Third-Party Data Sources and Data Brokers

What it is

Target buys or receives information about you from outside sources like data brokers and social media platforms, and combines it with what it already knows about you to build a more detailed profile for marketing and advertising.

Why it matters (compliance & governance perspective)

Data broker sourcing means Target's profile of you may include information you never directly provided to Target, which can expand the scope of behavioral targeting significantly beyond what most consumers expect from a retailer relationship.

Consumer impact (what this means for users)

Target may combine your first-party shopping data with third-party data broker information to create a more comprehensive consumer profile used for advertising, which means information about you from sources you may not be aware of is influencing how you are targeted. This practice is common in the retail industry but is specifically regulated under CPRA and analogous state laws, where consumers have a right to know what categories of personal information have been collected and from what sources.

What you can do

Institutional analysis (Compliance & governance intelligence)

1. REGULATORY LANDSCAPE: CPRA requires disclosure of the categories of personal information collected and the categories of sources from which it is obtained; consumers have the right to request this information. The FTC Act applies to material omissions about the use of third-party data. State attorneys general in California and other comprehensive privacy law states have authority to enforce data sourcing disclosure requirements. The FTC's Commercial Surveillance rulemaking has specifically addressed data broker practices. 2. GOVERNANCE EXPOSURE: Medium. The disclosure of data broker sourcing is compliant with CPRA's transparency requirement in principle, but the adequacy of the disclosure depends on whether the categories of data received from brokers and the purposes for which each category is used are sufficiently specified to satisfy consumer rights requests. 3. JURISDICTION FLAGS: California consumers have the right to know the specific categories of personal information collected and the categories of sources, not just a general reference to data brokers. Virginia and Colorado privacy laws similarly require disclosure of data sources in response to consumer access requests. The EU and UK GDPR would require that data received from third parties be processed under a lawful basis and that consumers be notified, but the policy does not clearly address how GDPR obligations are met for third-party sourced data. 4. CONTRACT AND VENDOR IMPLICATIONS: Contracts with data brokers should include representations and warranties that the data provided was collected lawfully and with appropriate consumer notice. Due diligence on data broker vendors should include review of their own privacy policies and applicable legal proceedings. 5. COMPLIANCE CONSIDERATIONS: The compliance team should maintain a data inventory that maps each third-party data source to the categories of information received and the downstream uses, to enable complete and accurate responses to consumer access requests. The policy's reference to 'data brokers' as a category of source should be assessed against CPRA's definition of data broker to determine whether Target itself qualifies for registration under California's data broker registry law.

Applicable agencies

Provision details

Other risks in this policy

• Biometric Data Collection high
• Roundel Retail Media Advertising Network high
• Precise Geolocation Collection medium
• California and State-Specific Opt-Out Rights medium
• Children's Privacy and Age Restrictions low
• Data Retention Practices medium