Data Sharing Without Consent Lawyer

Providing personal information to one company does not necessarily mean a consumer expects that information to end up with several others.

Yet personal data routinely moves between businesses. Companies may provide information to advertising platforms, analytics providers, technology vendors, data brokers, affiliated businesses, and other third parties. Sometimes those transfers are necessary to provide a service. In other situations, information may be used for advertising, profiling, monetization, or purposes the consumer did not anticipate.

Sharing personal information is not automatically unlawful, and consent is not required for every transfer of data. Privacy concerns can arise, however, when a company discloses information contrary to its representations, shares sensitive information without authorization required by law, ignores an applicable opt-out right, or otherwise transfers personal data in a manner restricted by federal or state law.

Net Law Advocates represents individuals nationwide in matters involving unauthorized disclosure of personal information, digital privacy violations, and other areas of cyber law.

What Does It Mean for a Company to Share Personal Data?

Data sharing occurs when personal information held by one organization is transmitted, disclosed, provided, or otherwise made available to another party.

That can happen through an obvious transfer, such as providing a customer list to another business. It can also happen automatically through technology.

A website containing third-party tracking code, for example, may transmit information to an advertising or analytics company as the user interacts with the site. A mobile application may incorporate software from outside providers that receives information generated through the app.

The consumer may never directly interact with the company receiving the data.

Potential recipients can include:

• Advertising platforms
• Analytics providers
• Social media companies
• Data brokers
• Technology vendors
• Payment processors
• Cloud-service providers
• Marketing companies
• Business affiliates
• Software developers
• Other service providers

The legal significance of a transfer depends on what information was shared, who received it, why it was disclosed, what the consumer was told, and which laws apply.

Data Sharing and Data Collection Are Different Privacy Issues

The distinction between collecting information and sharing it is important.

A company may have a legitimate reason to collect a person’s information but later use or disclose that information in a way the individual did not expect.

For example, someone might intentionally provide information to an application because it is necessary to receive a service. The privacy issue may arise later if that information is sent to an advertising company for an unrelated purpose.

Conversely, information could be improperly collected even if it never leaves the company that obtained it.

Net Law Advocates addresses the first stage of this process separately through its discussion of unauthorized data collection. This page focuses on what happens after information has already been obtained and is disclosed or transferred to another party.

What Types of Personal Information Can Be Shared?

The information companies exchange can range from ordinary contact details to highly sensitive personal data.

Depending on the service and technology involved, shared information may include:

• Names and contact information
• Email addresses
• Phone numbers
• IP addresses
• Device and advertising identifiers
• Browsing and search activity
• Purchase history
• Precise or approximate location
• Financial information
• Health-related information
• Account information
• Employment information
• Biometric information
• Information entered into online forms
• Inferences about interests or behavior

Several pieces of information can also become more revealing when combined.

An advertising identifier by itself may appear less sensitive than a person’s name. But if that identifier can be connected to location history, browsing activity, purchases, or account information, it may allow companies to build a detailed profile of the individual.

Does a Company Always Need Consent Before Sharing Your Data?

No. Consent requirements depend on the type of information, purpose of the disclosure, parties involved, jurisdiction, and applicable law.

Businesses routinely need to provide information to other companies to perform ordinary services. A retailer, for example, may need to provide an address to a shipping company or transaction information to a payment processor.

Different issues arise when information is transferred for advertising, profiling, sale, or another secondary purpose.

Certain categories of sensitive information can also receive stronger protection.

The FTC has stated in guidance concerning consumer health information that disclosing health information for advertising without affirmative express consent may constitute an unfair practice under the FTC Act in some circumstances.

State privacy statutes can impose additional requirements and may give consumers rights concerning particular forms of data sale, sharing, targeted advertising, or processing. Those protections vary significantly by state.

The question is therefore not simply whether a consumer clicked an “accept” button. A meaningful analysis may require determining what was disclosed, what the consumer was told, what authorization was obtained, and whether that authorization satisfied the law governing the particular transfer.

Privacy Policies Can Matter When Data Is Shared

Companies frequently explain their data practices through privacy policies, notices, account disclosures, and consent screens.

Those representations can become important when actual practices differ from what consumers were told.

