Advertising Partner Disclosure as Potential CCPA Sale

What it is

Runway acknowledges that sharing your personal data with advertising and analytics companies may legally qualify as a 'sale' under California and other state privacy laws, even though no money changes hands. You have the right to opt out of this type of data sharing.

Why it matters (compliance & governance perspective)

This disclosure is significant because it confirms that Runway shares personal data with third-party advertising and analytics partners in a manner that may trigger opt-out rights under CCPA and similar state laws. Users in approximately fifteen named states can exercise this opt-out right.

Consumer impact (what this means for users)

Personal data including browsing activity, device identifiers, and interaction data may be disclosed to advertising and analytics partners in ways that qualify as a sale under CCPA. Users in California, Colorado, Connecticut, Texas, Virginia, and other named states can opt out by using the 'Your Privacy Choices' link in the website footer.

What you can do

Institutional analysis (Compliance & governance intelligence)

1) REGULATORY LANDSCAPE: This provision engages the California Consumer Privacy Act as amended by the California Privacy Rights Act (CPRA), and the privacy frameworks of Colorado, Connecticut, Texas, Virginia, Oregon, Minnesota, Delaware, Iowa, Maryland, Montana, Nebraska, New Hampshire, New Jersey, Tennessee, and Utah, all of which provide opt-out rights from sale or sharing of personal data. The California Privacy Protection Agency and the FTC have jurisdiction over compliance with these frameworks. 2) GOVERNANCE EXPOSURE: Medium. The policy proactively acknowledges the potential sale characterization and provides an opt-out mechanism, which reflects awareness of applicable obligations. However, the effectiveness of the opt-out mechanism depends on cookie-based technology, and the policy notes that cookie blockers such as Ghostery may prevent the opt-out tool from functioning, creating potential gaps in opt-out accessibility. 3) JURISDICTION FLAGS: California presents the highest exposure given CPPA enforcement authority and CPRA's expanded definitions of sale and sharing for cross-context behavioral advertising. Texas and Virginia have state AG enforcement with no private right of action. The policy's acknowledgment that opt-out preferences may be lost if cookies are cleared is a potential compliance gap under laws that require durable opt-out signals. 4) CONTRACT AND VENDOR IMPLICATIONS: Data sharing agreements with advertising and analytics partners should include contractual restrictions on downstream use consistent with CCPA service provider or contractor obligations, or alternatively confirm that these partners are treated as third parties with appropriate opt-out mechanisms in place. Procurement teams should verify that partners like Google Analytics and any other named analytics vendors maintain compatible opt-out infrastructure. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should audit whether the 'Your Privacy Choices' opt-out mechanism functions correctly across all browsers and device types, including in the presence of common ad-blocking or privacy tools. The policy's statement that Global Privacy Control signals are recognized 'in accordance and to the extent required by applicable law' should be evaluated against specific state-by-state GPC recognition requirements, some of which are mandatory. Data mapping should confirm which specific data categories are shared with which advertising and analytics partners.

Applicable agencies

Provision details

Other risks in this policy

• Biometric Data Collection high
• User Content Collection Including Prompts and Generated Outputs medium
• Enterprise Account Administrator Access medium
• Business Transferee Data Disclosure medium
• GDPR Legitimate Interests Legal Basis medium
• Children's Privacy and Age Restriction medium