Redlinethe fine print, decoded

Contract trap · Privacy policy

Data sold to third parties

The operator reserves the right to sell, license or share personal, browsing, location, driving or purchase data with 'partners', 'affiliates', advertisers or data brokers for their own purposes (often while claiming 'we do not sell your data' with carve-outs); recipients are described only as 'third parties' or «неопределённый круг лиц» and processing may be delegated to anyone; and de-identified or aggregated data is declared 'not personal data' usable for any purpose without limit.

Severity
Severe
How often it turns up
Almost always
Holds up?
Depends where you are
Clause phrases
24

What it looks like in a contract

Redline matches these phrases against your document verbatim. Drafters rarely invent new wording — they copy it, which is why the same sentences turn up across unrelated contracts.

In English-language contracts

  • we may sell
  • share with our partners
  • affiliates and subsidiaries
  • for their own marketing purposes
  • in exchange for valuable consideration
  • we do not sell your personal information, except
  • data partners
  • consumer reporting agencies
  • any third party we deem appropriate
  • subprocessors may change from time to time
  • de-identified or aggregated information is not personal information
  • we may use and share anonymized data for any purpose

In Russian-language contracts

  • передавать персональные данные партнёрам
  • третьим лицам в маркетинговых целях
  • аффилированным лицам Оператора
  • партнёрам Оператора для предложения товаров и услуг
  • поручить обработку персональных данных третьим лицам
  • без дополнительного согласия Пользователя
  • любым третьим лицам
  • неопределённому кругу лиц
  • перечень третьих лиц может изменяться
  • в том числе, но не ограничиваясь
  • обезличенные данные не являются персональными данными
  • Оператор вправе использовать обезличенные данные без ограничений

Check your own contract

Paste a clause, a page or the whole document. Nothing leaves your browser: the matching runs here, on this page, against the phrases above.

Run the full scan on this document

Why it bites

Data leaves the relationship entirely — brokers resell it to insurers, employers and lenders (GM driving data reached insurers' risk scores; Avast's 'anonymised' browsing data went to 100+ buyers and was re-identifiable); you cannot exercise access/deletion rights against recipients you cannot identify; the anonymity clause removes every promise in the policy for the most valuable dataset.

Is it enforceable where you are

The same clause can be routine in one country and void in another. What follows is what the law says where you are — not advice on your particular contract.

In the EU and the UK, the GDPR governs the legal basis, the retention period and your right to erasure; in the US, state privacy laws (CCPA/CPRA and its successors) give an opt-out of sale and sharing.

United States

Sharing is lawful if disclosed, but the CCPA/CPRA and most other comprehensive state privacy laws require a 'Do Not Sell or Share' opt-out and disclosure of recipient categories, and about a dozen states (California, Colorado, Connecticut, Texas, Oregon and others) also require honouring browser opt-out signals such as GPC — California fined Sephora $1.2M in 2022 for ignoring them. Selling data without disclosure is an FTC Act §5 deceptive practice.

  • Cited
  • CCPA
  • CPRA
  • FTC Act §5

European Union

Sharing for third-party marketing needs a lawful basis — almost always consent (GDPR Art 6, Recital 47); purpose limitation (Art 5(1)(b)); Arts 13(1)(e)/28: recipients or categories must be disclosed and processors contractually bound (WhatsApp €225M, 2021); pseudonymised data remains personal data (Recital 26; WP29 Opinion 05/2014); Amazon €746M (2021).

  • Cited
  • GDPR Art 6

United Kingdom

UK GDPR/DPA 2018; ICO enforcement notice against Experian (2020) over invisible data-broking; PECR for marketing contact; CMA37 treats 'at its discretion' recipient terms as potentially unfair; ICO anonymisation guidance (2025): re-identification risk must be remote.

  • Cited
  • CMA37
  • GDPR
  • ICO
  • PECR

Russia

Передача третьим лицам требует согласия (ст. 6, 7, 9 152-ФЗ) с указанием конкретных лиц и целей — согласие «неопределённому кругу» суды признают ущемляющим (ч. 2 ст. 14.8 КоАП); поручение обработки требует согласия и договора (ст. 6 ч. 3); маркетинг — только с предварительного согласия (ст. 15 152-ФЗ); 233-ФЗ (с 1 сент 2025): обезличивание без согласия только по методам Приказа РКН № 140 с обязательной передачей в ГИС по требованию Минцифры, re-identifiable «обезличенные» данные остаются ПД; штрафы ст. 13.11 КоАП, с 30 мая 2025 оборотные штрафы за незаконную обработку/утечку.

  • Cited
  • 152-ФЗ
  • 233-ФЗ
  • ст. 13.11 КоАП
  • ст. 14.8 КоАП
  • ст. 15
  • ст. 6 ч. 3

Where this has actually happened

Regulator actions, court rulings and the contracts they were fought over.

  • FTC v. Avast (Feb 2024) — $16.5M, 'anonymised' browsing data sold via Jumpshot to 100+ third parties and re-identifiable
  • California AG v. Sephora (Aug 2022) — $1.2M, undisclosed 'sale' via ad cookies and ignoring GPC signals
  • FTC v. General Motors/OnStar (16 Jan 2025) — 5-year ban on disclosing driving/geolocation data to consumer reporting agencies; Texas AG v. Allstate/Arity (Jan 2025)
  • FTC v. X-Mode/Outlogic and InMarket (Jan 2024), Gravy Analytics/Venntel and Mobilewalla (Dec 2024) — bans on selling sensitive location data
  • DPC v. WhatsApp (Sept 2021) — €225M for opaque information about recipients and processing
  • 233-ФЗ от 08.08.2024 and Приказ Роскомнадзора № 140 (2025) — обезличивание methods and mandatory transfer to ГИС from 1 Sept 2025

What to do

In order, from the thing that takes a minute to the thing that takes a letter.

  1. Search for 'sell', 'share', 'partners', 'affiliates', 'valuable consideration', 'de-identified'
  2. Exercise every opt-out (Do Not Sell/Share, Global Privacy Control, in-app toggles) and keep confirmations
  3. Demand the list of recipients/processors in writing (GDPR Art 13/15
  4. 152-ФЗ ст. 14 — 10 рабочих дней) and whether the operator commits not to re-identify
  5. EU/UK/RU: withdraw consent and object — sharing for third-party marketing needs consent
  6. RU: consent to unspecified recipients is treated by courts as no consent (ст. 9 ч. 4 152-ФЗ) and обезличивание must use RKN-approved methods (Приказ РКН № 140, 2025)
  7. For cars, fitness, health and antivirus products assume the data is monetised unless the policy says otherwise.

Check your own document

Traps that travel with it

Drafters who use one of these usually use several.

79 traps · 1789 verbatim clause phrases