Third-Party Sharing and Disclosure

What it is

ZipRecruiter receives your browsing and device data from analytics and advertising partners, and may supplement your profile with data bought or obtained from other external sources.

Why it matters (compliance & governance perspective)

Your data profile at ZipRecruiter may be enriched with information from third-party advertising networks and data brokers, potentially creating a more detailed picture of you than what you directly provided.

Consumer impact (what this means for users)

ZipRecruiter may combine the data you provide with behavioral and business data sourced from advertising networks and third-party data providers, which may result in a more comprehensive personal profile being used for job matching and marketing without your direct awareness.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: Under GDPR Articles 13 and 14, users must be informed of third-party data sources used to supplement their profiles, and the legal basis for such processing must be identified. CCPA requires disclosure of categories of sources from which personal information is collected. The policy satisfies basic CCPA disclosure requirements but is less specific about named third-party sources, which may be insufficient for GDPR Article 14 compliance if EEA users are affected. GOVERNANCE EXPOSURE: Medium. The policy discloses third-party data sourcing broadly but does not name specific analytics providers or advertising networks, limiting users' ability to understand or challenge the data enrichment process. Advertising network data combined with job seeker profiles creates a cross-context behavioral profiling concern. JURISDICTION FLAGS: California users have CCPA rights to know the categories of sources, which are disclosed at a high level. EEA users have stronger rights to specific source identification under GDPR Article 14. The combination of employment data with behavioral advertising data may attract scrutiny from European DPAs. CONTRACT AND VENDOR IMPLICATIONS: Organizations sharing employee data with ZipRecruiter should assess whether ZipRecruiter's supplemental third-party data enrichment of employee profiles is consistent with their own data governance commitments. Vendor assessments should include ZipRecruiter's sub-processor and data partner lists. COMPLIANCE CONSIDERATIONS: Legal teams should request ZipRecruiter's sub-processor list and data partner disclosures to assess downstream data flows. GDPR Article 14 compliance for enriched profiles should be evaluated, including whether individuals receive notice of third-party data sources within the required timeframes.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• AI and Machine Learning Use for Job Matching medium
• Non-User Data Collection from Third Parties medium
• EU-U.S. Data Privacy Framework Certification medium
• Sensitive Personal Data Advisory and Resume Submissions medium
• Connected Account Data Access medium
• Data Subject Access Rights (Non-EEA Users) low

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.