Business Partner Data Sharing for Marketing

What it is

Poshmark can share your personal information with outside companies for their own marketing purposes, including companies that run co-branded promotions with Poshmark.

Why it matters (compliance & governance perspective)

This provision extends the use of your personal data beyond Poshmark itself, allowing outside businesses to market directly to you based on information you provided to Poshmark, which may not match users' reasonable expectations.

This document changed recently

Consumer impact (what this means for users)

Your name, contact details, purchase history, and behavioral data may be shared with third-party business partners who can use it for their own advertising campaigns, potentially resulting in targeted marketing from companies you have no direct relationship with.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision directly implicates the CCPA and CPRA definitions of sale and sharing of personal information, as disclosure of personal data to third parties for cross-context behavioral advertising or other marketing purposes triggers opt-out obligations regardless of whether monetary consideration is exchanged. The California Privacy Protection Agency and the California Attorney General hold enforcement authority. Under GDPR, sharing personal data with third-party controllers for their own marketing purposes requires a separate lawful basis for each controller, and reliance on legitimate interests for such sharing faces heightened scrutiny. GOVERNANCE EXPOSURE: High. The breadth of the business partner category is not exhaustively defined in the policy, which creates ambiguity about which entities receive data and for what purposes. If business partners are receiving personal data for independent marketing use, they likely fall outside the CCPA service provider exemption, requiring that the sharing be treated as a sale or sharing under California law with corresponding opt-out mechanisms and contractual restrictions. JURISDICTION FLAGS: California presents the highest exposure due to CPRA opt-out requirements for sharing of personal information for cross-context behavioral advertising. Virginia, Colorado, Connecticut, and Utah similarly require opt-out rights for targeted advertising using personal data. EU and UK users are protected by GDPR and UK GDPR, which impose stricter controller-to-controller transfer requirements including separate lawful bases and data sharing agreements. CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should verify that all business partner relationships are governed by data sharing agreements that define permitted uses, restrict onward transfer, and align with applicable state law requirements. The absence of an exhaustive list of business partners in the policy may complicate vendor inventory and data mapping exercises. Contracts should specify whether business partners are classified as service providers, contractors, or third parties under CCPA or CPRA, as the classification determines the legal requirements for the sharing arrangement. COMPLIANCE CONSIDERATIONS: Compliance teams should audit whether Poshmark's opt-out mechanisms for data sale and sharing are operationally effective and whether the Global Privacy Control signal is honored for California users as required under CPRA. Data processing agreements with all business partners who receive personal data for marketing purposes should be reviewed and updated. A complete inventory of business partner data sharing relationships should be maintained and reflected in the policy's data practices disclosures.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Public Content Exclusion from Deletion Rights medium
• California Data Sale and Sharing Opt-Out medium
• Cookies and Cross-Context Behavioral Advertising medium
• Data Collection Scope and Categories medium
• User-Generated Content Public Visibility medium
• Data Retention and Account Deletion medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.