Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that opting out of data sales and targeted advertising requires completing separate actions in two distinct platform locations: the cookie management portal accessed via the 'Your Privacy Choices' link and the account-level Data Sharing Preferences settings.
This analysis describes what StockX's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that a single opt-out action does not fully effectuate a CCPA 'Do Not Sell or Share My Personal Information' request; users must complete separate actions in both the cookie management portal and account settings. Compliance teams should evaluate whether this two-step mechanism satisfies CCPA opt-out usability and GPC recognition requirements.
The updated policy authorizes StockX to share and sell personal information to a broader range of recipients than previously disclosed. Specifically, the policy now explicitly permits sharing or selling personal data, including identifiers, transaction data, and browsing behavior, to Live Sellers on the Live Shopping Platform, Sellers on the Listings Marketplace, and third-party data brokers. The prior version limited disclosures to 'sharing' with 'StockX Verified Sellers' without explicit reference to data sales or data brokers. Under the revised terms, data sale and sharing is now standard practice for analytics, advertising, and marketplace partners. The policy does not describe a consumer opt-out mechanism for this data sharing or selling.
View change record →Under this clause, consumers who wish to exercise their CCPA opt-out rights must take action in two separate platform locations, as the policy states that changes in one location alone do not apply to all data sale and sharing practices. The policy also states that enabling a Global Privacy Control signal will be recognized as an opt-out for Targeting Cookies only.
Cross-platform context
See how other platforms handle Dual Opt-Out Requirement for Data Sales and Targeted Advertising and similar clauses.
Compare across platforms →Monitoring
StockX has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Opting Out of Targeted Advertising You may opt-out of us using your Personal Information for targeted advertising by changing your Cookie preferences and your account profile settings. Use the 'Your Privacy Choices' link at the bottom of our website to access our cookie management portal and select the toggle for 'Targeting Cookies' so that it is turned off. This will opt you out of our use of targeted advertising cookies to collect and share or sell Personal Information about you and your activity on our website. In addition, you can log into your StockX account online, go to 'Settings,' scroll down to 'Data Sharing Preferences,' and toggle the 'Targeted Advertising' button so that it is turned off. You may also toggle the 'Data Sales' button so that it is turned off to opt out of the selling of your other Personal Information to all our partners. Following these instructions is the same as making a 'Do Not Sell or Share My Personal Information' request. Please note that you must change your settings in both locations, as we use different technologies to apply your opt-out of Cookie-based targeted advertising and targeted advertising based on other Personal Information (such as your name and email address).Excerpt from StockX's Privacy Policy
1) REGULATORY LANDSCAPE: This provision directly engages CCPA's 'Do Not Sell or Share My Personal Information' requirements and the California Privacy Protection Agency's regulations regarding opt-out mechanism usability and Global Privacy Control recognition. The CPPA has issued guidance on opt-out mechanism design requirements. The FTC Act is engaged to the extent that a multi-step opt-out mechanism could be evaluated as a dark pattern or unfair practice. 2) GOVERNANCE EXPOSURE: Medium. The requirement that consumers complete opt-out actions in two separate locations to fully effectuate a data sale opt-out may draw scrutiny under CCPA usability standards. The policy's disclosure that GPC signal recognition applies only to Targeting Cookies and not to account-level data sales creates a documented limitation in GPC implementation that compliance teams should evaluate. 3) JURISDICTION FLAGS: California presents the primary enforcement exposure given CCPA's specific opt-out mechanism requirements. Other states with analogous consumer opt-out rights, including Colorado, Connecticut, and Virginia, may also evaluate the multi-step opt-out mechanism against their respective statute requirements. 4) CONTRACT AND VENDOR IMPLICATIONS: The technology architecture underlying the two separate opt-out mechanisms (cookie-based and account-based) should be documented and assessed to confirm that opt-out signals are propagated to all relevant downstream partners and data brokers in a timely manner consistent with CCPA compliance timelines. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should assess whether the dual-location opt-out requirement satisfies CCPA regulations regarding opt-out mechanism design, specifically whether the mechanism is at least as easy to use as the opt-in mechanism. The partial GPC recognition (Targeting Cookies only) should be evaluated against CPPA guidance on GPC implementation obligations.
This provision establishes that a single opt-out action does not fully effectuate a CCPA 'Do Not Sell or Share My Personal Information' request; users must complete separate actions in both the cookie management portal and account settings. Compliance teams should evaluate whether this two-step mechanism satisfies CCPA opt-out usability and GPC recognition requirements.
Under this clause, consumers who wish to exercise their CCPA opt-out rights must take action in two separate platform locations, as the policy states that changes in one location alone do not apply to all data sale and sharing practices. The policy also states that enabling a Global Privacy Control signal will be recognized as an opt-out for Targeting Cookies …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by StockX.