If you use Poshmark from outside the US, your personal data will be transferred to and processed in the United States, and using the platform is treated as consent to that transfer.
This analysis describes what Poshmark's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
For users in the EU, UK, and other jurisdictions with strict data transfer rules, relying on implied consent from platform use as the legal basis for international data transfers may not satisfy applicable legal requirements.
Interpretive note: The policy does not specify the transfer mechanisms relied upon for EU and UK data, and reliance on implied consent from platform use may not satisfy GDPR Chapter V requirements; adequacy of transfer protections is asserted but not detailed.
Poshmark's updated Privacy Policy provides significantly more transparent disclosure about what personal data the company collects, how it uses that data, and how you can exercise your privacy rights. The policy now explicitly itemizes data collection points, including photos, videos, payment information, social media accounts, and user interaction data, and provides a dedicated section on consumer rights and choices. The policy also includes a dedicated California Privacy Notice supplement, indicating enhanced compliance with California privacy laws. You can review the full updated policy and California Privacy Notice to understand Poshmark's specific data practices and identify which privacy rights and choices are available to you.
View change record →Poshmark's updated privacy policy provides more explicit detail about what categories of personal data the company collects through the platform, including user-generated content (photos, videos, listings), interaction data (likes, comments, offers), and payment information. The expanded disclosure does not necessarily indicate new data collection practices, but gives users clearer visibility into what information Poshmark holds. You can review the full policy at Poshmark's website to understand which data collection practices apply to your account activity and, if you are a California resident, consult the supplementary California Privacy Notice referenced in the policy.
View change record →This new provision discloses mandatory U.S. data transfers for non-U.S. users with broad consent mechanism, addressing regulatory requirements for international privacy compliance.
View full change record →Users outside the US, particularly in the EU and UK, should be aware that their personal data is processed in the United States, and the adequacy of legal transfer mechanisms protecting that data should be independently evaluated.
How other platforms handle this
At Ledger, earning and maintaining our users' trust is a top priority. That's why we are deeply committed not only to protecting your privacy and securing your personal data, but also to being fully transparent about how we handle it.
Your personal information may be transferred to, and maintained on, computers located outside of your state, province, country, or other governmental jurisdiction where the privacy laws may not be as protective as those in your jurisdiction.
Your personal information may be transferred to, stored, and processed in the United States or other countries outside of your country of residence, which may have data protection laws that are different from those in your country.
Monitoring
Poshmark has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"If you are located outside of the United States, please be aware that information we collect may be transferred to, and processed in, the United States. By using our services, you consent to this transfer. We take steps to ensure that your personal information receives adequate protection when transferred internationally.— Excerpt from Poshmark's Poshmark Privacy Policy
REGULATORY LANDSCAPE: International data transfers from the EU and EEA to the United States are governed by GDPR Chapter V, which requires an adequacy decision, standard contractual clauses, binding corporate rules, or another approved transfer mechanism as the legal basis for transfer. The EU-US Data Privacy Framework provides an adequacy mechanism for certified US companies. Reliance on consent as the basis for international transfers under GDPR is permissible only under specific conditions, including that consent must be explicit, informed, and freely given, and that users are informed of possible risks. The UK has its own international transfer regime post-Brexit. The policy's statement that use of the service constitutes consent to transfer may not satisfy GDPR's requirements for valid consent to international transfers. GOVERNANCE EXPOSURE: Medium to High for EU and UK users. The policy does not specify which transfer mechanisms are in place beyond a general statement that adequate protection is taken, which may not satisfy GDPR accountability requirements. EU data protection authorities have scrutinized consent-based transfer mechanisms and have in some cases found them inadequate. JURISDICTION FLAGS: EU and EEA users face the highest exposure given GDPR Chapter V requirements. UK users are subject to equivalent requirements under UK GDPR. Users in other jurisdictions with data localization or transfer restrictions, such as Brazil under LGPD, should also be considered. CONTRACT AND VENDOR IMPLICATIONS: Data processing agreements with vendors who process personal data of EU and UK users should specify the applicable transfer mechanism, such as standard contractual clauses or the EU-US Data Privacy Framework. Transfer impact assessments may be required for high-risk transfers. COMPLIANCE CONSIDERATIONS: Poshmark should document the specific legal transfer mechanisms relied upon for international transfers of EU and UK personal data and update the privacy policy to reflect those mechanisms with specificity. The policy's reliance on implied consent from platform use as a transfer basis should be reviewed against GDPR Article 49 requirements, which impose significant limitations on consent-based derogations for international transfers.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
For users in the EU, UK, and other jurisdictions with strict data transfer rules, relying on implied consent from platform use as the legal basis for international data transfers may not satisfy applicable legal requirements.
Users outside the US, particularly in the EU and UK, should be aware that their personal data is processed in the United States, and the adequacy of legal transfer mechanisms protecting that data should be independently evaluated.
ConductAtlas has identified this type of provision across 55 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Poshmark.