) for personalized shopping experiences in the United States. To opt-out of disclosures of Personal Information to Partners and Merchants for personalized shopping experiences, log into your PayPal account and edit your preferences in the Data and Privacy setting. If you opt-out, we will continue to disclose your Personal Information as necessary to complete transactions you initiate but will not disclose Personal Information to Partners and Merchant for personalized shopping experiences.Excerpt from PayPal's Privacy Statement
(1) REGULATORY LANDSCAPE: This provision engages the CCPA as amended by the CPRA, enforced by the California Privacy Protection Agency and the California Attorney General. The policy explicitly states PayPal does not sell or share Personal Information subject to non-exempt practices under U.S. comprehensive privacy laws, which is the basis for the opt-out rather than opt-in structure. Legal teams should evaluate whether the disclosed sharing constitutes sharing for cross-context behavioral advertising under the CPRA, which would trigger specific disclosure and opt-out requirements. The GLBA exemption claimed for precise geolocation data is noted in the policy and may affect which data categories are covered by this provision. (2) GOVERNANCE EXPOSURE: High. The provision authorizes disclosure of behavioral, preference, and product data to an open-ended category of Partners and Merchants for personalized shopping, with a default-on structure for all U.S. users from November 27, 2024. The breadth of the Partner and Merchant category and the types of inferred data disclosed (products, sizes, preferences, styles) create material data governance exposure, particularly for users who have not reviewed their Data and Privacy settings. (3) JURISDICTION FLAGS: California residents have heightened rights under the CPRA to opt out of sharing for cross-context behavioral advertising. The provision applies only to U.S. users; EU/EEA and UK users are subject to GDPR consent requirements for equivalent processing. Vermont and California-addressed accounts have additional state-level protections described separately in the policy. (4) CONTRACT AND VENDOR IMPLICATIONS: The provision does not specify individual Partners and Merchants by name, which may create challenges for institutional users seeking to assess downstream data handling. The policy states that once Personal Information is shared with Partners and Merchants, their own privacy policies govern further handling, which represents a liability boundary that procurement and compliance teams should note. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should confirm whether current consent mechanisms and preference center configurations correctly implement the November 27, 2024 effective date and whether existing users who opened accounts before that date have been presented with opt-out notice. Data mapping should reflect the inferred data categories disclosed under this provision, including product preferences and behavioral attributes.
ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.
Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.
This provision establishes a default data sharing program for U.S. users under which Personal Information including products, preferences, sizes, and styles is disclosed to Partners and Merchants for personalized shopping without requiring opt-in consent. The opt-out mechanism and the November 27, 2024 cutoff date are operationally significant for both user-facing privacy controls and compliance assessments under U.S. privacy law.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by PayPal.