Third-Party Data Sharing for Analytics and Marketing

What it is

Wix shares your personal data with a range of third parties including analytics companies, advertisers, and business partners in order to operate its platform and conduct marketing activities.

Why it matters (compliance & governance perspective)

Personal data you provide when using Wix, including your usage patterns and contact details, may flow to third-party advertising and analytics networks, expanding the number of entities that hold your information.

Consumer impact (what this means for users)

Your personal data, including usage behavior, contact information, and device identifiers, may be shared with advertising networks and analytics providers, potentially enabling cross-site tracking and targeted advertising beyond the Wix platform.

What you can do

Institutional analysis (Compliance & governance intelligence)

(1) REGULATORY LANDSCAPE: This provision engages GDPR Article 6 (lawful basis for sharing), Article 28 (processor agreements with sub-processors), and Recital 47 (legitimate interests). Under CPRA, sharing personal information with third parties for cross-context behavioral advertising may constitute a 'sale' or 'sharing' requiring opt-out rights. The FTC's framework on unfair or deceptive practices applies to US users. EU regulators, including national Data Protection Authorities, have issued guidance requiring clear disclosure and, in many cases, consent for analytics and advertising data sharing. (2) GOVERNANCE EXPOSURE: Medium. The breadth of third-party sharing described is consistent with common industry practice for large SaaS platforms but creates meaningful compliance obligations around maintaining an accurate record of processing activities (GDPR Article 30), ensuring sub-processor agreements are current, and honoring user opt-out rights. The scope of 'trusted third-party service providers' is not exhaustively defined in standard Wix policy language, which may create disclosure gaps. (3) JURISDICTION FLAGS: California residents have CPRA opt-out rights for sharing with advertising networks. EU and EEA users require a documented lawful basis (likely legitimate interests with a balancing test, or consent) for each sharing purpose. UK GDPR imposes equivalent requirements. Transfers of shared data outside the EU or UK require appropriate transfer mechanisms. (4) CONTRACT AND VENDOR IMPLICATIONS: Businesses using Wix should confirm whether Wix's sub-processor list is publicly available and kept current, as GDPR Article 28 requires notification of sub-processor changes. Contracts with Wix should include audit rights and sub-processor change notification provisions. (5) COMPLIANCE CONSIDERATIONS: Organizations should evaluate whether their use of Wix-integrated analytics and advertising tools creates independent consent obligations under their own privacy programs, particularly where EU or California users are involved. A review of Wix's current sub-processor list is recommended as part of any vendor due diligence process.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Collection of Data from Visitors to User-Built Websites medium
• International Data Transfers medium
• Data Subject Rights (EU, UK, California) low
• Cookies and Tracking Technologies medium
• Children's Privacy and Age Restriction low
• Aggregated and De-Identified Data Use low

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.