Third-Party Data Sharing
Third-party sharing clauses let the service hand your data to advertisers, data brokers, and 'affiliates' — sometimes hundreds of companies at once.
This family of clauses authorizes the service to transmit your personal information to other companies. The words to watch are 'partners', 'affiliates', 'service providers', and especially 'legitimate business purposes' — categories broad enough to include ad-tech exchanges, data brokers, and any corporate relative the parent company later acquires.
Modern programmatic advertising makes the count absurd: a single mobile app can beam device identifiers and location to over a hundred bidding partners in real time, each becoming an independent controller of a copy of your data. Once distributed, the data cannot be recalled — deletion requests to one company do not propagate to the ecosystem.
The honest versions of this clause name categories, purposes, and transfer mechanisms (e.g., standard contractual clauses for EU data). The dishonest ones use one sentence — 'we may share information with third parties to improve our services' — which is functionally a blank authorization. Location, identifiers, and behavioral profiles deserve a named, bounded list.
Collected device identifiers, IP addresses, and behavioral ad categorization profiles are transmitted in real-time to over 140 programmatic bidding partners and corporate data brokers located both domestically and internationally.
ToS-TLDR ranks data-sharing breadth under privacy risks — broker syndication, real-time bidding, and unbounded 'affiliates' score high severity.
Scan a terms-of-service document free →