Poshmark Privacy Policy

This document is Poshmark's Privacy Policy, governing the collection, use, disclosure, and retention of personal information from users of the Poshmark platform, a peer-to-peer social commerce marketplace, with a stated legal basis rooted in contractual necessity, consent, and legitimate business interests. The policy states that Poshmark collects a broad range of personal data including name, address, payment information, device identifiers, geolocation, photos, browsing and purchase history, and social graph connections, and the terms authorize use of this data for purposes including personalization, advertising, analytics, fraud prevention, and sharing with third-party business partners and service providers. Notably, the policy reserves the right to share personal information with a wide category of 'business partners' for marketing purposes and authorizes cross-context behavioral advertising, which the terms separately acknowledge may constitute a 'sale' or 'sharing' of personal data under California law, creating opt-out obligations; the breadth of the business partner sharing category and the public nature of user-generated content on the platform are operationally distinct from many consumer platforms where social visibility is more limited. The policy explicitly engages California Consumer Privacy Act and California Privacy Rights Act frameworks, providing opt-out mechanisms for data sale and sharing and sensitive data use, and acknowledges obligations to Nevada, Virginia, Colorado, Connecticut, and Utah residents, as well as referencing GDPR-equivalent obligations for users in certain international regions; enforcement context and the scope of applicable state privacy laws continue to evolve, and the practical enforceability of specific terms may vary by jurisdiction. Compliance teams should note that Poshmark's status as a social commerce platform means user-generated content, including photos and profile information, is broadly public by default, and the policy's treatment of publicly posted data as outside standard deletion or restriction rights warrants careful review.