A company might tell users that information will be used only to provide a service, for example, while allegedly sending the same information to outside companies for advertising.

FTC privacy enforcement has repeatedly addressed discrepancies between representations made to consumers and companies’ actual handling of personal information. The agency has emphasized that businesses must accurately disclose their collection, use, transfer, and sale of consumer data.

A privacy policy does not necessarily authorize every data transfer simply because it contains broad language about third parties. The specific language, applicable law, type of information, and circumstances surrounding the disclosure can all matter.

Sensitive Health Information Presents Particular Concerns

Health information provides a clear example of why the nature of shared data matters.

A person may provide information to a health-related website or application because the information is necessary to receive a service. That does not necessarily mean the individual expects details about medical conditions, prescriptions, or treatment to be sent to advertising companies.

The FTC’s cases involving GoodRx and BetterHelp illustrate this issue.

In the GoodRx matter, the FTC alleged that the company disclosed sensitive personal health information, including information concerning medications and health conditions, to Facebook, Google, and other companies despite privacy representations to users. The resulting order prohibited certain sharing of health information for advertising and required affirmative express consent for certain other disclosures.

In the BetterHelp matter, the FTC alleged that the online counseling company shared information including email addresses, IP addresses, and answers to health-related questions with advertising platforms after promising consumers that personal health data would be used or disclosed only for limited purposes. The FTC finalized an order prohibiting sharing of sensitive health data for advertising and requiring BetterHelp to pay $7.8 million for partial consumer refunds.

These enforcement actions do not mean every disclosure of health-related information gives an individual a private lawsuit. They demonstrate why the type of information, representations made to consumers, purpose of the disclosure, and applicable law can be significant.

Tracking Technologies Can Share Data Automatically

A company does not have to manually send a spreadsheet or customer database for information to reach another business.

Modern websites and applications can transmit information automatically.

Tracking pixels, software development kits, analytics scripts, advertising tools, and other technologies may communicate with outside companies when someone visits a webpage or uses an application.

The FTC has explained that tracking pixels can transmit user information to third parties and has specifically examined their role in the GoodRx and BetterHelp health-privacy matters.

This creates an important connection between data sharing and website tracking technologies. The tracking technology is the mechanism. The resulting transmission of personal information to another company is the disclosure.

Understanding that distinction can help identify which conduct is actually at issue.

Advertising and Data Sharing Often Intersect

Digital advertising relies heavily on information about consumers.

Businesses may use personal information to create advertising audiences, measure whether advertisements resulted in purchases, retarget previous website visitors, or identify people with particular characteristics or interests.

Information can also move among multiple participants in the advertising ecosystem.

This does not make every advertising-related transfer unlawful. Privacy concerns can become more significant when sensitive information is involved, consumers were given misleading information, an applicable law requires consent, or individuals exercised an opt-out right that was not honored.

Broader issues involving the observation and profiling of consumer behavior are addressed through Net Law Advocates’ online tracking and privacy content.

Location Data Can Reveal Sensitive Information

Location information can provide insights into a person’s life that are not obvious from a simple set of coordinates.

Repeated location records can potentially reveal where someone lives and works, along with visits to healthcare facilities, places of worship, shelters, political gatherings, and other sensitive locations.

The FTC’s case against data broker Kochava alleged that location data sold by the company could be used to trace individuals’ movements to sensitive locations. In June 2026, the FTC announced an order prohibiting Kochava and its subsidiary from selling, sharing, or disclosing sensitive location data without consumer consent.

The case demonstrates why the sensitivity of information and the ability to connect it to an individual can affect the privacy implications of data sharing.

Selling Data and Sharing Data Are Not Always the Same Thing

Privacy laws sometimes distinguish among selling, sharing, disclosing, and processing personal information.

Those terms can have specific statutory definitions.

A “sale” does not necessarily require the type of transaction consumers might ordinarily imagine, and a transfer can sometimes fall within a regulated category even if no money directly changes hands.

At the same time, some disclosures to service providers or processors may be treated differently when contractual and statutory requirements are satisfied.

This is one reason consumers should be cautious about assuming that a company’s statement that it “does not sell personal information” means no information leaves the company.

