Data Sharing With Partners: What Privacy Policies Really Mean (And Who Gets Your Info)
"The 347 companies that know you downloaded that app"
You finally found the perfect fitness tracking app. It has beautiful charts, integrates with your smartwatch, and the free version has everything you need. Before you can start logging workouts, up pops the privacy policy—a wall of text you scroll past and tap "Accept."
Buried in paragraph 47, there's a line that reads: "We may share your information with select partners for marketing and analytics purposes."
Select partners. Marketing. Analytics. Innocuous-sounding words that could mean anything—or everything.
The truth is, that vague language might authorize the app to sell your workout data, location history, and health metrics to hundreds of data brokers, advertisers, and unknown third parties. And thanks to the privacy policy you just accepted, it's all perfectly legal.
Welcome to the hidden economy of data sharing partnerships, where your personal information is the product and "partners" is a deliberately ambiguous term designed to obscure what's really happening to your data.
What "Partners" Actually Means in Privacy Policies
When privacy policies mention sharing data with "partners," they're rarely referring to a curated list of trusted collaborators. Instead, "partners" typically falls into one of these categories—some legitimate, others deeply concerning:
Service Providers (Usually Legitimate)
These are companies that actually help deliver the service you're using:
- Cloud hosting providers (AWS, Google Cloud, Azure) – Store your data securely
- Payment processors (Stripe, PayPal) – Handle transactions
- Analytics services (Google Analytics, Mixpanel) – Help the company understand app usage
- Customer support platforms (Zendesk, Intercom) – Manage help tickets
- Email delivery services (SendGrid, Mailchimp) – Send notifications and updates
The key distinction: service providers process data on behalf of the company and are contractually bound to use it only for the specified purpose. They shouldn't be using your data for their own independent purposes.
Advertising Partners (Highly Concerning)
This is where privacy policies get problematic. "Advertising partners" typically include:
- Ad networks (Google Ads, Meta Audience Network) – Deliver targeted advertisements
- Data brokers (Acxiom, LexisNexis, Experian) – Buy, aggregate, and sell consumer profiles
- Attribution providers (AppsFlyer, Adjust) – Track which ads led to app installs
- Real-time bidding platforms – Auction your data profile to advertisers in milliseconds
These partners don't just process your data—they actively use it to build profiles, target ads, and often resell insights to others. Your "partnership" with them is non-consensual and invisible.
Affiliates (Often Overlooked)
"Affiliates" refers to parent companies, subsidiaries, and sister companies under common ownership. When you share data with a startup, you might also be sharing it with:
- The massive tech conglomerate that acquired them last year
- Their subsidiary in a country with weaker privacy laws
- Sister brands you didn't even know were related
Privacy policies often treat intra-company sharing as not really "sharing" at all, even though your data may travel across corporate boundaries and jurisdictions.
Business Partners (Purpose-Limited)
These are companies the app explicitly collaborates with:
- Integration partners – Apps that connect with the service you're using
- Co-marketing partners – Companies running joint promotions
- Referral partners – Services recommended within the app
This category is theoretically limited to specific, disclosed purposes—but the definitions can be stretched to include surprising relationships.
Successors (The Broadest Category)
This refers to companies that might acquire the business in the future. Privacy policies typically state that your data is an asset that can be transferred in a merger, acquisition, or bankruptcy. Today's privacy-conscious startup could become tomorrow's data-hungry conglomerate—with your information as part of the deal.
The Data Broker Ecosystem: Where Your Data Really Goes
To understand the scope of "partner" data sharing, you need to understand data brokers—the shadowy companies that trade in personal information.
Major data brokers include:
- Acxiom – Claims to have data on 2.5 billion consumers globally
- LexisNexis – Originally a legal research company, now a massive consumer data aggregator
- Experian, Equifax, TransUnion – Credit bureaus that also sell marketing data
- CoreLogic – Specializes in property and mortgage data
- Oracle Data Cloud – Collects data from thousands of sources for ad targeting
Hundreds of smaller brokers operate beneath these giants, buying data from apps, websites, and loyalty programs, then repackaging and reselling it.
The process typically works like this:
- You use an app that shares data with "analytics partners"
- Those partners combine your data with information from thousands of other sources
- They build a comprehensive profile: demographics, interests, behaviors, location patterns
- Advertisers, insurers, employers, and even government agencies buy these profiles
- You receive targeted ads, higher insurance quotes, or other algorithmically determined outcomes
And you agreed to all of this when you accepted that privacy policy.
Finding the Actual List of Partners (If It Exists)
Some privacy-conscious companies are becoming more transparent about data sharing. Here's how to find the actual list of partners—if the company provides one:
Check the Privacy Policy Section on Third Parties
Look for sections titled "Information Sharing," "Third Parties," "Service Providers," or "Data Recipients." The best policies include specific company names. The worst use only vague categories.
Look for Linked Lists or Downloads
Some companies—particularly those subject to California privacy laws—provide downloadable CSV files or linked pages listing all third parties that receive data. This is the gold standard of transparency.
