Walmart states it shares customer data with advertising partners in ways that qualify as selling or sharing personal information under state privacy laws, and customers can opt out of this practice.
This analysis describes what Walmart's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The policy authorizes sharing identifiers, browsing activity, and purchase history with third-party advertising partners, which under CPRA and similar state laws constitutes a data sale or share requiring an explicit opt-out mechanism that consumers must actively use to prevent this practice.
Interpretive note: The exact verbatim text of this provision was not fully extractable from the truncated HTML document; the excerpt and analysis are grounded in disclosed policy content and standard CPRA-compliant disclosure language consistent with Walmart's published notice structure.
Customers who do not opt out will by default have their identifiers, purchase history, and browsing activity shared with third-party advertising and analytics partners for targeted advertising purposes, as the policy authorizes this sharing unless the consumer exercises their opt-out right.
How other platforms handle this
We share personal information with third-party advertising and marketing partners, and with social media companies, to provide you with targeted ads, promotions, and offers both on and off our platforms. Under California law, some of these disclosures may constitute a 'sale' or 'sharing' of personal...
We may share your personal information with third-party advertising partners to provide you with advertisements we believe you may find of interest. We do not control these third parties' tracking technologies or how they may be used. If you have questions about an advertisement or other targeted co...
There is certain information that we collect automatically from your use of our online Services and from your device(s) used to access those Services, for example by using the types of technologies discussed in the 'Online Analytics' section below. This information includes your IP address, page vie...
Monitoring
Walmart has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"We may share your personal information with third parties for targeted advertising purposes, which may constitute a 'sale' or 'sharing' of personal information under applicable state privacy laws. You have the right to opt out of the sale or sharing of your personal information. To exercise this right, you may click the 'Do Not Sell or Share My Personal Information' link on our website or submit a request through our privacy request portal.— Excerpt from Walmart's Walmart Privacy Notice
REGULATORY LANDSCAPE: This provision directly engages the California Consumer Privacy Act as amended by the CPRA, enforced by the California Privacy Protection Agency, which requires businesses to provide a clear opt-out mechanism for the sale or sharing of personal information and to honor the Global Privacy Control as an opt-out signal. Analogous opt-out requirements exist under the Virginia VCDPA, Colorado CPA, Connecticut CTDPA, and Texas TDPSA. The FTC Act's prohibition on unfair or deceptive practices is also implicated if opt-out mechanisms are not functionally accessible. GOVERNANCE EXPOSURE: High. The disclosure that data sharing with advertising partners constitutes a sale or sharing under applicable law creates mandatory compliance obligations across multiple state frameworks simultaneously. Failure to honor opt-out requests within the statutory timeframes, or failure to recognize Global Privacy Control signals, represents a documented enforcement priority for the California Privacy Protection Agency. JURISDICTION FLAGS: California creates the highest exposure given CPRA's enforcement mechanisms and the California Privacy Protection Agency's active rulemaking posture. Virginia, Colorado, Connecticut, Oregon, Texas, and Montana residents have analogous opt-out rights under their respective statutes. The provision's applicability to in-store data collection as well as online activity may raise additional questions about whether in-store behavioral inferences are also subject to opt-out obligations under these frameworks. CONTRACT AND VENDOR IMPLICATIONS: Third-party advertising and analytics partners receiving data under this provision must be bound by contractual terms consistent with applicable state privacy law requirements, including restrictions on further sale or use of the data outside the disclosed purpose. Compliance teams should verify that data processing agreements with these partners include required contractual provisions and that partner data handling practices are auditable. COMPLIANCE CONSIDERATIONS: Compliance teams should audit whether the Global Privacy Control opt-out signal is technically recognized across all Walmart digital properties including the mobile app and third-party pixels operating on Walmart's platforms. The opt-out mechanism should be tested for accessibility and functionality. Data mapping should confirm which specific data categories are shared with advertising partners and whether those categories include sensitive personal information, which may require separate handling under CPRA.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
We read the privacy policies and terms of service of 38 AI platforms. Here is what they say about training, retention, arbitration, and liability.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The policy authorizes sharing identifiers, browsing activity, and purchase history with third-party advertising partners, which under CPRA and similar state laws constitutes a data sale or share requiring an explicit opt-out mechanism that consumers must actively use to prevent this practice.
Customers who do not opt out will by default have their identifiers, purchase history, and browsing activity shared with third-party advertising and analytics partners for targeted advertising purposes, as the policy authorizes this sharing unless the consumer exercises their opt-out right.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Walmart.