Update: Apr 04, 2025

Categories of (PI)

Categories of Sources from which the Personal Information is collected from?

Business Purpose

Length of Retention

Identifiers (e.g., a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers), or information that identifies, relates to, describes, or is capable of being associated with, a particular individual

☐ not applicable (not collected)

☒ Consumer directly;

☒ Advertising networks;

☒ ISPs;

☒ Data analytics providers;

☐ Gov’t entities;

☒ Operating systems and platforms;

☒ Social networks;

☒ Data brokers;

☐ Other third parties

☒Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards

☒ Helping to ensure security and integrity;

☒ Debugging to identify and repair errors that impair existing intended functionality.

☒ Short-term, transient use, provided that the personal information is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer’s experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction.

☒ Performing services on behalf of the business or service provider, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider.

☒ Undertaking internal research for technological development and demonstration.

☐ Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.

Retained indefinitely, unless the consumer requests that their information be deleted

Characteristics of protected classifications.

☐ not applicable (not collected)

☒ Consumer directly;

☐ Advertising networks;

☐ ISPs;

☐ Data analytics providers;

☐ Gov’t entities;

☐ Operating systems and platforms;

☐ Social networks;

☒ Data brokers;

☐ Other third parties

☐Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards

☐ Helping to ensure security and integrity;

☐ Debugging to identify and repair errors that impair existing intended functionality.

☒ Short-term, transient use, provided that the personal information is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer’s experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction.

☒ Performing services on behalf of the business or service provider, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider.

☒ Undertaking internal research for technological development and demonstration.

☐ Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.

Retained indefinitely, unless the consumer requests that their information be deleted

Commercial information (e.g., records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies)

☐ not applicable (not collected)

☒ Consumer directly;

☐ Advertising networks;

☐ ISPs;

☐ Data analytics providers;

☐ Gov’t entities;

☐ Operating systems and platforms;

☐ Social networks;

☒ Data brokers;

☐ Other third parties

☐Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards

☐ Helping to ensure security and integrity;

☐ Debugging to identify and repair errors that impair existing intended functionality.

☒ Short-term, transient use, provided that the personal information is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer’s experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction.

☒ Performing services on behalf of the business or service provider, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider.

☒ Undertaking internal research for technological development and demonstration.

☐ Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.

Retained indefinitely, unless the consumer requests that their information be deleted

Biometric information

☒ not applicable (not collected)

☐ Consumer directly;

☐ Advertising networks;

☐ ISPs;

☐ Data analytics providers;

☐ Gov’t entities;

☐ Operating systems and platforms;

☐ Social networks;

☐ Data brokers;

☐ Other third parties

☐Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards

☐ Helping to ensure security and integrity;

☐ Debugging to identify and repair errors that impair existing intended functionality.

☐ Short-term, transient use, provided that the personal information is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer’s experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction.

☐ Performing services on behalf of the business or service provider, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider.

☐ Undertaking internal research for technological development and demonstration.

☐ Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.

Retained indefinitely, unless the consumer requests that their information be deleted

Internet or other electronic network activity information (e.g., browsing history, search history, and information regarding a consumer’s interaction with an Internet Web site, application, or advertisement)

☐ not applicable (not collected)

☒ Consumer directly;

☐ Advertising networks;

☒ ISPs;

☒ Data analytics providers;

☐ Gov’t entities;

☒ Operating systems and platforms;

☐ Social networks;

☒ Data brokers;

☐ Other third parties

☒Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards

☒ Helping to ensure security and integrity;

☒ Debugging to identify and repair errors that impair existing intended functionality.

☒ Short-term, transient use, provided that the personal information is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer’s experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction.

☒ Performing services on behalf of the business or service provider, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider.

☒ Undertaking internal research for technological development and demonstration.

☐ Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.

Retained indefinitely, unless the consumer requests that their information be deleted

Geolocation data

☐ not applicable (not collected)

☒ Consumer directly;

☐ Advertising networks;

☒ ISPs;

☒ Data analytics providers;

☐ Gov’t entities;

☒ Operating systems and platforms;

☒ Social networks;

☐ Data brokers;

☐ Other third parties

☒Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards

☒ Helping to ensure security and integrity;

☒ Debugging to identify and repair errors that impair existing intended functionality.

