This is Poshmark's privacy policy, which explains what personal data the fashion resale platform collects — including your name, email, purchase history, device identifiers, location, and social connections — and how it shares that data with third parties, advertisers, and its parent company Naver in South Korea. The most important thing to know is that your Poshmark profile, listings, and much of your activity on the platform are publicly visible by default, meaning strangers can see what you buy and sell. California residents can opt out of the sale or sharing of their personal data for cross-context behavioral advertising by visiting Poshmark's 'Do Not Sell or Share My Personal Information' page.
This document is Poshmark's Privacy Policy governing the collection, use, storage, and sharing of personal data by Poshmark Inc. and its parent Naver Corporation, with legal basis rooted in user consent, contractual necessity, and legitimate interests under applicable U.S. and international privacy frameworks. The policy creates significant obligations including Poshmark's right to share user data with third-party partners, service providers, affiliates including Naver Corporation, and in the context of business transactions such as mergers or acquisitions, while users bear responsibility for understanding these disclosures through continued use of the platform. Notably, the policy grants Poshmark broad latitude to share personal information — including purchase history, location data, and device identifiers — with social features designed to make much user activity publicly visible by default, which deviates from a privacy-by-design standard and creates elevated disclosure risk. The policy engages CCPA/CPRA (Cal. Civ. Code §1798.100 et seq.) with explicit California resident rights enumerated, GDPR/UK GDPR for international users, COPPA for users under 13, and the FTC Act Section 5 governing unfair or deceptive practices; material compliance considerations include the adequacy of consent mechanisms for cross-border data transfers to South Korea via Naver, and the breadth of 'publicly visible' default settings that may conflict with GDPR data minimization principles under Art. 5(1)(c).
REGULATORY EXPOSURE: This policy engages CCPA/CPRA (Cal. Civ. Code §§1798.100–1798.199), requiring opt-out rights for data sale/sharing and honoring Global Privacy Control signals; GDPR Arts. 6, 13, …
REGULATORY EXPOSURE: This policy engages CCPA/CPRA (Cal. Civ. Code §§1798.100–1798.199), requiring opt-out rights for data sale/sharing and honoring Global Privacy Control signals; GDPR Arts. 6, 13, 14, and 44–49 for EU/EEA users given data transfers to Naver in South Korea (not an adequacy-recogni…
Compliance intelligence locked
Regulatory exposure, material risk, and due diligence action items.
1 change analyzed since monitoring began.