Third-Party Advertising Data Sharing

What it is

Walgreens shares your personal data with advertising partners and allows third-party tracking technologies on its platforms that follow your activity across websites to deliver targeted ads.

Why it matters (compliance & governance perspective)

The combination of health, pharmacy, and shopping data with third-party advertising tracking creates significant privacy exposure, particularly where health-adjacent browsing behavior may inform targeted advertising.

Consumer impact (what this means for users)

Your browsing behavior, purchase history, and potentially health-related activity on the Walgreens website may be shared with advertising partners and tracked by third-party pixels across the internet, enabling personalized advertising based on sensitive data.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision engages CCPA and CPRA, which define the sharing of personal information with third parties for cross-context behavioral advertising as a form of data sharing requiring an opt-out right; the FTC Act applies to disclosures about the nature and extent of data sharing with advertising partners; where health-adjacent data is involved, Washington's My Health MY Data Act and similar statutes may require affirmative consent rather than an opt-out mechanism. The California Privacy Protection Agency, California AG, and FTC are primary enforcement authorities. GOVERNANCE EXPOSURE: High. The deployment of third-party tracking technologies in a health and pharmacy retail environment creates material compliance exposure under CCPA, CPRA, and emerging state health data statutes. Regulatory scrutiny of healthcare-adjacent advertising data practices has increased, and the FTC has issued guidance on health data sharing practices. JURISDICTION FLAGS: California residents have a statutory right to opt out of the sale or sharing of personal information for advertising. Washington's My Health MY Data Act may require affirmative consent for sharing consumer health data, which could include health-related browsing activity. Heightened exposure in all US states with enacted consumer privacy laws. CONTRACT AND VENDOR IMPLICATIONS: Contracts with advertising technology vendors should specify data use limitations, prohibit re-identification, and address health data handling. Standard advertising technology contracts may not include adequate protections for health-adjacent data, requiring custom data processing agreements. Audit rights for advertising partner data use should be established. COMPLIANCE CONSIDERATIONS: Compliance teams should audit all third-party pixels and tracking technologies deployed on Walgreens digital properties to assess whether they interact with health or pharmacy browsing data; evaluate whether current consent mechanisms satisfy CPRA's opt-out requirements and state health data statutes' affirmative consent requirements; assess whether advertising data flows constitute a sale or sharing of personal information under applicable state laws; and review advertising partner contracts for adequate data use restrictions.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Health and Pharmacy Data Collection high
• California Consumer Privacy Rights medium
• Sensitive Personal Information Collection and Use high
• Children's Privacy medium
• De-identified and Aggregated Data Use medium
• Data Retention medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.