Poshmark Privacy Policy

Poshmark's privacy policy explains how the fashion resale platform collects and uses your personal information, including your name, email, purchase history, device data, precise location, and social connections. The most important thing to know is that Poshmark shares your personal data — including browsing behavior and purchase history — with third-party advertising and analytics partners, and California residents have the right to opt out of the sale of their personal information. If you are a California resident, you can submit a 'Do Not Sell My Personal Information' request through Poshmark's privacy settings or by contacting privacy@poshmark.com.

This document is Poshmark's Privacy Policy, governing the collection, use, sharing, and retention of personal data from users of its peer-to-peer fashion resale platform, with legal bases including consent, contractual necessity, and legitimate interests depending on jurisdiction. The policy creates significant obligations on Poshmark to collect and process a broad range of data types — including precise geolocation, device identifiers, payment information, behavioral data, and user-generated content — while granting Poshmark broad discretion to share this data with affiliates, service providers, advertising partners, and third parties for marketing and analytics purposes. Notably, the policy permits sharing personal data with third-party advertisers and data brokers for targeted advertising without a straightforward opt-out mechanism in the main policy text, and it retains data for unspecified periods tied to vague 'business purposes,' which deviates from data minimization principles under GDPR. The policy engages CCPA/CPRA (California residents), GDPR (EU/EEA users), PIPEDA (Canadian users), and the FTC Act Section 5, with Poshmark operating as both a data controller and processor in certain vendor contexts; California residents are afforded specific rights including the right to know, delete, and opt out of sale of personal information, while other US users receive fewer protections. Material compliance considerations include the adequacy of consent mechanisms for cross-border data transfers, the sufficiency of disclosed data retention schedules, and the breadth of 'affiliated companies' and 'business partners' defined as permissible data recipients.