Third-Party Advertising Data Sharing

What it is

StockX shares your personal information including browsing and purchase behavior with major advertising companies like Meta (Facebook/Instagram), Google, TikTok, and Amazon so those platforms can show you targeted ads.

Why it matters (compliance & governance perspective)

This means your shopping habits and personal details from StockX are being shared with some of the largest data brokers and advertising networks in the world, which can result in highly targeted advertising following you across the internet.

Consumer impact (what this means for users)

Your browsing history, purchase behavior, and personal identifiers collected on StockX may be shared with Meta, Google, TikTok, and Amazon, enabling cross-platform behavioral profiling and targeted advertising that extends well beyond the StockX platform itself.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: Under the CPRA, sharing personal information with third parties for cross-context behavioral advertising constitutes a regulated activity that requires an opt-out mechanism and is subject to the California Privacy Protection Agency's enforcement authority. Under GDPR, sharing personal data with advertising networks for behavioral targeting requires a valid legal basis, which in practice for advertising purposes is typically consent; reliance on legitimate interests for behavioral advertising has been consistently challenged by EU data protection authorities. The FTC Act applies to representations about data sharing practices. GOVERNANCE EXPOSURE: High. The policy explicitly names major advertising platforms as data recipients for behavioral advertising purposes. The visible page source confirms active loading of tracking pixels from Facebook, TikTok, Google, Amazon, Spotify, and Snapchat, which operationally confirms the disclosures made in the policy text. Under CPRA, this sharing must be disclosed in the privacy notice and consumers must be able to opt out; the policy appears to offer this but implementation should be audited. JURISDICTION FLAGS: California (CPRA opt-out of sale/sharing obligations, annual data sharing reports), EU and UK (GDPR consent requirements for behavioral advertising, recent DPA enforcement actions against consent management platform implementations), Virginia, Colorado, Connecticut, and Texas (opt-out rights for targeted advertising under their respective comprehensive privacy laws). CONTRACT AND VENDOR IMPLICATIONS: Data processing agreements with each named advertising partner must be current and must accurately reflect the scope of data shared, the purposes for which it is used, and the partner's obligations as either a processor or independent controller. Where advertising partners act as independent controllers, their own privacy terms govern downstream use and StockX's ability to enforce data protection obligations is limited. COMPLIANCE CONSIDERATIONS: Teams should audit whether the consent management platform deployed on the StockX website (OneTrust, as visible in the page source) is correctly configured to block advertising pixels prior to consent for EU and UK users. For California users, teams should verify that Global Privacy Control signals are being honored and that the opt-out mechanism is functional and prominently disclosed. The annual CPRA data sharing report obligation should be calendared and assigned.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Government ID Collection for Seller Verification high
• California Consumer Privacy Rights (CPRA Opt-Out) medium
• GDPR Rights for EU and UK Users medium
• Cookies and Tracking Technologies medium
• Children and Minors Age Restriction medium
• Data Sharing in Corporate Transactions medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.