A business may disclose information to other entities even when it does not characterize those transfers as sales.

The rights consumers have over those practices are addressed more broadly in Net Law Advocates’ discussion of consumer data privacy rights.

Biometric Information Can Be Subject to Specific Sharing Restrictions

Biometric information can present a different set of legal concerns because some jurisdictions specifically regulate how biometric identifiers and biometric information are disclosed.

Fingerprints, facial geometry, voiceprints, and similar identifiers cannot be changed as easily as a password if they are compromised.

Illinois’ Biometric Information Privacy Act is a prominent example of a statute that regulates the collection, storage, use, and disclosure of biometric information under covered circumstances.

Other states have adopted their own biometric protections, and the legal requirements are not uniform nationwide.

Because these issues involve a specialized body of law, Net Law Advocates addresses biometric collection and disclosure through its biometric privacy practice.

Third-Party Vendors Can Complicate Responsibility

Companies increasingly rely on outside vendors to provide technology and business services.

That can make it difficult for consumers to determine who actually received their information.

A website operator might install technology provided by another company. That provider may process information on the website operator’s behalf, retain certain data, or interact with additional systems.

The existence of a vendor does not automatically make a disclosure unlawful, nor does outsourcing a service necessarily eliminate the original company’s privacy responsibilities.

The relationships among the companies, contractual limitations, type of information involved, applicable privacy law, and actual use of the data can all become relevant.

This differs from a third-party vendor data breach, where an outside company’s systems are compromised by an unauthorized actor. Data sharing without consent concerns an intentional or automated transfer of information, while a vendor breach involves a security incident.

Can You Sue a Company for Sharing Your Data Without Consent?

Possibly, but unauthorized or unexpected data sharing does not automatically create a private lawsuit.

Some privacy laws are enforced primarily by government regulators. Others provide private rights of action only for particular types of violations. Additional legal theories may apply depending on the information involved and the manner in which it was disclosed.

Relevant questions can include:

• What information was shared?
• Who received it?
• Why was it transferred?
• What did the company tell the consumer?
• Was consent required?
• Was valid consent actually obtained?
• Did the consumer exercise an applicable opt-out right?
• Does the relevant law allow an individual lawsuit?
• Did the disclosure cause legally recognized harm?

The answer can also depend heavily on where the affected individual lives.

This is why identifying an unexpected third-party data transfer is only the beginning of the legal analysis.

Evidence That Can Help Evaluate a Data-Sharing Concern

Consumers often discover possible data sharing without having access to the underlying technical records.

Information available to the individual can still be useful.

Relevant materials may include:

• Privacy policies and notices
• Consent screens
• Cookie banners and privacy controls
• Account settings
• Screenshots
• Emails or other company communications
• Copies of privacy requests and responses
• Information identifying outside vendors
• Notices describing changes to data practices

Technical evidence may later help establish what information was transmitted and which companies received it.

For website or application disclosures, network traffic, source code, tracking configurations, software development kits, and third-party requests can sometimes help reconstruct the path information took.

Data Sharing Is One Stage of a Larger Privacy Lifecycle

Personal information can pass through several stages.

A company may first collect information from an individual. It may then analyze or combine that data with other information, use it to make inferences, and eventually disclose some of it to other organizations.

Different privacy issues can arise at each stage.

Unauthorized data collection concerns whether the information should have been obtained in the first place. Data sharing without consent focuses on subsequent disclosure to another party. Consumer data privacy rights addresses the rights individuals may have to understand or control those practices.

A security incident introduces yet another issue. When an unauthorized actor gains access to information because systems were compromised, the matter may instead involve data breach litigation.

Separating these stages helps identify both what happened to the information and which legal protections may apply.

Speak With Net Law Advocates About Unauthorized Data Sharing

Consumers often have little visibility into where their information travels after they provide it to a company. Determining whether a disclosure creates a viable legal claim can require examining privacy representations, consent mechanisms, tracking technologies, third-party relationships, applicable state or federal law, and the information that was actually transferred.

Net Law Advocates represents plaintiffs nationwide in cyber and privacy matters. If you believe a company shared sensitive or personal information without appropriate authorization, contact Net Law Advocates at 888-913-2318 to schedule a confidential consultation.