☒ Short-term, transient use, provided that the personal information is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer’s experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction.

☒ Performing services on behalf of the business or service provider, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider.

☒ Undertaking internal research for technological development and demonstration.

☐ Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.

Retained indefinitely, unless the consumer requests that their information be deleted

Audio, electronic, visual, thermal, olfactory, or similar information (sensory data)

☒ not applicable (not collected)

Not applicable

Not applicable

Professional or employment-related information

☐ not applicable (not collected)

☒ Consumer directly;

☐ Advertising networks;

☐ ISPs;

☒ Data analytics providers;

☐ Gov’t entities;

☐ Operating systems and platforms;

☐ Social networks;

☒ Data brokers;

☐ Other third parties

☐Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards

☐ Helping to ensure security and integrity;

☐ Debugging to identify and repair errors that impair existing intended functionality.

☒ Short-term, transient use, provided that the personal information is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer’s experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction.

☒ Performing services on behalf of the business or service provider, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider.

☒ Undertaking internal research for technological development and demonstration.

☐ Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.

Retained indefinitely, unless the consumer requests that their information be deleted

Education information

☐ not applicable (not collected)

☒ Consumer directly;

☐ Advertising networks;

☐ ISPs;

☒ Data analytics providers;

☐ Gov’t entities;

☐ Operating systems and platforms;

☐ Social networks;

☒ Data brokers;

☐ Other third parties

☐Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards

☐ Helping to ensure security and integrity;

☐ Debugging to identify and repair errors that impair existing intended functionality.

☒ Short-term, transient use, provided that the personal information is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer’s experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction.

☒ Performing services on behalf of the business or service provider, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider.

☐ Undertaking internal research for technological development and demonstration.

☐ Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.

Retained indefinitely, unless the consumer requests that their information be deleted

Inferences drawn from any of the information identified above to create a profile about a consumer reflecting their preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes

☐ not applicable (not collected)

☒ Consumer directly;

☐ Advertising networks;

☒ ISPs;

☐ Data analytics providers;

☐ Gov’t entities;

☒ Operating systems and platforms;

☒ Social networks;

☒ Data brokers;

☐ Other third parties

☐Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards

☐ Helping to ensure security and integrity;

☐ Debugging to identify and repair errors that impair existing intended functionality.

☒ Short-term, transient use, provided that the personal information is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer’s experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction.

☒ Performing services on behalf of the business or service provider, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider.

☒ Undertaking internal research for technological development and demonstration.

☐ Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.

Retained indefinitely, unless the consumer requests that their information be deleted

Sensitive personal information

☐ not applicable (not collected)

☒ Consumer directly;

☐ Advertising networks;

☐ ISPs;

☒ Data analytics providers;

☐ Gov’t entities;

☐ Operating systems and platforms;

☒ Social networks;

☒ Data brokers;

☐ Other third parties

☐Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards

☐ Helping to ensure security and integrity;

☐ Debugging to identify and repair errors that impair existing intended functionality

☒ Short-term, transient use, provided that the personal information is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer’s experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction.

☒ Performing services on behalf of the business or service provider, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider.

☒ Undertaking internal research for technological development and demonstration.

☐ Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.

Retained indefinitely, unless the consumer requests that their information be deleted

Categories of Personal Information (PI)

Categories of Third Parties to Whom Such PI is Disclosed

Specific Business or Commercial Purpose for Disclosure

Identifiers (e.g., a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers), or information that identifies, relates to, describes, or is capable of being associated with, a particular individual

☐ not applicable (not disclosed)

☒ direct lead buyers;

☒ email marketers/email marketing partners;

☐ email service providers;

☐ offline marketing partners;

☐ advertising networks;

☐ payment processors;

☒ data hygiene companies;

☐ ISPs;

☐ data analytics providers;

☐ gov’t entities;

☐ operating systems and platforms;

☒ social networks;

☒ data brokers;

☐ acquirer of assets;

☐ others

☒Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards

☒ Helping to ensure security and integrity;

☐ Debugging to identify and repair errors that impair existing intended functionality.

☐ Short-term, transient use, provided that the personal information is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer’s experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction.

☒ Performing services on behalf of the business or service provider, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider.

☒ Undertaking internal research for technological development and demonstration.

☐ Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.

Characteristics of protected classifications.

