Affiliate sharing for cross-context behavioral advertising

What it is

The policy authorizes sharing personal data with current and future CoreWeave parent companies, subsidiaries, and affiliates, including for the purpose of cross-context behavioral advertising, defined as targeted advertising based on user activity across different websites, applications, or services over time.

Why it matters (compliance & governance perspective)

The clause explicitly defines cross-context behavioral advertising, making clear that affiliate sharing can enable tracking and targeting of users across multiple platforms over time.

Consumer impact (what this means for users)

Under this clause, CoreWeave may share personal data with affiliated companies for targeted advertising based on activity across multiple websites and services. California residents and others with applicable rights may opt out of this sharing by using the 'Do Not Sell or Share My Personal Information' footer link, the Global Privacy Control browser setting, or the cookie preference banner.

What you can do

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: Cross-context behavioral advertising sharing engages the California Privacy Rights Act (CPRA), which classifies such sharing as subject to opt-out rights distinct from data sales. The policy's opt-out mechanism disclosure satisfies CPRA's notice requirements on its face. This provision may also require evaluation under GDPR Articles 6 and 21 for EEA users, where cross-context behavioral profiling may implicate right-to-object provisions and legitimate interest balancing. The California Privacy Protection Agency (CPPA) and the FTC hold relevant enforcement authority. (2) GOVERNANCE EXPOSURE: Medium. The provision's reference to 'any current or future' affiliated company creates an open-ended scope for affiliate sharing that may require updating data mapping and consent records as corporate structure changes. The legitimate interests basis cited for affiliate data sharing under GDPR may be subject to challenge if the balancing test does not adequately account for user expectations regarding advertising data flows. (3) JURISDICTION FLAGS: California creates the most immediate exposure given CPRA's specific opt-out right for sharing for cross-context behavioral advertising. EEA and UK users have analogous objection rights under GDPR and UK GDPR. Virginia, Colorado, Connecticut, and other state privacy law jurisdictions with opt-out of targeted advertising rights create additional compliance touchpoints. (4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers whose employee or contractor data is processed through CoreWeave's Sites should assess whether cross-context behavioral advertising sharing is within the scope of their data processing agreements. The inclusion of future affiliates in the sharing authorization may affect vendor assessments, as the identity of sharing recipients is not fixed at contract execution. (5) COMPLIANCE CONSIDERATIONS: Legal teams should verify that the opt-out mechanism (footer link, GPC signal, cookie banner) is technically functional and covers all cross-context behavioral advertising cookies and tracking technologies deployed on CoreWeave's Sites. Data mapping should be updated to reflect affiliate sharing relationships as they change. CPRA's 12-month lookback disclosure obligations should be reviewed against the categories of data shared with affiliates for advertising purposes.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Data retention limited to necessary period medium
• Affiliate cross-context behavioral advertising sharing high
• AI and ML processing of user data high
• AI ML notice or consent required by law high
• Customer content used for service improvement high
• Customer-submitted content collection and use high

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.