The policy authorizes sharing of personal information with advertising and analytics partners for targeted advertising purposes, and acknowledges this may constitute a sale or sharing of personal information under California law, with an opt-out right available.
This analysis describes what Ro's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that personal information collected by Ro, which may include health-related identifiers and behavioral data, can be shared with advertising and data analytics companies for targeted advertising, and the opt-out right is conditional on the user affirmatively exercising it.
Under this provision, personal information including behavioral and demographic data may be shared with advertising partners for targeted marketing unless the user exercises the opt-out right provided under applicable state law. California residents are specifically entitled to opt out of this sale or sharing under CCPA/CPRA.
Cross-platform context
See how other platforms handle Sale and Sharing of Personal Information with Advertising Partners and similar clauses.
Compare across platforms →Monitoring
Ro has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We may share your personal information with third-party advertising partners so that they can deliver targeted advertisements to you on our behalf. We may also share your information with data analytics companies. To the extent this constitutes a 'sale' or 'sharing' of your personal information under applicable law, you have the right to opt-out of such sale or sharing.— Excerpt from Ro's Ro Privacy Policy
REGULATORY LANDSCAPE: This provision directly engages CCPA/CPRA, which requires businesses to provide opt-out rights for the sale and sharing of personal information and to honor those requests within specified timeframes. The California Privacy Protection Agency (CPPA) is the primary enforcement authority. The FTC Act applies to the adequacy of the opt-out mechanism and the accuracy of disclosures about data sharing practices. States including Colorado, Connecticut, Virginia, and Texas have enacted similar consumer data rights statutes that may require equivalent opt-out mechanisms. GOVERNANCE EXPOSURE: High for California-resident user populations. The characterization of advertising data sharing as a potential sale or sharing under CCPA/CPRA requires a functional opt-out mechanism, a global privacy control (GPC) response, and annual privacy policy updates. Non-compliance with CCPA opt-out requirements carries civil penalty exposure enforced by the California AG and CPPA. JURISDICTION FLAGS: California creates the highest immediate exposure given CCPA/CPRA's specific opt-out and GPC requirements. Colorado, Connecticut, Virginia, Texas, and Montana have enacted analogous statutes. Washington's My Health MY Data Act may impose additional restrictions on sharing of consumer health data for advertising purposes that go beyond CCPA's framework. CONTRACT AND VENDOR IMPLICATIONS: Contracts with advertising and analytics partners should specify permitted data uses, prohibit reidentification of health-related data, and include data use restrictions consistent with applicable health data statutes. Standard advertising platform data processing agreements may not include sufficient health data protections. COMPLIANCE CONSIDERATIONS: The opt-out mechanism should be tested for operational functionality, and compliance teams should verify that opt-out signals transmitted via GPC are honored as required by CCPA/CPRA. Data flow maps should document which personal information categories are shared with which advertising partners, and vendor agreements should be reviewed to confirm data use restrictions are contractually enforced.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 3 platforms + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes that personal information collected by Ro, which may include health-related identifiers and behavioral data, can be shared with advertising and data analytics companies for targeted advertising, and the opt-out right is conditional on the user affirmatively exercising it.
Under this provision, personal information including behavioral and demographic data may be shared with advertising partners for targeted marketing unless the user exercises the opt-out right provided under applicable state law. California residents are specifically entitled to opt out of this sale or sharing under CCPA/CPRA.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Ro.