Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that users have jurisdiction-dependent rights including access, portability, correction, deletion, processing restriction, objection, post-death instructions, and targeted advertising opt-out, and that StockX makes efforts to honor access, portability, deletion, and correction requests from all users regardless of jurisdiction.
This analysis describes what StockX's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a unified Personal Data Access Request portal for exercising data rights and commits to honoring access, portability, deletion, and correction requests globally, which extends certain rights beyond jurisdictions where they are legally mandated. The inclusion of post-death data instructions is a disclosure not universally present in comparable platform privacy policies.
The updated policy authorizes StockX to share and sell personal information to a broader range of recipients than previously disclosed. Specifically, the policy now explicitly permits sharing or selling personal data, including identifiers, transaction data, and browsing behavior, to Live Sellers on the Live Shopping Platform, Sellers on the Listings Marketplace, and third-party data brokers. The prior version limited disclosures to 'sharing' with 'StockX Verified Sellers' without explicit reference to data sales or data brokers. Under the revised terms, data sale and sharing is now standard practice for analytics, advertising, and marketplace partners. The policy does not describe a consumer opt-out mechanism for this data sharing or selling.
View change record →The agreement states that data rights including access, deletion, correction, and portability are available to all StockX users through the Personal Data Access Request portal, regardless of jurisdiction. Under these terms, users may also submit appeals for decisions made regarding their data rights requests.
Cross-platform context
See how other platforms handle User Rights and Personal Data Access Request Mechanism and similar clauses.
Compare across platforms →Monitoring
StockX has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Depending on your jurisdiction and under certain circumstances, you may have the following rights with respect to your Personal Information: to be provided with a copy of your Personal Information (right of access), including the right to have your Personal Information provided in a commonly used and machine-readable format (right of portability); to request the correction of your Personal Information; to request the deletion of your Personal Information; to request that we restrict the processing of your Personal Information; to object to the further processing of your Personal Information, including the right to object to marketing communications; to provide instructions about your Personal Information after death; and to opt-out of sharing your Personal Information with third parties for some purposes, notably targeted advertising, which may be defined as a sale under applicable laws. You may also have the right to appeal a decision we make regarding your rights. These rights vary depending on where you reside, but we make efforts to honor requests for access/portability, deletion, and correction from all StockX users, regardless of where they live.Excerpt from StockX's Privacy Policy
1) REGULATORY LANDSCAPE: This provision engages GDPR Articles 15 through 21 governing data subject rights for EEA users, UK GDPR equivalent provisions, CCPA consumer rights provisions for California residents, and analogous frameworks for Mexico, South Korea, and Japan as referenced in the region-specific sections. Enforcement authorities include EU national supervisory authorities, the UK ICO, the California Privacy Protection Agency, and applicable authorities in other named jurisdictions. 2) GOVERNANCE EXPOSURE: Low. The commitment to honor access, portability, deletion, and correction requests from all users globally exceeds the minimum legal requirements in jurisdictions without comprehensive privacy legislation. The inclusion of an appeal mechanism for rights request decisions aligns with GDPR and CCPA requirements. 3) JURISDICTION FLAGS: EEA and UK users have legally enforceable rights under GDPR and UK GDPR. California users have legally enforceable rights under CCPA. Users in Mexico, South Korea, and Japan are covered by jurisdiction-specific sections referenced in the policy. Users in other jurisdictions benefit from the policy's voluntary global extension of certain rights. 4) CONTRACT AND VENDOR IMPLICATIONS: Service providers receiving personal data from StockX must be capable of supporting data deletion and correction requests within GDPR and CCPA response timelines. Data processing agreements should address the operational mechanism for propagating user rights requests to downstream processors. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should audit the Personal Data Access Request portal to confirm response timelines meet GDPR's one-month and CCPA's 45-day requirements. The appeal mechanism should be operationally defined with documented escalation procedures. The global extension of rights should be assessed against the operational capacity to fulfill requests from users in all jurisdictions.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes a unified Personal Data Access Request portal for exercising data rights and commits to honoring access, portability, deletion, and correction requests globally, which extends certain rights beyond jurisdictions where they are legally mandated. The inclusion of post-death data instructions is a disclosure not universally present in comparable platform privacy policies.
The agreement states that data rights including access, deletion, correction, and portability are available to all StockX users through the Personal Data Access Request portal, regardless of jurisdiction. Under these terms, users may also submit appeals for decisions made regarding their data rights requests.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by StockX.