Advertising Partner Data Sharing

What it is

The policy authorizes sharing of user identifiers, device information, and interaction data with advertising partners for targeted advertising and campaign measurement. This data sharing is distinct from sharing with AI model providers.

Why it matters (compliance & governance perspective)

This provision authorizes sharing of personal data with advertising partners, which constitutes a sale or sharing of personal information under CCPA for California residents and requires a valid lawful basis under GDPR, typically consent for behavioral advertising. The provision engages CCPA opt-out rights and GDPR consent requirements for targeted advertising.

Consumer impact (what this means for users)

Under this clause, user identifiers, device information, and interaction data are shared with advertising partners for targeted advertising purposes. California residents have the right to opt out of this sharing as a sale or sharing of personal information under CCPA.

What you can do

Institutional analysis (Compliance & governance intelligence)

1) REGULATORY LANDSCAPE: This provision implicates CCPA and CPRA definitions of sale and sharing of personal information, GDPR consent requirements for behavioral advertising under the ePrivacy Directive as implemented in EU member states, and FTC Act standards on data broker and advertising data practices. The California Privacy Protection Agency and California AG enforce CCPA. EU data protection authorities enforce GDPR advertising consent requirements. 2) GOVERNANCE EXPOSURE: Medium to High. The sharing of identifiers and interaction data with advertising partners constitutes sharing of personal information under CPRA, triggering opt-out rights for California residents. If the sharing involves cross-context behavioral advertising, specific disclosure and opt-out mechanism requirements apply. GDPR requires freely given, specific, and informed consent for behavioral advertising, not merely a legitimate interests basis. 3) JURISDICTION FLAGS: California residents have the right to opt out of sale and sharing under CPRA. EU/EEA users require consent for behavioral advertising. Users in states with comprehensive privacy laws including Virginia, Colorado, Connecticut, Texas, and others may have similar opt-out rights. 4) CONTRACT AND VENDOR IMPLICATIONS: Advertising partner agreements should be reviewed to confirm they are structured as service provider or processor agreements to avoid triggering CCPA sale or sharing definitions beyond what is disclosed. Data sharing agreements should specify permitted uses and prohibit secondary use by advertising partners. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should verify that the opt-out of advertising data sharing is technically implemented and accessible from all platforms, that the list of advertising partners is current and disclosed, and that consent mechanisms for EU/EEA users satisfy the ePrivacy and GDPR consent standards. Annual audits of advertising partner data flows are advisable.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Query and Conversation Data Shared with Third-Party AI Model Providers high
• AI Model Training Data Use high
• Voice Audio Data Collection high
• California Resident Privacy Rights medium
• EU/EEA User Rights and GDPR Disclosures medium
• Children's Data and Minimum Age medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.