Data Sharing with Advertising and Analytics Partners

What it is

Pinterest shares your personal data, including identifiers and interaction data, with advertising partners and analytics vendors for ad measurement, optimization, and reporting purposes.

Why it matters (compliance & governance perspective)

The policy authorizes disclosure of personal data to external advertising and measurement companies, not just to enable ads on Pinterest but also to support ad measurement and reporting off-platform, meaning your data may flow to third-party ad-tech companies.

Consumer impact (what this means for users)

This provision states that Pinterest shares user data including identifiers and behavioral information with advertising partners and measurement vendors, which may result in your data being processed by multiple third-party ad-tech companies beyond Pinterest's direct control.

What you can do

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: Under the CCPA and CPRA, sharing personal information with advertising partners for cross-context behavioral advertising constitutes a sharing that requires an opt-out right (the right to opt out of sharing). Under GDPR, disclosure to advertising partners requires a valid legal basis and, where those partners are independent controllers, separate transparency obligations. The FTC Act applies to the adequacy and accuracy of disclosures about third-party data sharing. (2) GOVERNANCE EXPOSURE: High. Third-party data sharing for advertising is a primary area of regulatory enforcement under both GDPR and CCPA. The policy does not enumerate specific advertising partners by name, which may complicate user rights exercises and data mapping obligations. (3) JURISDICTION FLAGS: California residents have a statutory right to opt out of sharing under the CPRA. EEA users are entitled to object to processing for direct marketing. States including Virginia, Colorado, and Connecticut provide opt-out rights for targeted advertising that may apply to this sharing. (4) CONTRACT AND VENDOR IMPLICATIONS: Data processing agreements with advertising and analytics partners should classify each partner as a processor or independent controller and allocate compliance obligations accordingly. Where partners are independent controllers receiving personal data, GDPR Article 26 joint controller agreements or Article 28 processor agreements may be required. Procurement and vendor management teams should maintain an updated record of advertising and measurement partners. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should maintain a data sharing inventory documenting each advertising and analytics partner, the categories of data shared, the legal basis, and the applicable opt-out or consent mechanism. CCPA opt-out signals including Global Privacy Control should be tested for functionality. Records of processing activities under GDPR Article 30 should reflect all advertising partner disclosures.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Off-Platform Data Collection for Ad Targeting high
• Collection of Financial and Transaction Information medium
• Business Transfer Data Disclosure medium
• Children Under 13 Prohibition and Age Screening high
• User Rights by Jurisdiction medium
• Inferred Interest Data and Personalization medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.