Target Plus Marketplace Seller Data Sharing

What it is

The policy states that when consumers purchase from third-party sellers on the Target Plus marketplace, Target shares the consumer's name, address, and items purchased with those sellers as needed to fulfill the order.

Why it matters (compliance & governance perspective)

This provision establishes that Target Plus marketplace transactions involve personal information disclosure to third-party sellers who are not directly subject to Target's privacy policy, creating a data flow that consumers may not associate with a Target-branded transaction and that may require evaluation under applicable data sharing and service provider frameworks.

Consumer impact (what this means for users)

This provision establishes that purchases from third-party sellers on the Target Plus marketplace result in sharing of the consumer's name, shipping address, and order details with those sellers; the privacy practices of individual Target Plus sellers are governed by their own policies rather than Target's.

Institutional analysis (Compliance & governance intelligence)

1. REGULATORY LANDSCAPE: This provision engages CCPA/CPRA data sharing disclosure requirements, which require businesses to identify categories of third parties with whom personal information is shared and the purposes of sharing. The FTC Act applies to deceptive representations about the scope of data sharing in marketplace contexts. State consumer protection statutes in California, Texas, and Colorado may impose additional disclosure obligations regarding marketplace seller data access. 2. GOVERNANCE EXPOSURE: Medium. The disclosure is present in the policy but consumers may not readily understand that completing a Target Plus purchase results in personal information transfer to a third-party seller outside Target's direct contractual control. If Target Plus sellers receive data beyond what is necessary for fulfillment, the transaction may constitute a 'sale' or 'sharing' under CPRA depending on the contractual relationship between Target and the seller. 3. JURISDICTION FLAGS: California creates the most defined exposure; CPRA requires disclosure of the purposes for sharing and whether sellers are structured as service providers, contractors, or third parties. If Target Plus sellers are third parties rather than service providers, consumers' opt-out rights may apply to this data flow. Illinois and other states with consumer fraud statutes may require adequate disclosure of marketplace data sharing. 4. CONTRACT AND VENDOR IMPLICATIONS: Procurement and legal teams should evaluate whether Target Plus seller agreements include: data use limitations restricting sellers to order fulfillment purposes; prohibition on onward sale or sharing of consumer data received from Target; deletion obligations upon order completion; and compliance representations regarding applicable privacy laws in the seller's jurisdiction. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should assess whether Target Plus sellers are classified as service providers or third parties under CPRA; whether data minimization principles are applied to limit the information shared to what is strictly necessary for fulfillment; whether consumers can exercise deletion rights as to data held by Target Plus sellers; and whether the policy disclosure is sufficiently specific to satisfy CPRA's disclosure requirements for categories of third parties.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Biometric Identifier Collection high
• Sale and Sharing of Personal Information for Advertising high
• Precise Geolocation Collection medium
• California and Multi-State Privacy Rights medium
• Loyalty and Partner Program Data Sharing medium
• Inferences and Sensitive Personal Information Collection medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.