Third-party data sharing in ecommerce: compliance risks you are overlooking

The average ecommerce store loads 40-60 third-party scripts on its pages. Each one sends customer data somewhere outside your infrastructure. Most store operators could not name all of those destinations or explain what data each script sends. That information gap is a significant compliance risk.

Regulators are increasingly treating this ecosystem as intentional data sharing, not technical overhead. The California Privacy Protection Agency fined Sephora $1.2 million in 2022 for sharing customer data with advertising networks via pixel tracking, and specifically for failing to honor Global Privacy Control signals that would have stopped that sharing. The enforcement message was clear: running pixels is sharing personal data and requires an opt-out mechanism.

How ecommerce stores share data without realizing it

Most data sharing happens through client-side JavaScript loaded on your store's pages. When a customer visits your site, their browser downloads and executes these scripts, which collect behavioral data and send it to the script owner's servers. You do not see this traffic in your own server logs.

Common data-sharing scripts on ecommerce stores:

• Meta Pixel. Sends page view events, AddToCart events, InitiateCheckout events and Purchase events (with value and items) to Meta. Includes the customer's hashed email address if they are logged into Facebook and have visited your store before. Meta can match this to their profile and target them with ads on behalf of you and other advertisers.
• Google Analytics 4 and Google Ads tags. GA4 sends behavioral data to Google including pages visited, time on site, purchase events and ecommerce data. Google Ads tags send conversion data. Google uses this data to improve its advertising products beyond just your campaigns. Implementing Google Consent Mode v2 controls what data these tags collect based on visitor consent state.
• TikTok Pixel. Functions similarly to Meta Pixel, sending behavioral and ecommerce events to TikTok for ad targeting. TikTok has faced specific scrutiny over data handling given its Chinese corporate ownership.
• Pinterest Tag. Sends conversion and behavioral data to Pinterest for ad optimization and audience building.
• Snapchat Pixel. Same pattern as Pinterest Tag but for Snapchat's advertising platform.
• Affiliate tracking. Scripts from affiliate networks (ShareASale, CJ Affiliate, Impact) track customer journeys to attribute purchases to affiliates. These send transaction data including order values to the affiliate network.
• Review platforms. Yotpo, Trustpilot and similar platforms run scripts that collect customer behavior data and in some cases email customers for review requests.
• Loyalty program providers. Third-party loyalty platforms (Smile.io, LoyaltyLion) process customer identity and purchase data on their own infrastructure.
• Live chat and chatbots. Intercom, Drift, Gorgias and similar platforms capture customer identity and conversation data on third-party servers.

What counts as "sale" or "sharing" under CCPA and CPRA

CPRA amended CCPA to cover both the "sale" and "sharing" of personal information. The distinction is important because it closes the gap that allowed businesses to claim they were not "selling" data to advertising platforms when no money changed hands.

Under CPRA, "selling" means disclosing personal information to a third party for monetary or other valuable consideration. "Sharing" means disclosing personal information to a third party for cross-context behavioral advertising, even if no money changes hands.

This definition covers almost all advertising pixel activity. When your store fires a Meta Pixel that sends a customer's browsing behavior to Meta, and Meta uses that data to show that customer ads on Instagram (cross-context behavioral advertising), that is "sharing" under CPRA. The fact that you receive ad targeting services rather than cash does not matter. The consideration (better ad targeting) is the value received.

The CPPA's Sephora enforcement action confirmed this interpretation. Sephora argued that its pixel activity was not a "sale" of personal information. The CPPA found it was at minimum "sharing" and fined Sephora accordingly.

GDPR: processor vs controller distinction

Under GDPR, the compliance treatment of third-party data flows depends on the role of each party. The distinction between controller and processor is fundamental:

• Controller. An entity that determines the purposes and means of processing. Your store is a controller: you decide what data to collect and why.
• Processor. An entity that processes personal data on behalf of a controller, following the controller's instructions. Your email marketing platform is a processor when it sends emails on your behalf.
• Independent controller (or joint controller). An entity that processes personal data for its own purposes. Meta is an independent controller when it uses pixel data for its own advertising products beyond just your campaigns.

The compliance requirements differ by role. When you share data with a processor, you need a data processing agreement (DPA) and the processor can only use the data as directed. When you share data with an independent controller, that sharing requires its own legal basis (typically consent), full disclosure in your privacy policy and any required cross-border transfer mechanisms.

Meta, Google and other advertising platforms are typically joint or independent controllers for the data they receive through pixels. This means firing a Meta Pixel without user consent is sharing personal data with an independent controller without a valid legal basis. Under GDPR, this requires prior consent from EU visitors.

Data processing agreements: what you need

GDPR Article 28 requires a written contract (DPA) between a controller and any processor it uses. The DPA must specify:

• Subject matter and duration of the processing
• Nature and purpose of the processing
• Type of personal data and categories of data subjects
• Obligations and rights of the controller
• That the processor only processes data on documented instructions from the controller
• Confidentiality obligations on authorized personnel
• Security measures
• Subprocessor management requirements
• Assistance to the controller for data subject requests
• Deletion or return of data after services end
• Audit rights

Major SaaS providers offer standard DPAs accessible through their account settings or on request. You typically need to actively sign or accept the DPA; it does not apply automatically. Having signed DPAs with all your processors is a baseline GDPR compliance requirement.

