Roundel Retail Media Advertising Network

What it is

Target uses your purchase history and browsing data to serve you personalized ads not only on Target's own platforms, but also across other websites and apps through its Roundel advertising business. Third-party ad companies can also track your online behavior across the internet for the same purpose.

Why it matters (compliance & governance perspective)

Target's retail media network means your in-store and online shopping data can follow you around the internet in the form of targeted ads, and this data is shared with external advertising technology companies beyond Target's direct control.

Clause Stability Stable

Consumer impact (what this means for users)

Your purchase history and browsing behavior on Target platforms may be used to power advertising that reaches you on third-party websites and apps, meaning your shopping data is not contained within Target's ecosystem. Under California and several other state laws, you have the right to opt out of this sharing, which may qualify as sale or sharing of personal information under CPRA.

What you can do

Institutional analysis (Compliance & governance intelligence)

1. REGULATORY LANDSCAPE: This provision engages the CPRA, which defines 'sharing' of personal information for cross-context behavioral advertising as a regulated activity subject to opt-out rights regardless of monetary consideration. The California Privacy Protection Agency (CPPA) has authority to enforce. The FTC Act applies to material omissions or deceptive representations regarding third-party data sharing. State comprehensive privacy laws in Virginia, Colorado, Texas, and Connecticut also grant opt-out rights for targeted advertising that may be triggered by this provision. 2. GOVERNANCE EXPOSURE: High. The operation of a retail media network that passes consumer behavioral and purchase data to external advertising technology partners is one of the most closely scrutinized data practices under current state privacy law. If the opt-out mechanism is not fully functional or clearly disclosed, this provision creates direct enforcement exposure under CPRA and analogous state statutes. 3. JURISDICTION FLAGS: California creates the highest current exposure, but Virginia, Colorado, Texas, and Connecticut residents also have opt-out rights for targeted advertising. Any consumer in a comprehensive privacy law state who does not receive a clear and functional opt-out mechanism is a potential complainant. The EU and UK GDPR would require a lawful basis such as consent for this type of third-party sharing, but the policy does not appear to address EU/EEA consumers directly. 4. CONTRACT AND VENDOR IMPLICATIONS: Agreements with Roundel's advertising technology partners should include data processing terms that limit use of consumer data to disclosed purposes and require compliance with applicable privacy laws. The policy's reference to third-party advertising companies that independently track consumers across the internet creates potential for data flows that Target may not fully control contractually. 5. COMPLIANCE CONSIDERATIONS: The compliance team should verify that the opt-out of sale or sharing mechanism covers all downstream Roundel data flows, not only Target's own ad serving. Data mapping should identify every third-party advertising technology integration and assess whether those integrations constitute sale or sharing under each applicable state statute. Universal opt-out signal (Global Privacy Control) recognition should be confirmed for California compliance.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Biometric Data Collection high
• Precise Geolocation Collection medium
• Third-Party Data Sources and Data Brokers medium
• California and State-Specific Opt-Out Rights medium
• Children's Privacy and Age Restrictions low
• Data Retention Practices medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.