If you live in California, you have the right to tell Visa not to share your personal information with third parties for targeted advertising purposes.
This analysis describes what Visa's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This is a legally enforceable right under California's CPRA that allows California residents to limit how their data is used for commercial advertising targeting across the internet.
Interpretive note: The policy uses qualified language ('may have the right') which is technically accurate but creates potential ambiguity about when Visa will honor opt-out requests; applicability depends on whether specific data uses constitute CPRA-covered sharing.
California residents can stop Visa from sharing their personal information for cross-context behavioral advertising by using the opt-out mechanism on Visa's website, limiting targeted ad profiles built from their data.
How other platforms handle this
If you would like to opt out of the disclosure of your personal information for purposes that could be considered "sales" for those third parties' own commercial purposes, or "sharing" or processing for purposes of targeted advertising, please visit the following link, which is also available in the...
California law gives residents the right to know what personal information we collect, use, share or sell; to delete personal information under certain circumstances; to opt-out of the sale or sharing of their personal information; to correct inaccurate personal information; to limit the use and dis...
If you are a California resident, you have certain rights with respect to your personal information, including: The right to know about the personal information we collect, use, disclose, and sell. The right to delete your personal information. The right to opt out of the sale or sharing of your per...
Monitoring
Visa has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"California residents may have the right to opt-out of the sharing of personal information for cross-context behavioral advertising. To exercise this right, please click the 'Your Privacy Choices' link on our website or contact us as described in this Privacy Notice.— Excerpt from Visa's Visa Privacy Notice
REGULATORY LANDSCAPE: This provision directly engages the California Consumer Privacy Act as amended by the California Privacy Rights Act (CPRA), which grants California residents the right to opt out of sharing personal information for cross-context behavioral advertising without requiring a sale of data. The California Privacy Protection Agency and the California Attorney General share enforcement authority. CPRA requires businesses to honor opt-out requests within 15 business days and to maintain the opt-out for at least 12 months before requesting re-consent. GOVERNANCE EXPOSURE: Medium. The provision acknowledges the right using qualified language ('may have the right'), which is technically accurate given that applicability depends on whether the specific data use constitutes CPRA-covered sharing. However, this qualification should not be used to deny valid opt-out requests. The opt-out mechanism must be a clear and conspicuous link, and compliance with the Global Privacy Control signal may also be required under CPRA. JURISDICTION FLAGS: This right applies specifically to California residents under CPRA. Other U.S. state privacy laws including Virginia's CDPA, Colorado's CPA, and Connecticut's CTDPA include similar opt-out rights for targeted advertising that Visa's policy should address for residents of those states as well. EU and UK residents have separate but related rights to object to processing for direct marketing under GDPR. CONTRACT AND VENDOR IMPLICATIONS: Downstream advertising technology vendors and analytics partners receiving data under this sharing arrangement should be assessed for CPRA compliance, including their ability to honor opt-out signals. Data processing agreements should include provisions requiring advertising partners to respect opt-out flags passed by Visa and to cease processing within required timeframes. COMPLIANCE CONSIDERATIONS: Compliance teams should audit the 'Your Privacy Choices' opt-out mechanism to confirm it functions as required under CPRA, including honoring Global Privacy Control browser signals. The 15-business-day fulfillment requirement and 12-month re-consent prohibition should be reflected in operational workflows. Teams should also assess whether similar opt-out rights must be provided to residents of Virginia, Colorado, Connecticut, Texas, and other states with active comprehensive privacy laws.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This is a legally enforceable right under California's CPRA that allows California residents to limit how their data is used for commercial advertising targeting across the internet.
California residents can stop Visa from sharing their personal information for cross-context behavioral advertising by using the opt-out mechanism on Visa's website, limiting targeted ad profiles built from their data.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Visa.