Sale or Sharing of Personal Information for Targeted Advertising

What it is

Walmart states it shares customer data with advertising partners in ways that qualify as selling or sharing personal information under state privacy laws, and customers can opt out of this practice.

Why it matters (compliance & governance perspective)

The policy authorizes sharing identifiers, browsing activity, and purchase history with third-party advertising partners, which under CPRA and similar state laws constitutes a data sale or share requiring an explicit opt-out mechanism that consumers must actively use to prevent this practice.

Consumer impact (what this means for users)

Customers who do not opt out will by default have their identifiers, purchase history, and browsing activity shared with third-party advertising and analytics partners for targeted advertising purposes, as the policy authorizes this sharing unless the consumer exercises their opt-out right.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision directly engages the California Consumer Privacy Act as amended by the CPRA, enforced by the California Privacy Protection Agency, which requires businesses to provide a clear opt-out mechanism for the sale or sharing of personal information and to honor the Global Privacy Control as an opt-out signal. Analogous opt-out requirements exist under the Virginia VCDPA, Colorado CPA, Connecticut CTDPA, and Texas TDPSA. The FTC Act's prohibition on unfair or deceptive practices is also implicated if opt-out mechanisms are not functionally accessible. GOVERNANCE EXPOSURE: High. The disclosure that data sharing with advertising partners constitutes a sale or sharing under applicable law creates mandatory compliance obligations across multiple state frameworks simultaneously. Failure to honor opt-out requests within the statutory timeframes, or failure to recognize Global Privacy Control signals, represents a documented enforcement priority for the California Privacy Protection Agency. JURISDICTION FLAGS: California creates the highest exposure given CPRA's enforcement mechanisms and the California Privacy Protection Agency's active rulemaking posture. Virginia, Colorado, Connecticut, Oregon, Texas, and Montana residents have analogous opt-out rights under their respective statutes. The provision's applicability to in-store data collection as well as online activity may raise additional questions about whether in-store behavioral inferences are also subject to opt-out obligations under these frameworks. CONTRACT AND VENDOR IMPLICATIONS: Third-party advertising and analytics partners receiving data under this provision must be bound by contractual terms consistent with applicable state privacy law requirements, including restrictions on further sale or use of the data outside the disclosed purpose. Compliance teams should verify that data processing agreements with these partners include required contractual provisions and that partner data handling practices are auditable. COMPLIANCE CONSIDERATIONS: Compliance teams should audit whether the Global Privacy Control opt-out signal is technically recognized across all Walmart digital properties including the mobile app and third-party pixels operating on Walmart's platforms. The opt-out mechanism should be tested for accessibility and functionality. Data mapping should confirm which specific data categories are shared with advertising partners and whether those categories include sensitive personal information, which may require separate handling under CPRA.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Sensitive Personal Information Collection high
• Geolocation Data Collection medium
• Consumer Privacy Rights Request Mechanism medium
• Third-Party Data Sharing with Service Providers and Partners high
• In-Store Data Collection medium
• Data Retention low

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.