Square may share your personal information with outside advertising companies and analytics firms to show you targeted ads and to analyze how you use Square products.
This analysis describes what Square's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Sharing personal data with third-party advertising partners for targeted advertising purposes may qualify as a sale or sharing of personal information under CCPA/CPRA, triggering opt-out rights for California residents, and requires a valid lawful basis under GDPR.
Interpretive note: The scope of what constitutes sharing for advertising purposes and whether it meets the CPRA definition of sale or sharing may vary depending on specific technical implementation and the nature of data passed to each partner.
Previous version had empty excerpt for 'Third-Party Data Sharing'; current version provides detailed excerpt specifying advertising partners and analytics providers.
View full change record →Your behavioral data and identifiers may be passed to advertising partners and analytics firms, potentially enabling cross-site tracking and profiling; California residents have the right to opt out of this sharing, while EU/UK users may be able to object under GDPR.
How other platforms handle this
We may share your information with third-party vendors and service providers that perform services on our behalf, such as payment processing, data analysis, email delivery, hosting services, customer service, and marketing assistance. We may also share your information with third-party advertising p...
Sending you information about Adobe products and services, special offers and similar information, and sharing your information with third parties for their own marketing purposes, where your consent is not required; In some cases, in order to show you more relevant ads, we disclose with social medi...
We may share your personal information with third-party vendors and service providers that perform services on our behalf, such as payment processing, data analysis, email delivery, hosting services, customer service, and marketing assistance. We may also share your personal information with busines...
Monitoring
Square has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We may share information about you with third-party advertising partners to provide you with more relevant ads on and off our Services. We also work with third-party analytics providers to help us understand how you use our Services.— Excerpt from Square's Square Privacy Notice
REGULATORY LANDSCAPE: This provision directly engages CCPA/CPRA's definition of sale and sharing of personal information, which includes sharing for cross-context behavioral advertising even without monetary consideration. The California Privacy Protection Agency enforces CPRA. Under GDPR, this type of sharing typically requires either explicit consent or a valid legitimate interest that survives a balancing test; EU data protection authorities have scrutinized advertising data sharing extensively. The FTC also has authority over deceptive or unfair data sharing practices under Section 5. GOVERNANCE EXPOSURE: High. Advertising data sharing is one of the most actively enforced areas of privacy regulation globally. CPRA enforcement actions and GDPR decisions in the EU have resulted in significant penalties for companies sharing behavioral data with advertising partners without adequate consent or opt-out mechanisms. The adequacy of Square's opt-out mechanism and the technical implementation of that opt-out are key compliance risk factors. JURISDICTION FLAGS: California residents have explicit CPRA opt-out rights for sharing of personal information for cross-context behavioral advertising. EU/EEA users require a lawful basis under GDPR. UK users require compliance with UK GDPR and ICO guidance. Colorado, Virginia, Connecticut, and other US states with comprehensive privacy laws also recognize opt-out rights for targeted advertising. CONTRACT AND VENDOR IMPLICATIONS: Data sharing agreements with advertising and analytics partners should include data processing addenda, purpose limitation clauses, and restrictions on onward transfer. The identity of specific advertising partners is not fully enumerated in the policy, which may complicate due diligence for institutional customers assessing data flows. COMPLIANCE CONSIDERATIONS: Compliance teams should audit the technical implementation of Square's opt-out mechanisms to confirm they effectively halt data sharing with advertising partners. Cookie consent mechanisms and software development kit (SDK) configurations used by Square on merchant-facing platforms should be reviewed to ensure they align with disclosed practices. CPRA-compliant privacy notices should clearly label advertising data sharing as such.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.
Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Sharing personal data with third-party advertising partners for targeted advertising purposes may qualify as a sale or sharing of personal information under CCPA/CPRA, triggering opt-out rights for California residents, and requires a valid lawful basis under GDPR.
Your behavioral data and identifiers may be passed to advertising partners and analytics firms, potentially enabling cross-site tracking and profiling; California residents have the right to opt out of this sharing, while EU/UK users may be able to object under GDPR.
ConductAtlas has identified this type of provision across 1 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Square.