Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Vercel discloses that it has shared identifiers, commercial information, and internet activity data with third-party advertising networks in the preceding 12 months in a manner that may qualify as 'selling' or 'sharing' personal information under applicable US state privacy laws.
This analysis describes what Vercel AI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision constitutes a disclosure of advertising-related data sharing practices that trigger opt-out rights under CCPA, CPRA, and equivalent state laws; the document states that Vercel honors GPC signals and provides a linked opt-out form, which are operationally relevant compliance mechanisms for California and other state law compliance.
The updated policy establishes a new mechanism for resolving privacy disputes related to Data Privacy Framework transfers. Users in the EU, UK, and EEA who have unresolved privacy complaints can now submit them to VeraSafe for independent review, which will be conducted free of charge. Additionally, the policy introduces an explicit Right to Restriction, permitting users to request that Vercel limit processing of their personal information or restrict further disclosures in certain instances, particularly for sensitive information. You can file a complaint with VeraSafe by submitting required information at https://www.verasafe.com/privacy-services/dispute-resolution/submit-dispute/.
View change record →Under these terms, identifiers such as name, email, and IP address, along with commercial information and internet activity data, may have been shared with advertising networks in a manner that US state laws may classify as a sale or sharing of personal information; users can opt out using the provided form or by enabling a Global Privacy Control signal in their browser.
Cross-platform context
See how other platforms handle Advertising Data Sharing as Sale or Sharing Under US State Laws and similar clauses.
Compare across platforms →Monitoring
Vercel AI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"To the extent that certain US Data Privacy Laws consider some sharing of personal information for Advertising purposes to be "selling" or "sharing" of personal information, Vercel may have shared the following categories of personal information with third-party advertising networks in the preceding 12 months: Identifiers; Commercial information; and Internet or similar network activity.Excerpt from Vercel AI's SDK Privacy
(1) REGULATORY LANDSCAPE: This provision directly engages CCPA and CPRA, which establish opt-out rights for the sale and sharing of personal information; the California Privacy Protection Agency (CPPA) and California Attorney General enforce these requirements. Similar opt-out obligations apply under Colorado CPA, Connecticut CTDPA, Virginia CDPA, and other named state laws. The disclosure of internet activity and identifier sharing with advertising networks may also engage FTC Act Section 5 standards for unfair or deceptive practices if not accompanied by adequate notice. (2) GOVERNANCE EXPOSURE: Medium. The provision discloses past sharing with advertising networks across three broad categories of personal information; the adequacy of Vercel's opt-out mechanisms, including GPC signal honoring, must be operationally verified to confirm compliance with applicable state law requirements, which vary in their GPC mandates. (3) JURISDICTION FLAGS: California creates the highest enforcement exposure given CPPA's active regulatory posture and CPRA's expanded sharing definition. Colorado and Connecticut also mandate GPC signal honoring under their respective laws. Businesses with significant California user bases should confirm that Vercel's GPC implementation applies to all relevant site properties and that the opt-out form functions correctly. (4) CONTRACT AND VENDOR IMPLICATIONS: Customers using Vercel's sites for their own marketing or lead generation should confirm that Vercel's advertising data sharing does not capture end user data subject to the Customer's own privacy obligations; the Notice's processor carve-out may not shield customers from inquiry if their end users' data is collected through Vercel's own tracking technologies on Customer-deployed sites. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should document the date on which GPC opt-out controls were confirmed as active and functional across all relevant Vercel-operated domains; records of opt-out requests submitted through the linked form should be maintained as evidence of honored requests. Annual data inventory reviews should confirm that the categories disclosed here remain accurate.
This provision constitutes a disclosure of advertising-related data sharing practices that trigger opt-out rights under CCPA, CPRA, and equivalent state laws; the document states that Vercel honors GPC signals and provides a linked opt-out form, which are operationally relevant compliance mechanisms for California and other state law compliance.
Under these terms, identifiers such as name, email, and IP address, along with commercial information and internet activity data, may have been shared with advertising networks in a manner that US state laws may classify as a sale or sharing of personal information; users can opt out using the provided form or by enabling a Global Privacy Control signal in …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Vercel AI.