Review California-Specific Disclosures
The California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) require detailed disclosures about data sharing. Even if you don't live in California, the "California Privacy Rights" section often contains the most detailed information about partners.
Search for "Categories of Third Parties"
CCPA requires companies to disclose categories of third parties that receive data (advertising networks, data analytics providers, etc.). While not as useful as specific names, this gives you a sense of the ecosystem.
Check for "Do Not Sell/Share" Mechanisms
If a company has a "Do Not Sell or Share My Personal Information" link, they're acknowledging that data sharing occurs. Click it to see what options (if any) you have to opt out.
Red Flag Language to Watch For
Certain phrases in privacy policies signal particularly concerning data sharing practices:
"We may share with partners we believe are reputable" Red flag: Vague, subjective standard with no actual accountability. They can share with anyone they "believe" is okay, and you'll never know.
"For marketing purposes" without specifics Red flag: This often means selling data to data brokers and ad networks. If they can't name the partners, there are probably too many to list.
"As necessary for our business operations" Red flag: Broad catch-all that can justify almost any sharing. What isn't "necessary" for some business purpose?
"We reserve the right to share data with third parties" Red flag: Future-tense language suggesting they haven't decided yet who they'll share with. This anticipates broad sharing authority.
No opt-out mechanism described Red flag: If there's no way to prevent sharing, the company probably doesn't want you to know how extensive it is.
Practical Steps: Auditing Your Data Sharing
If you're concerned about where your data goes, take these steps:
1. Search the Privacy Policy for Key Terms
Use Ctrl+F (or Cmd+F) to search for: "partner," "third party," "share," "sell," "disclose," and "affiliate." Read every paragraph containing these terms.
2. Look for Specific Named Partners vs. Vague Categories
A policy that says "we share with Google Analytics and Stripe" is more transparent than one that says "we share with analytics and payment partners." Specificity equals accountability.
3. Check California-Specific Disclosures
Even non-California residents should read the California section, as it often contains the most granular information about data sharing practices.
4. Submit a CCPA Data Access Request
Under California law (and increasingly under other state laws), you can request a copy of the personal information a company has about you, including who they've shared it with. Use a template like:
"Pursuant to the California Consumer Privacy Act, I request that you disclose:
- The categories of personal information you have collected about me
- The categories of sources from which you collected this information
- The business or commercial purpose for collecting this information
- The categories of third parties with whom you share this information
- The specific pieces of personal information you hold about me
Please provide this information in a portable, readily usable format within 45 days."
You don't need to be a California resident for many companies to honor this request—many apply CCPA rights universally to simplify compliance.
5. Submit Opt-Out Requests to Major Data Brokers
Even if you can't stop the app from sharing initially, you can request deletion from major data brokers:
- Acxiom: Visit their opt-out page
- LexisNexis: Submit a consumer disclosure request
- Experian: Use their marketing opt-out
- Check the Data & Marketing Association opt-out registry
These opt-outs are imperfect and must be repeated periodically, but they reduce your exposure.
6. Use Privacy-Focused App Alternatives
When you find an app with concerning data sharing practices, look for alternatives that:
- Offer end-to-end encryption
- Have clear, limited privacy policies
- Are open-source (allowing code review)
- Don't require accounts or collect minimal data
- Are based in privacy-respecting jurisdictions
Services like PrivacyGuides.org and EFF's Privacy Guide can help identify better alternatives.
The Legal Landscape: What's Changing
Recent legislation is slowly forcing more transparency around data sharing:
California Privacy Rights Act (CPRA) expands on CCPA by requiring companies to disclose the "categories of third parties" that receive data and providing stronger opt-out rights for data "sharing" (not just "selling").
Virginia Consumer Data Protection Act (VCDPA) and similar state laws are giving residents of other states access to information about data sharing.
European GDPR requires disclosure of recipients or categories of recipients of personal data, and generally requires a legal basis for any sharing.
Platform Policy Changes: Both Apple and Google now require apps to disclose data collection and sharing practices in standardized nutrition-label formats before download, making it easier to spot problematic sharing upfront.
The Bottom Line
The phrase "we may share data with partners" is privacy policy boilerplate that obscures a vast and largely invisible data economy. Your personal information—your location, health metrics, purchase history, browsing behavior—may be flowing to hundreds of companies you've never heard of, used for purposes you'd never approve of, and stored indefinitely in databases you'll never access.
The solution isn't to stop using apps—it's to become a more informed consumer of privacy policies. Look for specificity. Demand transparency. Exercise your legal rights to access and deletion. And when companies won't be clear about their "partners," consider taking your business to competitors who will.
In the data economy, information is power. Don't give yours away without knowing exactly what you're getting in return—and exactly who else is getting it too.
TermsEx helps you understand what's really happening to your data. Our contract and policy analysis tools identify vague data sharing language and flag concerning privacy practices, so you can make informed decisions about which services to trust with your personal information.