Third-Party Data Sharing with Service Providers and Affiliates

What it is

Public shares your personal and financial data with a range of outside companies that help run its business, including companies handling marketing, payments, and data analysis, as well as related companies in the Public corporate family.

Why it matters (compliance & governance perspective)

The breadth of permitted sharing, which includes marketing assistance providers and unspecified affiliates, means your sensitive financial data may reach organizations beyond Public's direct control, and the policy does not exhaustively name all recipients.

Consumer impact (what this means for users)

Your financial data, including trading history and account information, may be shared with third-party marketing vendors and affiliates. The policy does not list specific recipients, making it difficult to assess the full scope of who may receive your information.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: Sharing of customer financial information by a registered broker-dealer with third parties is governed by SEC Regulation S-P and GLBA, both of which require appropriate safeguards and, in some cases, contractual commitments from recipients. The updated GLBA Safeguards Rule (effective 2023 for most non-bank financial institutions) requires written contracts with service providers specifying required security practices. CCPA/CPRA requires disclosure of categories of third parties receiving personal information and, depending on whether data sharing constitutes a 'sale' or 'sharing for cross-context behavioral advertising,' may require an opt-out mechanism. The FTC and SEC are primary enforcement authorities. GOVERNANCE EXPOSURE: Medium. The inclusion of 'marketing assistance' among permitted sharing purposes is notable in the context of sensitive financial data. Whether this sharing constitutes CCPA 'sharing' for cross-context behavioral advertising purposes requires a legal determination based on the specific nature of the data flows, which is not resolved by the policy text alone. JURISDICTION FLAGS: California residents have specific rights to opt out of sale and sharing of personal information under CCPA/CPRA, and the policy should clearly identify whether marketing-related data transfers qualify as 'sharing' under that statute. Virginia, Colorado, Connecticut, and other states with comprehensive privacy laws have similar opt-out rights that may apply. CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should confirm that all service providers receiving personal financial data are bound by written data processing agreements that meet Regulation S-P and GLBA standards. The reference to 'affiliates' requires a clear corporate map to determine whether affiliate data transfers require separate notice or consent under applicable law. COMPLIANCE CONSIDERATIONS: A data flow mapping exercise is recommended to identify all third-party recipients by category and confirm that the policy's disclosures are accurate and complete. If any marketing-related data transfers involve the use of personal information for cross-context behavioral advertising, opt-out mechanisms must be implemented and disclosed consistent with CCPA/CPRA.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Collection of Sensitive Financial and Identity Data medium
• California Consumer Privacy Rights (CCPA/CPRA) medium
• Marketing Communications and Opt-Out low
• Aggregated and De-Identified Data Use medium
• Automatic Data Collection via Tracking Technologies medium
• Data Retention medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.