☒ not applicable (not disclosed)

☐ direct lead buyers;

☐ email marketers/email marketing partners;

☐ email service providers;

☐ offline marketing partners;

☐ advertising networks;

☐ payment processors;

☐ data hygiene companies;

☐ ISPs;

☐ data analytics providers;

☐ gov’t entities;

☐ operating systems and platforms;

☐ social networks;

☐ data brokers;

☐ acquirer of assets;

☐ others

Not applicable

Commercial information (e.g., records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies)

☒ not applicable (not disclosed)

☐ direct lead buyers;

☐ email marketers/email marketing partners;

☐ email service providers;

☐ offline marketing partners;

☐ advertising networks;

☐ payment processors;

☐ data hygiene companies;

☐ ISPs;

☐ data analytics providers;

☐ gov’t entities;

☐ operating systems and platforms;

☐ social networks;

☐ data brokers;

☐ acquirer of assets;

☐ others

Not applicable

Biometric information

☒ not applicable (not disclosed)

☐ direct lead buyers;

☐ email marketers/email marketing partners;

☐ email service providers;

☐ offline marketing partners;

☐ advertising networks;

☐ payment processors;

☐ data hygiene companies;

☐ ISPs;

☐ data analytics providers;

☐ gov’t entities;

☐ operating systems and platforms;

☐ social networks;

☐ data brokers;

☐ acquirer of assets;

☐ others

Not applicable

Internet or other electronic network activity information (e.g., browsing history, search history, and information regarding a consumer’s interaction with an Internet Web site, application, or advertisement)

☐ not applicable (not disclosed)

☒ direct lead buyers;

☒ email marketers/email marketing partners;

☐ email service providers;

☐ offline marketing partners;

☐ advertising networks;

☐ payment processors;

☒ data hygiene companies;

☐ ISPs;

☐ data analytics providers;

☐ gov’t entities;

☐ operating systems and platforms;

☒ social networks;

☒ data brokers;

☐ acquirer of assets;

☐ others

☒Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards

☒ Helping to ensure security and integrity;

☐ Debugging to identify and repair errors that impair existing intended functionality.

☒ Short-term, transient use, provided that the personal information is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer’s experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction.

☒ Performing services on behalf of the business or service provider, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider.

☒ Undertaking internal research for technological development and demonstration.

☐ Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.

Geolocation data

☐ not applicable (not disclosed)

☒ direct lead buyers;

☒ email marketers/email marketing partners;

☐ email service providers;

☐ offline marketing partners;

☐ advertising networks;

☐ payment processors;

☒ data hygiene companies;

☐ ISPs;

☒ data analytics providers;

☐ gov’t entities;

☐ operating systems and platforms;

☒ social networks;

☐ data brokers;

☐ acquirer of assets;

☐ others

☒Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards

☒ Helping to ensure security and integrity;

☐ Debugging to identify and repair errors that impair existing intended functionality.

☒ Short-term, transient use, provided that the personal information is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer’s experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction.

☒ Performing services on behalf of the business or service provider, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider.

☒ Undertaking internal research for technological development and demonstration.

☐ Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.

Audio, electronic, visual, thermal, olfactory, or similar information

☒ not applicable (not disclosed)

☐ direct lead buyers;

☐ email marketers/email marketing partners;

☐ email service providers;

☐ offline marketing partners;

☐ advertising networks;

☐ payment processors;

☐ data hygiene companies;

☐ ISPs;

☐ data analytics providers;

☐ gov’t entities;

☐ operating systems and platforms;

☐ social networks;

☐ data brokers;

☐ acquirer of assets;

☐ others

Not applicable

Professional or employment-related information

☐ not applicable (not disclosed)

☒ direct lead buyers;

☒ email marketers/email marketing partners;

☐ email service providers;

☐ offline marketing partners;

☐ advertising networks;

☐ payment processors;

☒ data hygiene companies;

☐ ISPs;

☐ data analytics providers;

☐ gov’t entities;

☐ operating systems and platforms;

☒ social networks;

☒ data brokers;

☐ acquirer of assets;

☐ others

☒Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards

☐ Helping to ensure security and integrity;

☐ Debugging to identify and repair errors that impair existing intended functionality.

☐ Short-term, transient use, provided that the personal information is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer’s experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction.

☒ Performing services on behalf of the business or service provider, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider.

