Sharing Personal Information with Real Estate and Advertising Partners

What it is

Redfin shares your personal information with third parties including social media platforms and advertising networks to show you targeted ads on other websites and apps.

Why it matters (compliance & governance perspective)

This means your real estate browsing behavior and account data may follow you across the internet in the form of targeted advertising, even on unrelated platforms.

Clause Stability Stable

Consumer impact (what this means for users)

Your browsing activity, saved searches, and account data on Redfin may be shared with social media platforms and advertising networks to display personalized ads to you outside of Redfin, which California residents and users in certain other states can opt out of.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: Sharing personal data with third-party advertising platforms for cross-site targeted advertising constitutes a 'sale' or 'sharing' of personal information under CCPA/CPRA, triggering opt-out rights and the requirement to honor Global Privacy Control (GPC) signals. The FTC Act applies to any deceptive characterization of these data flows. State AG offices in California, Colorado, Virginia, and Connecticut have active enforcement postures on data sharing for advertising purposes. GOVERNANCE EXPOSURE: High for California and other opt-out states. The policy's authorization to share data with social media platforms for tailored content delivery is a textbook 'sharing for cross-context behavioral advertising' under CPRA, requiring a clearly accessible opt-out mechanism and GPC signal recognition. Failure to honor GPC is a documented CPPA enforcement priority. JURISDICTION FLAGS: California (CPRA sharing opt-out, GPC compliance), Colorado (CPA opt-out of targeted advertising), Virginia (VCDPA opt-out of targeted advertising), Connecticut (CTDPA opt-out), Texas (TDPSA opt-out). EU/EEA users would require a lawful basis under GDPR Article 6 for this processing; the policy does not address GDPR directly, creating potential exposure for any EU-accessible services. CONTRACT AND VENDOR IMPLICATIONS: Advertising technology partners receiving personal data must be classified under CPRA as either service providers (with a legitimate service purpose and no independent use rights) or third parties (triggering opt-out obligations). This classification must be reflected in data processing agreements. Procurement teams should audit whether current vendor agreements reflect the CPRA's service provider restrictions. COMPLIANCE CONSIDERATIONS: Data mapping should document all third-party advertising platforms receiving personal data and the legal basis for each transfer. Opt-out mechanisms for data sale and sharing should be tested for functionality and GPC signal recognition. The policy's description of IP address sharing with third parties for survey analysis should be assessed as a separate data flow requiring its own vendor classification.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Geolocation Data Collection medium
• Collection of Financial Data from Home Buyers and Sellers high
• Call Recording medium
• Public Content Exclusion from Privacy Protections medium
• Retention of Original Data After User Updates medium
• SMS and Telephone Marketing Consent medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.