The notice authorizes sharing of personal data with advertising, analytics, and third-party service providers, as well as corporate affiliates and parties involved in business transactions, for purposes described in the notice and its linked sub-notices.
This analysis describes what Smartsheet's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the categories of third parties with whom personal data may be shared, which is directly relevant to CCPA opt-out rights, GDPR legitimate interests assessments, and the scope of data flows that must be disclosed and contractually managed.
Interpretive note: The specific identity of advertising and analytics partners and the precise scope of data shared with each is described in linked sub-notices rather than the main notice text, so full assessment requires review of those supplementary documents.
The updated privacy policy states that only Smartsheet's U.S.-based affiliates participate in the EU-U.S., UK Extension, and Swiss-U.S. Data Privacy Framework. Previously, the policy referenced participation by Smartsheet and its affiliates without geographic qualification. This narrowed scope may affect the data transfer mechanisms available for processing personal data from EU, UK, and Swiss users if non-U.S. affiliates are involved in data handling. The policy does not explicitly describe alternative transfer mechanisms for non-U.S. affiliates.
View change record →The specific details about sharing with advertising partners and the mechanisms (cookies, pixel tags) were removed and replaced with a generic reference to the layered privacy notice structure.
View full change record →Under these terms, personal data collected from website visitors and registered users may be shared with advertising and analytics partners, which may support targeted advertising based on usage and device data. The notice states that opt-out mechanisms are available for certain advertising-related data uses.
How other platforms handle this
At Ledger, earning and maintaining our users' trust is a top priority. That's why we are deeply committed not only to protecting your privacy and securing your personal data, but also to being fully transparent about how we handle it.
If you are located in the European Economic Area, Switzerland, or the United Kingdom, you have the right to access, correct, or erase your personal data; the right to restrict or object to our processing of your personal data; the right to data portability; and, where our processing is based on your...
We may display advertisements on our Services and those advertisements may be targeted to your interests based on your personal information. We may share your personal information with advertising partners for interest-based advertising purposes. You may opt out of interest-based advertising by visi...
Monitoring
Smartsheet has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"The Smartsheet Privacy Notice ("Privacy Notice") consists of this page and the specific notices which describe how we collect, use, and share personal data and explain your related rights and choices.— Excerpt from Smartsheet's Smartsheet Privacy Policy
1. REGULATORY LANDSCAPE: Sharing with advertising and analytics partners implicates CCPA and CPRA provisions on sale and sharing of personal information, GDPR legitimate interests and consent requirements for third-party advertising data flows, and ePrivacy Directive requirements for cookie-based tracking. The California Privacy Protection Agency and FTC are primary enforcement authorities. CCPA's opt-out of sale and sharing provisions apply where data is disclosed to advertising partners for cross-context behavioral advertising. 2. GOVERNANCE EXPOSURE: High for California operations under CCPA and CPRA, and medium for EU and UK operations under GDPR. Advertising and analytics data sharing relationships require documented contractual restrictions and, where applicable, opt-out mechanisms that are operationally functional. 3. JURISDICTION FLAGS: California residents have a statutory right to opt out of the sale or sharing of personal information for cross-context behavioral advertising under CCPA and CPRA. EU and EEA users require a valid legal basis (consent or legitimate interests) for advertising data flows. Illinois, Virginia, Colorado, and other US states with comprehensive privacy laws may impose similar opt-out requirements. 4. CONTRACT AND VENDOR IMPLICATIONS: All advertising and analytics partners receiving personal data should be assessed to confirm that contractual restrictions on data use are in place. Procurement teams should verify that partner agreements include appropriate data protection clauses and that subprocessor or service provider designations are accurate under applicable law. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should audit the operational implementation of opt-out mechanisms for advertising-related data sharing, confirm that consent management platform configurations reflect applicable legal requirements by jurisdiction, and maintain a current list of advertising and analytics partners with documented data sharing agreements.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes the categories of third parties with whom personal data may be shared, which is directly relevant to CCPA opt-out rights, GDPR legitimate interests assessments, and the scope of data flows that must be disclosed and contractually managed.
Under these terms, personal data collected from website visitors and registered users may be shared with advertising and analytics partners, which may support targeted advertising based on usage and device data. The notice states that opt-out mechanisms are available for certain advertising-related data uses.
ConductAtlas has identified this type of provision across 7 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Smartsheet.