Sharing with Advertising and Analytics Partners

What it is

Robinhood states it shares personal information with advertising networks and analytics companies for targeted advertising purposes, and California residents can opt out of this sharing.

Why it matters (compliance & governance perspective)

Sharing of personal information with advertising networks for cross-context behavioral advertising constitutes a form of data sharing that triggers CPRA opt-out rights for California residents and may engage similar rights under other state privacy laws.

This document changed recently

Clause Stability Stable

Consumer impact (what this means for users)

The policy authorizes sharing of user data with advertising networks and analytics providers for behavioral advertising, meaning user data including identifiers and activity may be used to serve targeted ads across platforms; California residents can opt out through Robinhood's privacy settings.

What you can do

Institutional analysis (Compliance & governance intelligence)

1) REGULATORY LANDSCAPE: Sharing for cross-context behavioral advertising engages CCPA as amended by CPRA, which treats such sharing as equivalent to a sale requiring opt-out rights. The California Privacy Protection Agency enforces CPRA opt-out obligations. Other states including Colorado, Connecticut, Virginia, Texas, Oregon, and Montana have analogous opt-out rights for targeted advertising. The FTC's unfair or deceptive practices authority also applies if advertising data sharing is inconsistent with disclosed practices. 2) GOVERNANCE EXPOSURE: Medium. The policy discloses the sharing and offers an opt-out, which is the required CPRA mechanism. Governance exposure depends on whether the opt-out mechanism is properly implemented, whether it covers all relevant data flows, and whether the opt-out signal is honored by downstream advertising partners. 3) JURISDICTION FLAGS: California is the primary jurisdiction. Colorado, Connecticut, Virginia, Texas, Oregon, and Montana residents also have opt-out rights for targeted advertising under their respective state laws. Global Privacy Control (GPC) signal compliance is required under CPRA and some other state laws; the policy should be reviewed for GPC signal handling disclosures. 4) CONTRACT AND VENDOR IMPLICATIONS: Advertising network and analytics vendor contracts must reflect CPRA contractor or service provider status or document the sharing as a permitted sale with opt-out. Failure to appropriately classify these relationships could expose Robinhood to CPPA enforcement. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should audit the technical implementation of the advertising data opt-out to confirm it covers all advertising and analytics data flows, that opt-out signals including GPC are honored, and that the list of advertising and analytics partners is current and accurate.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• GLBA Exemption from CCPA Rights medium
• Collection of Sensitive Financial and Identity Data medium
• California Consumer Privacy Rights medium
• Data Sharing with Financial and Service Provider Partners medium
• Collection of Geolocation and Device Data medium
• Data Retention Practices low

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.