Third-Party Advertising and Analytics Data Sharing

What it is

Squarespace shares your browsing and usage data with advertising and analytics companies, and those partners may track you across other websites to show you targeted ads.

Why it matters (compliance & governance perspective)

Cross-site behavioral tracking for advertising purposes affects your online privacy beyond the Squarespace platform itself, and the opt-out mechanism may not fully prevent all tracking depending on the technologies used.

Consumer impact (what this means for users)

Your behavioral data, including browsing patterns and interactions on Squarespace, may be shared with advertising partners who track you across multiple websites to serve targeted advertising, with opt-out options available but not always comprehensive across all tracking methods.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision engages GDPR Article 6 lawful basis requirements and Recital 47 on legitimate interests, the ePrivacy Directive (Cookie Law) for EU users, CCPA and CPRA opt-out of sale and sharing rights, and FTC guidance on behavioral advertising. The Irish Data Protection Commission and state attorneys general are primary enforcement authorities. EU-facing operations may require opt-in consent for non-essential cookies under ePrivacy rules rather than opt-out mechanisms. GOVERNANCE EXPOSURE: High. The breadth of behavioral data shared with advertising partners, combined with reliance on opt-out rather than opt-in consent for EU users, creates material GDPR exposure. Under CPRA, sharing personal information with advertising networks for cross-context behavioral advertising may qualify as a sale or sharing requiring a conspicuous opt-out mechanism. Enforcement actions against similar practices by other platforms have resulted in significant regulatory penalties. JURISDICTION FLAGS: EU and EEA users face the highest exposure, as ePrivacy and GDPR requirements for advertising cookies typically require affirmative consent. California residents have CPRA rights to opt out of sharing for cross-context behavioral advertising. Virginia, Colorado, Connecticut, and other US states with comprehensive privacy laws may also impose opt-out obligations. CONTRACT AND VENDOR IMPLICATIONS: Legal teams should assess whether Squarespace's data processing agreements with advertising partners meet GDPR Article 28 requirements and whether those partners are disclosed as sub-processors. B2B customers using Squarespace's e-commerce or analytics integrations should evaluate whether their use of Squarespace introduces advertising data sharing obligations under their own customer agreements. COMPLIANCE CONSIDERATIONS: Compliance teams should audit Squarespace's cookie consent mechanisms to verify they meet applicable jurisdiction requirements, particularly for EU users. Organizations subject to CPRA should confirm Squarespace's opt-out of sharing mechanism is functional and conspicuously disclosed. Data mapping should include advertising and analytics partners as downstream recipients of behavioral data.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Dual Controller and Processor Role Structure medium
• International Data Transfers via Standard Contractual Clauses medium
• Corporate Transaction Data Transfer medium
• California Resident Privacy Rights and Opt-Out low
• EU and UK Data Subject Rights low
• Cookies and Tracking Technologies medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.