Advertising Data Sharing and Opt-Out Right

What it is

Salesforce may share your personal data with third-party advertising networks so that you can be shown targeted ads on other websites and apps. You have the right to opt out of this specific type of sharing.

Why it matters (compliance & governance perspective)

Your personal data may follow you across the internet through advertising partnerships. The opt-out right is meaningful but requires you to actively submit a request.

Consumer impact (what this means for users)

Salesforce may share personal data with third-party ad networks for behavioral advertising outside Salesforce platforms. California residents in particular should note this may qualify as a 'sale or sharing' under CCPA, triggering specific opt-out rights you can exercise through the privacy request form.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision directly engages CCPA as amended by CPRA, under which sharing personal data for cross-context behavioral advertising constitutes 'sharing' regardless of monetary exchange, triggering opt-out rights. Under GDPR, sharing data with advertising networks requires a valid legal basis, which in practice often requires freely given, informed consent rather than a legitimate interests basis given the nature of behavioral advertising. The FTC has authority over deceptive advertising data practices. GOVERNANCE EXPOSURE: High for California-resident data. The disclosure that Salesforce shares personal data for ads on non-Salesforce platforms and provides an opt-out mechanism is consistent with CCPA requirements. However, the adequacy of the opt-out mechanism's implementation, including whether it is as easy as opting in and whether it persists across devices, is subject to CPRA regulatory scrutiny. JURISDICTION FLAGS: California residents have the strongest statutory opt-out rights under CPRA. EU and UK users may have stronger protections in practice, as GDPR's consent requirements for behavioral advertising may limit this sharing unless freely given consent is obtained. Other US states with comprehensive privacy laws enacted since 2022 may also provide opt-out rights for targeted advertising. CONTRACT AND VENDOR IMPLICATIONS: Organizations that receive leads or other data from Salesforce's marketing ecosystem should assess whether downstream advertising activities create joint-controller relationships requiring formal agreements. Third-party ad networks receiving data from Salesforce should also be evaluated as vendors in procurement reviews. COMPLIANCE CONSIDERATIONS: Compliance teams should audit the opt-out mechanism to confirm it meets CPRA's accessibility and persistence requirements. Records of opt-out requests and their processing should be maintained. For GDPR contexts, the legal basis relied upon for this advertising sharing should be documented and reviewed against applicable supervisory authority guidance on legitimate interests versus consent for behavioral advertising.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Processor Carve-Out from Privacy Statement Scope medium
• Minor Data Opt-In Requirement medium
• International Data Transfers and Data Privacy Framework medium
• Data Subject Rights Framework medium
• Third-Party Dispute Resolution and Supervisory Authority Complaint Rights low
• Breadth of Data Sharing Categories medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.