Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that Zillow's disclosure of device identifiers, hashed email addresses, cookie IDs, and interest inferences to advertising networks, social networks, and advertising partners may qualify as the sale of personal data or targeted advertising under applicable state privacy laws. The policy separately notes that Zillow does not sell or share for targeted advertising the personal data of individuals known to be under 18.
This analysis describes what Zillow's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that Zillow's data disclosures to advertising partners may trigger opt-out obligations under state privacy statutes including the CCPA, requiring Zillow to provide and honor opt-out mechanisms and potentially to disclose the categories of personal data involved in such transfers. Compliance teams should evaluate whether Zillow's Privacy Portal opt-out infrastructure satisfies the requirements of each state privacy law under which a covered user resides.
Under this provision, users' device identifiers, hashed email addresses, cookie IDs, and inferred interest profiles may be disclosed to advertising networks and social networks in ways that state privacy law may characterize as a sale. Eligible users may opt out of this processing through Zillow's Privacy Portal, subject to applicable state law limitations and exceptions.
Cross-platform context
See how other platforms handle Personal Data Sale and Targeted Advertising Disclosure and similar clauses.
Compare across platforms →Monitoring
Zillow has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Our disclosure of personal data to the following categories of third parties may qualify as the sale of personal data, or the sharing or processing of personal data for the purpose of displaying advertisements that are selected based on personal data obtained or inferred over time from an individual's activities across businesses or distinctly-branded websites, applications, or other services (otherwise known as 'targeted advertising' or 'cross-context behavioral advertising') under certain privacy laws: Advertising networks and social networks: we may share device identifiers, a hashed identifier (such as a hashed email address), cookie ID or other internet/network information; inferences about your interests and preferences, for the purpose of displaying targeted advertisements.Excerpt from Zillow's Privacy Notice
(1) REGULATORY LANDSCAPE: This provision directly engages the California Consumer Privacy Act (CCPA) as amended by the CPRA, which requires businesses to disclose and honor opt-out rights for the sale of personal data and for sharing personal data for cross-context behavioral advertising. Analogous obligations exist under state privacy statutes in Virginia, Colorado, Connecticut, Texas, and other states with comprehensive privacy laws. The FTC holds authority over unfair or deceptive advertising data practices at the federal level. Where Zillow's opt-out mechanism does not satisfy the technical or procedural requirements of a given state statute, tension between the stated terms and applicable law may arise. (2) GOVERNANCE EXPOSURE: High. The acknowledgment that advertising-related disclosures may constitute a sale of personal data is a material admission that activates statutory opt-out rights in multiple jurisdictions. The use of hashed email addresses and device identifiers for cross-network advertising is a common industry practice, but the explicit acknowledgment of potential sale characterization requires documented opt-out workflows, consent management infrastructure, and regular data flow audits. (3) JURISDICTION FLAGS: California (CCPA/CPRA) creates the most operationally defined obligations, including the requirement to post a 'Do Not Sell or Share My Personal Information' link and to process opt-out requests. Additional exposure exists under Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and Texas (TDPSA). EU/EEA users, if any, would engage GDPR consent and legitimate interest requirements for behavioral advertising, though the notice does not explicitly address EU users in this context. (4) CONTRACT AND VENDOR IMPLICATIONS: The notice states that service providers are contractually restricted from using personal data beyond agreed-upon services, but the advertising network disclosures described here are characterized as potentially constituting sales rather than service provider processing, which carries different contractual and regulatory treatment. Procurement teams should verify that data processing agreements with advertising network partners reflect the sale or sharing characterization where applicable. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should audit the Privacy Portal opt-out mechanism to confirm it satisfies the technical requirements of each applicable state statute, including response timelines and scope. Data maps should reflect the categories of personal data disclosed to advertising networks and social networks as potentially sold or shared. Annual reviews of state privacy law applicability thresholds are advisable as new statutes become effective.
This provision establishes that Zillow's data disclosures to advertising partners may trigger opt-out obligations under state privacy statutes including the CCPA, requiring Zillow to provide and honor opt-out mechanisms and potentially to disclose the categories of personal data involved in such transfers. Compliance teams should evaluate whether Zillow's Privacy Portal opt-out infrastructure satisfies the requirements of each state privacy law …
Under this provision, users' device identifiers, hashed email addresses, cookie IDs, and inferred interest profiles may be disclosed to advertising networks and social networks in ways that state privacy law may characterize as a sale. Eligible users may opt out of this processing through Zillow's Privacy Portal, subject to applicable state law limitations and exceptions.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Zillow.