Aggregated Data

What is aggregated data?

In a vendor contract, aggregated data is a carve-out. It is data the vendor builds by combining information from you and other customers, then stripping out who it came from. The clause often says the vendor may use that result for its own purposes, sometimes with no end date.

The idea sounds harmless: totals and averages, not your records. The detail is in the wording. The clause decides what counts as aggregated, who checks that it really is anonymous, and what the vendor may do with it.

These clauses often pair "aggregated" with "anonymized" or "de-identified." Those words have their own legal meanings, explained in anonymized data and de-identified data.

How the law treats aggregate data

California's privacy law, the CCPA, defines "aggregate consumer information" as data about a group from which individual identities have been removed. The statute says it must not be linked or reasonably linkable to any consumer or household, including through a device.

That definition has two effects. Aggregate consumer information is not personal information. And Section 1798.145 says the law does not restrict a business's ability to use, sell or share it. So once data truly qualifies, most CCPA protections stop.

The statute adds a limit: one or more individual records that have been deidentified are not aggregate consumer information. A vendor that keeps record-level data and calls it "aggregated" may not meet this test.

What it looks like in a vendor's terms

A typical clause reads like this:

Provider may collect and aggregate data derived from Customer's use of the Services and Customer Data, provided it does not identify Customer or any individual. Provider owns this Aggregated Data and may use it during and after the term to improve its products, develop new services and publish benchmarks.

• "Derived from... Customer Data": some clauses reach only usage data. This one reaches the content you upload too.
• "Does not identify": the only limit. The clause sets no standard for how well the data must be stripped, and gives you no right to check.
• "Provider owns": the vendor claims the result outright, even though it came from your data.
• "During and after the term": the right survives when you leave, so deleting your account may not end it.
• "Develop new services": a broad purpose that can cover new products or AI features.

Zoom's terms of service have a clause of this kind. Section 28 lets Zoom aggregate technical and other data "on a de-identified or anonymized basis" and use it to develop the services and to create industry benchmarks.

A real change we caught

Venpo flagged this change: Klaviyo no longer promises to pass privacy requests on to you. The same new DPA, effective September 11, 2026, added "aggregated and de-identified insights" to the purposes for which Klaviyo may process customer data. A new purpose like this is where an aggregated data clause starts to matter, so the rules on how the data is combined and stripped are the part to read.

Why it matters to you

An aggregated data clause can turn your data into the vendor's asset. Your sales numbers, support volumes or user behavior could feed benchmarks your competitors see, or train features the vendor sells.

Weak stripping is a real risk. If the result can be traced back to your company or your users, you may have shared personal data in a way your own privacy policy does not describe.

The clause can also undercut other promises. A vendor may promise not to use your customer data for AI training, then allow aggregated data from it to be used for anything.

What to check

• Whether the clause reaches only usage data or also your customer data.
• How "aggregated" and "anonymized" are defined, and whether a recognized standard applies.
• Whether the result must exclude your company name, not only individuals.
• What the vendor may use it for, and whether AI training is on that list.
• Whether the vendor may share or sell it to third parties.
• What to ask for: limit it to improving the service you buy, require that it identify neither you nor any person, and ban attempts to re-identify it.

How Venpo helps

Venpo monitors your vendors' terms, privacy policies and DPAs and emails you when an aggregated or anonymized data clause is added or widened. The Fine Print Scan also flags whether each vendor trains AI on your data or uses it for ads.