Cross-Context Behavioral Advertising Data Sharing

What it is

Zelle and its advertising partners use tracking technologies to build a profile of your interests and show you targeted ads on the Zelle website and on other websites you visit.

Why it matters (compliance & governance perspective)

The clause establishes a data-sharing framework that permits behavioral tracking across contexts beyond Zelle's own platform, expanding the scope of data collection and enabling third-party advertising partners to build interest profiles for ad targeting purposes.

This document changed recently

Consumer impact (what this means for users)

Personal identifiers and internet activity data collected on zelle.com are shared with advertising service providers and third-party networks and may be used to target you with ads across the broader web, with the underlying data retained for up to 26 months.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision directly implicates CPRA's definition of 'sharing' personal information for cross-context behavioral advertising, which triggers opt-out rights equivalent to those for sales of personal information. The California Privacy Protection Agency is the primary enforcement authority for CPRA. The provision also engages the FTC Act with respect to transparency and notice adequacy for behavioral advertising practices. GOVERNANCE EXPOSURE: High. The sharing of personal identifiers and browsing data with advertising networks for cross-context behavioral advertising is one of the most actively enforced areas under CPRA. The document acknowledges this by providing opt-out mechanisms, but compliance teams should verify that the technical implementation of opt-out signals, including GPC, is functioning correctly and that downstream sharing with advertising partners is actually suspended upon opt-out. JURISDICTION FLAGS: California residents have an explicit opt-out right under CPRA. Other U.S. states with comprehensive privacy laws, including Colorado, Connecticut, Virginia, and Texas, have similar opt-out rights for targeted advertising that may apply to Zelle website visitors from those states. The 26-month retention period for advertising data should be evaluated against state data minimization requirements. CONTRACT AND VENDOR IMPLICATIONS: Service provider agreements with advertising networks and analytics providers should include data processing terms that restrict use of shared data to the disclosed purposes and require cessation of processing upon receipt of valid opt-out signals. Procurement teams should audit whether current vendor contracts reflect the limitations implied by the notice's opt-out commitments. COMPLIANCE CONSIDERATIONS: A technical audit of the Cookie Preference Center and GPC signal recognition should be conducted to confirm opt-out requests result in actual cessation of behavioral advertising data sharing. Data maps should document the specific third-party advertising networks receiving personal identifiers and browsing data, the categories of data shared, and the contractual restrictions governing their use.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Consent by Website Use medium
• Data Retention Schedules medium
• Disclosure of Fraud Report Data to Financial Institutions medium
• Global Privacy Control and Do Not Track Acceptance low
• Minors Privacy and COPPA Compliance low
• California B2B Privacy Rights low

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.