☒ Undertaking internal research for technological development and demonstration.

☐ Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.

Education information

☒ not applicable (not disclosed)

☐ direct lead buyers;

☐ email marketers/email marketing partners;

☐ email service providers;

☐ offline marketing partners;

☐ advertising networks;

☐ payment processors;

☐ data hygiene companies;

☐ ISPs;

☐ data analytics providers;

☐ gov’t entities;

☐ operating systems and platforms;

☐ social networks;

☐ data brokers;

☐ acquirer of assets;

☐ others

Not applicable

Inferences drawn from any of the above information to create a profile about a consumer reflecting the consumer’s preferences, characteristics, behavior, etc.

☒ not applicable (not disclosed)

☐ direct lead buyers;

☐ email marketers/email marketing partners;

☐ email service providers;

☐ offline marketing partners;

☐ advertising networks;

☐ payment processors;

☐ data hygiene companies;

☐ ISPs;

☐ data analytics providers;

☐ gov’t entities;

☐ operating systems and platforms;

☐ social networks;

☐ data brokers;

☐ acquirer of assets;

☐ others

Not applicable

Sensitive personal information

☒ not applicable (not disclosed)

☐ direct lead buyers;

☐ email marketers/email marketing partners;

☐ email service providers;

☐ offline marketing partners;

☐ advertising networks;

☐ payment processors;

☐ data hygiene companies;

☐ ISPs;

☐ data analytics providers;

☐ gov’t entities;

☐ operating systems and platforms;

☐ social networks;

☐ data brokers;

☐ acquirer of assets;

☐ others

Not applicable

Categories of Personal Information (PI)

Categories of Third Parties to Whom Such PI is Sold or Shared

Specific Business or Commercial Purpose for Sale or Sharing

Identifiers (e.g., a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers), or information that identifies, relates to, describes, or is capable of being associated with, a particular individual

☐ not applicable (not sold or shared)

☒ direct lead buyers;

☒ email marketers/email marketing partners;

☐ email service providers;

☐ offline marketing partners;

☐ advertising networks;

☐ payment processors;

☐ data hygiene companies;

☐ ISPs;

☐ data analytics providers;

☐ gov’t entities;

☐ operating systems and platforms;

☐ social networks;

☐ data brokers;

☐ acquirer of assets;

☐ others

☐Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards

☐ Helping to ensure security and integrity;

☒ Debugging to identify and repair errors that impair existing intended functionality.

☐ Short-term, transient use, provided that the personal information is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer’s experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction.

☒ Performing services on behalf of the business or service provider, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider.

☒ Undertaking internal research for technological development and demonstration.

☐ Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.

Characteristics of protected classifications.

☒ not applicable (not sold or shared)

☐ direct lead buyers;

☐ email marketers/email marketing partners;

☐ email service providers;

☐ offline marketing partners;

☐ advertising networks;

☐ payment processors;

☐ data hygiene companies;

☐ ISPs;

☐ data analytics providers;

☐ gov’t entities;

☐ operating systems and platforms;

☐ social networks;

☐ data brokers;

☐ acquirer of assets;

☐ others

Not applicable

Commercial information (e.g., records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies)

☒ not applicable (not sold or shared)

☐ direct lead buyers;

☐ email marketers/email marketing partners;

☐ email service providers;

☐ offline marketing partners;

☐ advertising networks;

☐ payment processors;

☐ data hygiene companies;

☐ ISPs;

☐ data analytics providers;

☐ gov’t entities;

☐ operating systems and platforms;

☐ social networks;

☐ data brokers;

☐ acquirer of assets;

☐ others

Not applicable

Biometric information

☒ not applicable (not sold or shared)

☐ direct lead buyers;

☐ email marketers/email marketing partners;

☐ email service providers;

☐ offline marketing partners;

☐ advertising networks;

☐ payment processors;

☐ data hygiene companies;

☐ ISPs;

☐ data analytics providers;

☐ gov’t entities;

☐ operating systems and platforms;

☐ social networks;

☐ data brokers;

☐ acquirer of assets;

☐ others

Not applicable

Internet or other electronic network activity information (e.g., browsing history, search history, and information regarding a consumer’s interaction with an Internet Web site, application, or advertisement)

☐ not applicable (not sold or shared)

☒ direct lead buyers;

☐ email marketers/email marketing partners;

☐ email service providers;

☐ offline marketing partners;

☐ advertising networks;

☐ payment processors;

☐ data hygiene companies;

☐ ISPs;

☐ data analytics providers;

☐ gov’t entities;

☐ operating systems and platforms;

☐ social networks;

☐ data brokers;

☐ acquirer of assets;

☐ others

☐Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards

☐ Helping to ensure security and integrity;

☐ Debugging to identify and repair errors that impair existing intended functionality.

