Interest-Based Advertising Data Sharing

What it is

PlanetScale shares your data with advertising companies like Google so they can show you targeted ads on other websites and platforms, and to find other users similar to you.

Why it matters (compliance & governance perspective)

Your usage data, identifiers, and behavioral inferences from the PlanetScale platform may be used to target you with advertising on completely separate third-party platforms, which many users would not anticipate from a developer database service.

Consumer impact (what this means for users)

Your online activity data and behavioral inferences collected while using PlanetScale's services may be shared with advertising partners including Google, enabling cross-platform targeted advertising and lookalike audience targeting, unless you opt out through the website footer or Cookie Policy.

What you can do

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: This provision engages CPRA's definition of 'sharing' personal information for cross-context behavioral advertising, which triggers opt-out rights under California Civil Code 1798.120 regardless of whether a sale occurs. Under GDPR, sharing personal data with advertising partners for behavioral targeting requires either valid consent (Article 6(1)(a)) or a legitimate interests basis (Article 6(1)(f)) that passes a balancing test; the policy asserts legitimate interests but this may face challenge in EU/EEA contexts depending on the intrusiveness of the targeting. The FTC has active enforcement interest in data sharing practices that diverge from consumer expectations. (2) GOVERNANCE EXPOSURE: Medium. The policy provides an opt-out mechanism and discloses the practice, which satisfies baseline CCPA/CPRA disclosure requirements. However, the GDPR legitimate interests basis for behavioral advertising to EU users is a contested area, and regulators including the Irish DPC and EDPB have scrutinized similar practices. The sharing of 'inferences drawn from information' with advertising partners is specifically disclosed in the Privacy Snapshot, which is a meaningful transparency measure. (3) JURISDICTION FLAGS: California residents have a specific opt-out right for this type of sharing under CPRA, and the 'Do Not Share My Personal Information' footer link appears designed to fulfill this requirement. EU and UK users face a different framework where consent may be required rather than an opt-out model, depending on how the data is processed and whether cookie consent adequately covers downstream data sharing. Illinois and other states with emerging privacy laws may also require evaluation. (4) CONTRACT AND VENDOR IMPLICATIONS: Contracts with advertising partners such as Google should be reviewed to confirm they qualify as 'service providers' or 'contractors' under CCPA rather than third parties, which affects the nature of the sharing and the applicable restrictions. If advertising partners use the shared data for their own independent purposes, this is likely 'sharing' or a 'sale' under CPRA and must be disclosed and subject to opt-out. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should audit the technical implementation of the 'Do Not Share My Personal Information' opt-out to confirm it prevents data transmission to advertising partners for all covered categories including inferences. The consent mechanism for EU users served through cookie banners should be reviewed to ensure it covers this downstream sharing, not merely on-site cookie placement.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Enterprise Customer Data Processor Carve-Out high
• EU-US Data Privacy Framework Certification medium
• Personal Information Rights and Requests medium
• Do Not Track Non-Response low
• International Data Transfers and Cross-Border Safeguards medium
• Privacy Policy Modification Without Individual Notice medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.