Data Sharing with Advertising Partners

What it is

Google states it does not sell personal information but does share aggregated or non-personally identifiable information with advertising partners, publishers, and developers; it also shares personal data in certain defined circumstances including with user consent.

Why it matters (compliance & governance perspective)

The distinction between sharing 'personal information' and 'non-personally identifiable information' with advertising partners matters because aggregated or pseudonymous data shared at scale can sometimes be re-identified, and the boundary is not always clear to users.

This document changed recently

Consumer impact (what this means for users)

While Google asserts it does not sell personal information to third parties, it does share certain data with advertising partners and publishers, and the definition of what qualifies as non-identifiable or aggregate data may not fully capture all flows that affect users' advertising experience.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision engages CCPA/CPRA definitions of 'sale' and 'sharing' of personal information, which cover disclosures for cross-context behavioral advertising even without monetary exchange. GDPR Articles 28 and 44-49 govern transfers to third parties and international transfers. The FTC Act applies to representations about data sharing practices. Relevant authorities include the California Privacy Protection Agency (CPPA), FTC, and EU DPAs. GOVERNANCE EXPOSURE: Medium. Google's assertion that it does not 'sell' personal information is legally contested in the context of CCPA's broad definition of 'sharing,' and organizations relying on this characterization in their own compliance frameworks should evaluate it independently. The sharing of pseudonymous or aggregated data with advertising partners at Google's scale may warrant further scrutiny. JURISDICTION FLAGS: California's CPRA defines 'sharing' broadly to include disclosures for behavioral advertising purposes, regardless of monetary exchange. EU GDPR imposes strict requirements on any transfer of personal data to third-party controllers. Organizations in both regions should not assume Google's characterization of these flows aligns with their own regulatory obligations. CONTRACT AND VENDOR IMPLICATIONS: Advertisers and publishers using Google Ads products should review their data processing agreements with Google to understand what user-level signals Google receives, retains, and uses beyond the immediate campaign transaction. API-level data integrations may constitute personal data transfers subject to GDPR Chapter V. COMPLIANCE CONSIDERATIONS: Organizations should not rely solely on Google's characterization of data as 'non-personally identifiable' when assessing their own CCPA or GDPR obligations. Data mapping should include Google as a downstream data recipient. Privacy notices should accurately describe data flows to Google's advertising infrastructure.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Cross-Service Data Combination for Ad Targeting medium
• Ad Personalization and Interest-Based Targeting medium
• Location Data Collection and Use medium
• Children's Privacy Protections medium
• User Data Controls and Deletion Rights low
• Data Retention Practices low

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.