☐ Short-term, transient use, provided that the personal information is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer’s experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction.

☒ Performing services on behalf of the business or service provider, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider.

☒ Undertaking internal research for technological development and demonstration.

☐ Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.

Geolocation data

☐ not applicable (not sold or shared)

☒ direct lead buyers;

☐ email marketers/email marketing partners;

☐ email service providers;

☐ offline marketing partners;

☐ advertising networks;

☐ payment processors;

☐ data hygiene companies;

☐ ISPs;

☐ data analytics providers;

☐ gov’t entities;

☐ operating systems and platforms;

☐ social networks;

☐ data brokers;

☐ acquirer of assets;

☐ others

☐Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards

☒ Helping to ensure security and integrity;

☐ Debugging to identify and repair errors that impair existing intended functionality.

☐ Short-term, transient use, provided that the personal information is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer’s experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction.

☒ Performing services on behalf of the business or service provider, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider.

☐ Undertaking internal research for technological development and demonstration.

☐ Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.

Audio, electronic, visual, thermal, olfactory, or similar information

☒ not applicable (not sold or shared)

☐ direct lead buyers;

☐ email marketers/email marketing partners;

☐ email service providers;

☐ offline marketing partners;

☐ advertising networks;

☐ payment processors;

☐ data hygiene companies;

☐ ISPs;

☐ data analytics providers;

☐ gov’t entities;

☐ operating systems and platforms;

☐ social networks;

☐ data brokers;

☐ acquirer of assets;

☐ others

Not applicable

Professional or employment-related information

☐ not applicable (not sold or shared)

☒ direct lead buyers;

☐ email marketers/email marketing partners;

☐ email service providers;

☐ offline marketing partners;

☐ advertising networks;

☐ payment processors;

☐ data hygiene companies;

☐ ISPs;

☐ data analytics providers;

☐ gov’t entities;

☐ operating systems and platforms;

☐ social networks;

☐ data brokers;

☐ acquirer of assets;

☐ others

☐Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards

☐ Helping to ensure security and integrity;

☐ Debugging to identify and repair errors that impair existing intended functionality.

☐ Short-term, transient use, provided that the personal information is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer’s experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction.

☒ Performing services on behalf of the business or service provider, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider.

☐ Undertaking internal research for technological development and demonstration.

☐ Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.

Education information

☒ not applicable (not sold or shared)

☐ direct lead buyers;

☐ email marketers/email marketing partners;

☐ email service providers;

☐ offline marketing partners;

☐ advertising networks;

☐ payment processors;

☐ data hygiene companies;

☐ ISPs;

☐ data analytics providers;

☐ gov’t entities;

☐ operating systems and platforms;

☐ social networks;

☐ data brokers;

☐ acquirer of assets;

☐ others

Not applicable

Inferences drawn from any of the above information to create a profile about a consumer reflecting the consumer’s preferences, characteristics, behavior, etc.

☒ not applicable (not sold or shared)

☐ direct lead buyers;

☐ email marketers/email marketing partners;

☐ email service providers;

☐ offline marketing partners;

☐ advertising networks;

☐ payment processors;

☐ data hygiene companies;

☐ ISPs;

☐ data analytics providers;

☐ gov’t entities;

☐ operating systems and platforms;

☐ social networks;

☐ data brokers;

☐ acquirer of assets;

☐ others

Not applicable

Sensitive personal information

☒ not applicable (not sold or shared)

☐ direct lead buyers;

☐ email marketers/email marketing partners;

☐ email service providers;

☐ offline marketing partners;

☐ advertising networks;

☐ payment processors;

☐ data hygiene companies;

☐ ISPs;

☐ data analytics providers;

☐ gov’t entities;

☐ operating systems and platforms;

☐ social networks;

☐ data brokers;

☐ acquirer of assets;

☐ others

Not applicable