Third-Party Data Sharing with Service Providers and Partners

What it is

The policy states that Walmart shares customer data with a range of third parties including advertising and analytics companies, and some of those companies may use the data for their own purposes beyond providing services to Walmart.

Why it matters (compliance & governance perspective)

The disclosure that advertising and analytics partners may use shared data for their own purposes, rather than solely on Walmart's behalf, is operationally significant because it means data shared under this provision may not be restricted to service provider limitations under state privacy laws, and may instead qualify as a sale or sharing of personal information triggering opt-out rights.

Consumer impact (what this means for users)

Customer data including identifiers, purchase history, and behavioral information is shared with advertising and analytics partners who the policy states may use it for their own purposes, which under CPRA and similar state laws may qualify as a sale or sharing and trigger opt-out rights that consumers must actively exercise.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: Under CPRA, the distinction between a service provider (who processes data only on the business's behalf) and a third party (who may use data for their own purposes) determines whether data disclosure constitutes a sale or sharing requiring opt-out rights. The California Privacy Protection Agency's regulations provide specific guidance on this distinction. FTC guidance on data broker practices is also relevant where shared data flows to analytics or data aggregation companies. GOVERNANCE EXPOSURE: High. The disclosure that some recipients may use data for their own purposes rather than solely as service providers triggers CPRA's sale and sharing opt-out framework and requires Walmart to honor opt-out signals including the Global Privacy Control. Compliance teams should map which specific partners receive data under service provider versus third-party contracts and ensure the contractual classifications match the actual data use described. JURISDICTION FLAGS: California creates primary exposure for the service provider versus third-party distinction. Virginia, Colorado, and Connecticut have analogous processor versus controller distinctions that determine whether data disclosure triggers consumer opt-out rights. For data shared with partners operating in the EU, GDPR data transfer requirements including standard contractual clauses or adequacy decisions may apply. CONTRACT AND VENDOR IMPLICATIONS: Contracts with advertising and analytics partners should clearly specify whether the partner is acting as a service provider or a third party, as this classification determines the permissible scope of data use and the applicable contractual terms under state privacy law. Audit rights provisions in partner contracts should allow Walmart to verify that data use conforms to disclosed purposes. COMPLIANCE CONSIDERATIONS: A vendor classification audit should confirm that partners receiving personal information are correctly categorized and that contractual terms reflect the disclosed data use. Where partners use data for their own purposes, Walmart's disclosure and opt-out mechanisms must reflect this practice, and the categories of personal information shared with each category of third party should be documented in the notice's disclosure table.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Sale or Sharing of Personal Information for Targeted Advertising high
• Sensitive Personal Information Collection high
• Geolocation Data Collection medium
• Consumer Privacy Rights Request Mechanism medium
• In-Store Data Collection medium
• Data Retention low

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.