Third-Party Advertising Data Sharing

What it is

PlayStation uses cookies, tracking pixels, and embedded scripts to log your activity across its websites and marketing communications, and may share data derived from this tracking with advertising and analytics partners.

Why it matters (compliance & governance perspective)

This tracking infrastructure supports targeted advertising, and under CPRA, sharing personal information with advertising partners for cross-context behavioral advertising constitutes 'sharing' that California residents have the right to opt out of.

Consumer impact (what this means for users)

Your browsing behavior on PlayStation websites and interactions with marketing emails may be tracked and shared with advertising partners, which can result in targeted advertising based on your PlayStation activity across third-party websites and services.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision directly engages the CPRA's definition of 'sharing' personal information for cross-context behavioral advertising, which triggers opt-out rights for California residents distinct from the right to opt out of 'sale.' The FTC Act applies to the adequacy of disclosures regarding tracking technologies and advertising partnerships. At the federal level, the Children's Online Privacy Protection Act is relevant if tracking technologies are deployed in contexts accessible to users under 13. GOVERNANCE EXPOSURE: Medium. The use of cookies, tracking pixels, and embedded scripts for advertising is standard in the industry; however, the CPRA's 'sharing' opt-out requirement and the FTC's ongoing scrutiny of dark patterns in consent mechanisms create compliance obligations that require operational implementation, not just policy disclosure. JURISDICTION FLAGS: California creates the highest exposure given CPRA's explicit sharing opt-out right. Colorado and Connecticut privacy laws also provide opt-out rights for targeted advertising. Users in the EU and UK are subject to separate cookie consent requirements under ePrivacy Directive and GDPR, addressed in regional policy supplements. CONTRACT AND VENDOR IMPLICATIONS: Advertising and analytics vendor agreements should reflect data processing restrictions consistent with the policy's stated purposes, and should address the opt-out signal requirements under CPRA (including Global Privacy Control compliance). COMPLIANCE CONSIDERATIONS: Compliance teams should audit whether opt-out signals such as the Global Privacy Control are honored across PlayStation web properties, and should confirm that the cookie consent management platform deployed (OneTrust, referenced in the site's technical configuration) is correctly configured to suppress non-essential tracking prior to consent.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Broad Automatic Data Collection from Consoles and Devices medium
• Voice and Text Communication Recording and Review medium
• Children's Accounts and Parental Consent high
• Information Sharing with Sony Group Companies and Third Parties medium
• California Consumer Privacy Rights and Opt-Out medium
• Data Retention and Deletion Rights low

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.