Targeted Advertising

What is targeted advertising?

Targeted advertising is showing ads to a person based on what is known about them. That can be the pages they visited, what they clicked, their location, their job title, or data bought or collected from other companies.

For a business buyer, there are two ways a vendor can use data for ads. It can use data about you and your team to market its own products to you. Or it can let ad partners collect data through its website or apps, so those partners can show you ads elsewhere. The second kind is the one privacy laws focus on.

Vendors often collect this data with cookies and tracking pixels, small pieces of code that report your visit to an ad network. HubSpot's privacy policy, for example, says ad networks collect information about your interactions with its websites "to provide you targeted advertising based upon your interests."

US state privacy laws give people a right to opt out. In California, ads based on activity across different companies' sites and apps are called "cross-context behavioral advertising," and giving data to others for it counts as "sharing." See cross-context behavioral advertising below. Some vendors list the rights side by side. Atlassian's privacy policy, for example, offers US residents an opt-out from sales and targeted advertising in its US state disclosures.

What it looks like in a vendor's terms

A typical clause reads like this:

We and our advertising partners use cookies, pixels and similar technologies to collect information about your activity on our websites and on other sites over time. We use this information to show you ads that are more relevant to your interests. You can opt out of targeted advertising through our cookie settings or the privacy choices link on our website.

• "Advertising partners": outside ad networks that also receive the data. The cookie policy often names them.
• "On other sites over time": tracking that follows you beyond the vendor's own site. This is what makes it cross-context.
• "More relevant to your interests": a plain way of saying ads are picked using a profile of you.
• "Opt out": your choice to stop it, through settings, a link or a browser signal.

Vendors often sort these tools into a cookie category. Atlassian's cookie notice describes "Targeting Cookies or Advertising Cookies" that collect information about browsing habits.

A real change we caught

Venpo flagged this change: Uber now says its ad partners may combine your data with other sources. Uber's cookie notice, updated September 26, 2026, now says its ad partners "may combine this information with data they hold about you from other sources," and it added nine advertising partners. When ad partners combine data from one company with data from other sources, they can build a fuller profile of a person than either company has alone. In a different change, Google's privacy policy now says data from Gmail, Drive and Photos can shape personalized ads if you let other Google services, such as Search, access it: Gmail, Drive, and Photos can now shape Google ads if you connect them.

Why it matters to you

• Your team's data feeds ad profiles. Your employees visit vendor websites and use vendor apps every day. That activity can end up in ad networks.
• Your customers' data may be in scope. If a vendor uses data from your account, such as contact lists or usage data, for advertising, your customers' information could be used in ways you never told them about.
• Your own privacy promises. If your privacy policy says you do not share customer data for advertising, a vendor that does so with data from you can make that statement wrong.
• Contract rules. Under the CCPA, a service provider contract must bar the vendor from selling or sharing the data it processes for you. Ad use that breaks that rule is a contract problem, not just a privacy policy detail.

What to check

• Search the privacy policy for "advertising," "interest-based," "personalized ads" and "cross-context."
• Check whether ad use applies only to website visitors, or also to data you put into the product.
• Read the cookie policy for named ad partners and new pixels.
• Check your DPA or service provider terms for a ban on using your data for advertising.
• Test the opt-out: the cookie settings, the "Your Privacy Choices" link, and whether the vendor honors Global Privacy Control.

Cross-Context Behavioral Advertising

Cross-context behavioral advertising is a term from California's privacy law. It means "the targeting of advertising to a consumer" based on personal information gathered from their activity across different businesses, brands, websites, apps or services. The key is that the data comes from somewhere other than the company the person chose to deal with.

Giving personal data to others for this purpose is called "sharing" under the CCPA. Sharing does not need any payment. That is the main difference from a "sale," which requires money or something else of value. People can opt out of both, and the California Attorney General describes sharing in exactly these terms.

An example: you read a vendor's blog post about invoicing, and later see that vendor's ads on a news site. A pixel on the blog reported your visit to an ad network, which then used it on another site. Showing an ad on the vendor's own site, based only on what you did there, is not cross-context.

For more on the line between the two terms, see selling vs sharing data.

How Venpo helps

The Fine Print Scan answers whether each vendor sells your data or uses it for ads. Venpo also watches vendors' privacy policies and cookie policies, and emails you a plain-English alert when advertising language or ad partners change.