Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that StockX uses third-party session replay technology to record and reproduce user interactions on the site and apps, including mouse movements, clicks, page visits, scrolling, and tapping, for quality control, customer service, fraud prevention, and marketing purposes.
This analysis describes what StockX's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that a comprehensive record of user on-site behavior, including keystroke-level interactions, is captured by a third-party service provider and transferred to and stored by that provider. The use of session replay for marketing purposes, in addition to operational purposes, and the transfer of interaction recordings to a third party may require evaluation under applicable state electronic communications and wiretapping statutes.
Interpretive note: The legal treatment of session replay technology under applicable state wiretapping and electronic communications statutes is subject to ongoing litigation and varies by jurisdiction.
The updated policy authorizes StockX to share and sell personal information to a broader range of recipients than previously disclosed. Specifically, the policy now explicitly permits sharing or selling personal data, including identifiers, transaction data, and browsing behavior, to Live Sellers on the Live Shopping Platform, Sellers on the Listings Marketplace, and third-party data brokers. The prior version limited disclosures to 'sharing' with 'StockX Verified Sellers' without explicit reference to data sales or data brokers. Under the revised terms, data sale and sharing is now standard practice for analytics, advertising, and marketplace partners. The policy does not describe a consumer opt-out mechanism for this data sharing or selling.
View change record →The agreement states that detailed interaction data including mouse movements, clicks, scrolling, and page visits are recorded and transferred to a third-party session replay provider. Under these terms, this recording occurs during site visits and the recorded data is stored by the third-party provider, which the policy identifies as a service provider acting on StockX's behalf.
Cross-platform context
See how other platforms handle Session Replay Technology and similar clauses.
Compare across platforms →Monitoring
StockX has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We use session replay technology on our Site. Session replay technology, also referred to as session playback or user experience (UX) replay, collects information regarding records and tracks your interactions with our Site or Apps. It then transforms those logged user events (such as mouse movements, clicks, page visits, scrolling, tapping, etc.) into a reproduction of what you actually did on the Site or App. We use session replays for quality control, customer service, fraud prevention and security, and marketing purposes. Our session replay technology is owned and operated by a third-party who acts as our service provider. The information collected by this technology may be collected by, transferred to, and stored by our third-party service provider.Excerpt from StockX's Privacy Policy
1) REGULATORY LANDSCAPE: Session replay technology may implicate the California Invasion of Privacy Act (CIPA), the Electronic Communications Privacy Act (ECPA), and analogous state wiretapping statutes, particularly where interactions are recorded and transmitted to a third party in real time. The FTC Act is engaged by the collection and third-party transfer of detailed behavioral data. Enforcement authorities include State Attorneys General and, under CIPA, private plaintiffs. 2) GOVERNANCE EXPOSURE: Medium. The disclosure that session replay data is transferred to and stored by a third-party provider, and that it is used for marketing purposes in addition to operational purposes, creates potential exposure under state electronic surveillance statutes. California courts have addressed session replay technology under CIPA in litigation contexts, though the legal landscape remains actively developing. 3) JURISDICTION FLAGS: California presents the highest current exposure given CIPA litigation activity around session replay technology. Other states with broad electronic communications statutes may also present exposure depending on user location. The use of session replay for marketing purposes, as distinct from purely operational uses, may heighten scrutiny in jurisdictions with consent-based electronic surveillance frameworks. 4) CONTRACT AND VENDOR IMPLICATIONS: The third-party session replay provider should be assessed under a Data Processing Agreement confirming data use limitations, retention schedules, and deletion obligations. The policy does not name the session replay provider, limiting transparency regarding the provider's own data practices. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should evaluate whether the session replay deployment satisfies applicable consent requirements in states with two-party consent statutes. The marketing use case for session replay data should be reviewed to confirm it is within the scope of user consent obtained through the cookie consent mechanism. The unnamed session replay provider should be identified and subject to vendor due diligence.
This provision establishes that a comprehensive record of user on-site behavior, including keystroke-level interactions, is captured by a third-party service provider and transferred to and stored by that provider. The use of session replay for marketing purposes, in addition to operational purposes, and the transfer of interaction recordings to a third party may require evaluation under applicable state electronic communications …
The agreement states that detailed interaction data including mouse movements, clicks, scrolling, and page visits are recorded and transferred to a third-party session replay provider. Under these terms, this recording occurs during site visits and the recorded data is stored by the third-party provider, which the policy identifies as a service provider acting on StockX's behalf.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by StockX.