Potential Sale of Personal Information via Third-Party Product Incorporation

What it is

The policy discloses that Thomson Reuters provides services and content incorporating user personal information to third-party customers, including through aggregated listings, reports, profiles, and professional directories, and acknowledges that under certain local laws this may constitute a sale of personal information.

Why it matters (compliance & governance perspective)

This provision establishes that personal information, including that aggregated from public and private sources into attorney directories and professional profiles, may be made available to all users of Thomson Reuters services and acknowledges that this constitutes a potential sale under applicable law. California residents and residents of other states with sale opt-out rights may exercise those rights, but individuals whose information appears in public records products face a structurally distinct regime governed by the supplemental Public Records Privacy Statement.

Consumer impact (what this means for users)

This clause authorizes Thomson Reuters to incorporate personal information into third-party-accessible listings, reports, and professional directories and acknowledges this may constitute a sale under applicable law. California residents and eligible state residents can opt out of sale or sharing of their personal information using the mechanisms described in the statement.

What you can do

Institutional analysis (regulatory & governance intelligence)

1) REGULATORY LANDSCAPE: CCPA/CPRA requires businesses that 'sell' or 'share' personal information to provide opt-out rights and disclose the categories of personal information sold and the categories of third parties to whom it is sold. The statement's acknowledgment of potential sale triggers opt-out disclosure and mechanism obligations under CCPA/CPRA. Analogous opt-out rights exist under Virginia VCDPA, Colorado CPA, Connecticut CTDPA, and other state privacy laws. The FTC Act may engage if sale or sharing practices are inconsistent with disclosed purposes. 2) GOVERNANCE EXPOSURE: High for California and multi-state compliance. The acknowledgment that professional directory and content product distribution may constitute a sale requires verified opt-out mechanisms and accurate consumer request fulfillment metrics, which the statement publishes annually. The 2024 metrics disclose 6,562 Do Not Sell requests received, of which 846 were rejected, indicating an active operational compliance program with non-trivial rejection rates that may warrant documentation review. 3) JURISDICTION FLAGS: California creates the highest compliance exposure given CPRA's expanded definition of sale and sharing and the California Privacy Protection Agency's enforcement authority. Virginia, Colorado, Connecticut, Texas, Oregon, and Montana impose analogous opt-out obligations. The 'sale' acknowledgment for public records products engages the Public Records Privacy Statement's separate regime, and the interaction between CCPA opt-out rights and Fair Credit Reporting Act obligations for consumer report data warrants legal evaluation. 4) CONTRACT AND VENDOR IMPLICATIONS: B2B customers whose employee or client data may appear in Thomson Reuters professional directories or public records products should assess whether their data processing agreements address the sale acknowledgment and whether applicable privacy notices to those individuals disclose the potential sale to Thomson Reuters downstream customers. 5) COMPLIANCE CONSIDERATIONS: Legal teams should verify that the Do Not Sell opt-out mechanism is functional, prominent, and processes requests within CCPA-mandated timelines. The 18-day median response time for Do Not Sell requests noted in the 2024 metrics should be evaluated against CCPA's 15-business-day requirement. Rejection rates for deletion and access requests (approximately 51% and 87% respectively in 2024 metrics) should be reviewed to confirm that rejection bases are documented and legally supported.

Applicable agencies

Provision details

Other risks in this policy

• Acknowledgment of risk from transfers to less-protective countries high
• Annotation and tagging of individuals in news content high
• Biometric data destroyed within legally specified timeframe high
• Chinese residents deemed to consent to sensitive data processing by interacting high
• Collection from third-party data brokers and advertising partners high
• Collection of biometric data high