Vendor audit requirements

GDPR requires that controllers not use processors without "sufficient guarantees" that they will implement appropriate technical and organisational measures. CCPA and CPRA require written service provider agreements for processors. These obligations mean you cannot simply add a new vendor without assessing their privacy and security practices.

A vendor privacy audit does not need to be a full due diligence exercise for every vendor. A proportionate approach based on data sensitivity and volume:

• High sensitivity (payment data, health data, large volumes of personal data): Full DPA review, security certifications check (SOC 2 Type II, ISO 27001), data residency options and deletion procedures.
• Medium sensitivity (email lists, analytics, customer service): Standard DPA sign-off, privacy policy review, GDPR/CCPA compliance statement.
• Lower sensitivity (CDN, hosting, infrastructure): Standard DPA, verify they do not use your data for their own purposes.

Facebook Custom Audiences and GDPR

Facebook Custom Audiences allows you to upload customer email lists to Meta and target ads to those customers on Facebook and Instagram. This has specific GDPR compliance implications.

The European Court of Justice's Schrems II ruling (2020) invalidated the Privacy Shield that made US transfers lawful. Subsequently, EU data protection authorities issued guidance that uploading EU customer data to Meta's US infrastructure without adequate transfer safeguards is unlawful. Meta updated its Terms of Service to include SCCs as a transfer mechanism, but individual advertisers are still responsible for ensuring their use of Custom Audiences has a valid legal basis for the initial sharing.

To use Custom Audiences compliantly for EU customers: the customers must have consented to their data being shared with Meta for advertising purposes (this goes beyond consent to your own marketing emails), you need SCCs or DPF to cover the transfer and you need to disclose this practice in your privacy policy.

Many EU ecommerce operators have moved to Lookalike Audiences based only on US customer data, or have implemented server-side Conversions API flows that minimize direct data transfers to Meta.

Real enforcement cases

Regulatory enforcement of third-party data sharing has accelerated since 2022:

• Sephora, California, 2022: $1.2 million. The CPPA found that Sephora shared customer data with advertising networks through pixel tracking and failed to honor GPC signals. This was the first CCPA enforcement action to specifically address pixel-based data sharing.
• Meta Pixel hospital cases, US, 2022-2023. Multiple healthcare providers were found to have installed Meta Pixel on patient portals, transmitting protected health information to Meta. Class action lawsuits followed, with settlements reaching tens of millions of dollars. The FTC and HHS issued guidance prohibiting pixel use on pages containing health information.
• Clearview AI, EU, 2022-2023. Multiple EU supervisory authorities fined Clearview for scraping and sharing facial recognition data without legal basis. While not a typical ecommerce case, it established the principle that large-scale data sharing for advertising or profiling purposes requires explicit legal basis under GDPR.
• TikTok, EU, 2023: 345 million euros. The Irish DPC fined TikTok for processing children's data including sharing with third parties without adequate safeguards. Platform-level enforcement with direct implications for any brand using TikTok Pixel on pages accessible to minors.

Practical audit checklist for third-party data sharing

A practical audit process for ecommerce stores:

• Inventory all third-party scripts. Use a browser developer tools network tab scan or a tool like Ghostery, uBlock Origin or Cookiebot to catalog every script loading on each page type (homepage, product page, cart, checkout, confirmation page). Scripts on the checkout confirmation page are particularly sensitive as they can capture order values and email addresses.
• Classify each script. Is this vendor a processor (acts on your instructions only) or an independent/joint controller (uses data for their own purposes)? Advertising pixels are almost always independent controllers.
• Identify legal basis for each. For EU visitors: do you have consent for advertising pixel fires? Is that consent properly collected before the pixel fires? For US visitors: do you have a CCPA opt-out mechanism that stops pixel fires for opted-out visitors?
• Check DPA status. Have you signed a DPA with each processor? When was it last reviewed? Does it reference the current 2021 SCCs?
• Verify service provider agreements. For CCPA compliance, do you have written service provider agreements with vendors confirming they will not sell or share the data for their own commercial purposes?
• Test GPC signal handling. Visit your site with a GPC-enabled browser (Firefox with Privacy Badger extension or a Chromium browser with the GPC extension). Do advertising pixels fire? If they do, you are not honoring GPC as required by California law.
• Review your privacy policy. Does it list all third parties that receive personal data? Does it describe the categories of data shared with each? Does it explain how customers can opt out of sharing?

Frequently asked questions

Does firing a Meta Pixel count as selling data under CCPA?

Yes. Under CPRA, sending customer browsing data to Meta via the Pixel constitutes sharing of personal information for cross-context behavioral advertising. The Sephora enforcement action confirmed this interpretation with a $1.2 million fine.

What is a data processing agreement and do I need one?

A data processing agreement (DPA) is a GDPR Article 28 contract between a controller and processor specifying how personal data will be handled. You need a signed DPA with every vendor that processes your customers' personal data, including email platforms, analytics tools and payment processors.

How do I audit third-party scripts on my ecommerce store?

Use browser developer tools, Ghostery or a tool like Cookiebot to catalog every script loading on each page type. Classify each vendor as a processor or independent controller, identify the legal basis for each data flow and verify you have signed DPAs with all processors.

Is Google Analytics data sharing considered a sale under CCPA?

It depends on your GA4 configuration. If Google Analytics shares data with Google for advertising purposes, this constitutes sharing under CPRA. Configure GA4 to disable advertising data sharing for opted-out visitors and honor GPC signals.