Selling, sharing, and targeted advertising

Sale: US state privacy laws generally require companies to provide clear and conspicuous notice of and allow consumers to opt out of the “sale” of their personal information to third parties. In some US states, "sale" is defined broadly to include any transfer or disclosure of personal information for money or other valuable consideration.

Sharing: In California, the California Privacy Rights Act (CPRA) amendments to the California Consumer Privacy Act (CCPA) also require notice of and the ability to opt out of the “sharing” of personal information, with “sharing” defined as the disclosure of personal information for “cross-context behavioral advertising.” “Cross-context behavioral advertising," in turn, means “the targeting of advertising to a consumer based on the consumer's personal information obtained from the consumer's activity across businesses, distinctly-branded websites, applications, or services, other than the business, distinctly-branded website, application, or service with which the consumer intentionally interacts.”

Targeted Advertising: Other US states permit consumers to opt out of “targeted advertising,” which is similar to “sharing” and defined as “displaying advertisements to a consumer where the advertisement is selected based on personal information obtained from that consumer's activities over time and across non-affiliated websites or online applications to predict such consumer's preferences or interests.” Targeted advertising typically does not include first party marketing, contextual advertising, or showing ads to consumers based on their request for information or feedback.

Shopify offers certain products and services to you that may be considered “sharing” of personal information with Shopify or “targeted advertising” as defined under US state privacy laws, and you might also be engaged in “selling,” “sharing,” or “targeted advertising” customer personal information, depending on how you operate your store and website. It's up to you to assess your legal obligations and make sure you provide consumers with any required notices and the ability to opt-out of those activities, as applicable.

This is not a comprehensive list of requirements related to “selling,” “sharing,” or “targeted advertising” under US state privacy laws, which are continuously changing.