Websites often rely on external services for hosting, analytics, advertising, payments, email, customer support, and fraud prevention. Some of these services may receive or access personal information. A clear notice helps people understand those relationships and helps your team keep public statements consistent with the site’s actual data flows.
The phrase “third-party disclosure” can also refer to affiliate or sponsored-content disclosures. Those explain a financial or other connection behind an endorsement, not the handling of personal data. This guide covers both meanings and explains why they should not be confused. For a related overview, see our guides to legal essentials for SaaS and tech startups and policies for ad monetization.
What a Third-Party Disclosure Means
In a privacy context, a third-party disclosure is information in a privacy notice or related page about organizations that receive, process, or otherwise access personal information. It should connect the recipient to the activity: what information is involved, why it is used, what role the recipient plays, and what choices or rights may be available.
Recipient
A company or organization that receives or can access information.
Purpose
The reason information is used or shared, such as hosting, payment, analytics, or advertising.
Relationship
The recipient may act as a processor, service provider, independent controller, or another role under applicable law.
Visual: follow the information flow
Provides or generates information
Collects or uses it
Supports a purpose
An inventory should also record the information category, purpose, role, location, retention rule, and whether a user choice is required or available.
Why Transparent Disclosures Matter
People should not have to guess whether a checkout provider receives billing details, an analytics tool observes page activity, or an advertising partner receives identifiers. Accurate notices make those flows easier to explain, review, and manage. They also help internal teams notice when a newly installed tool conflicts with the published privacy policy or consent settings.
More informed choices
Explain relevant data practices at the point where people can make decisions about a feature or consent.
Fewer policy mismatches
Compare the public notice with scripts, vendor contracts, and product configuration.
Clearer vendor governance
Separate a service provider working on your behalf from a recipient using data for its own purposes.
Better incident response
Know which vendors may hold affected data and who to contact when something goes wrong.
Legal Requirements Depend on Context
There is no single worldwide law requiring every site to publish a standalone document called a “third-party disclosure.” Privacy laws may instead require information in a privacy notice or at collection, with requirements that depend on the location of the organization and users, the type of data, and the purpose of processing.
European Union: recipient information in privacy notices
The GDPR text on EUR-Lex requires information about recipients or categories of recipients in the relevant transparency notices. It also addresses purposes, legal bases, retention, rights, and international transfers. A disclosure does not replace these other notice requirements or make otherwise unlawful processing valid.
Other privacy frameworks may require information about categories of personal information collected, purposes, recipients, sales or sharing, and available choices. Requirements and defined terms differ. Check the current law and regulator guidance for each market where your service operates rather than copying a global compliance claim from a template.
How Disclosure Duties Differ
The table is a high-level orientation, not a jurisdiction-by-jurisdiction legal checklist. The applicable obligations depend on law, activity, thresholds, exceptions, and the role of each organization.
| Framework example | Disclosure focus | Practical review question |
|---|---|---|
| EU GDPR | Recipients or categories of recipients and other required transparency information. | Does the notice describe the actual recipients and processing purposes? |
| US state privacy laws | Depending on the law, categories of information, purposes, recipient categories, and sale or sharing choices. | Does the notice and preference mechanism match the activities defined by local law? |
| Children’s privacy rules | Additional notice and consent duties may apply to covered child-directed services or data collection. | Is the service directed to children or knowingly collecting their information? |
| Advertising and endorsements | Material commercial connections may need a clear disclosure close to the endorsement. | Can a reader see and understand the relationship when evaluating the recommendation? |
Do not treat “third-party sharing” as one legal category across every framework. Some laws distinguish processors from independent businesses, service-provider relationships from sale or sharing, and essential processing from optional advertising.
What to Include in a Privacy Recipient Disclosure
A useful notice connects each recipient with its data use and the choices that apply. The right level of detail varies by law and design; where practical, give examples or vendor names while keeping categories accurate and maintainable.
Recipient name or category
Name the company or describe a meaningful category such as payment processors or analytics providers.
Information involved
Describe data categories such as account details, transaction data, device identifiers, or usage events.
Purpose
Explain why the information is used, such as to complete payment, provide support, measure site use, or deliver ads.
Role and relationship
Clarify whether a provider acts on your instructions or handles information for its own purpose, where relevant.
Choices and rights
Explain the available controls and how to exercise applicable access, deletion, objection, or opt-out rights.
Transfers and retention
Describe relevant transfer information and retention periods or criteria when required.
Example of a useful disclosure
“We use a payment provider to process orders. It receives the transaction amount, billing details, and payment status needed to complete the purchase and help prevent fraud. The provider handles payment information under its own privacy terms. We use order records for customer service and accounting.”
Example wording only. Replace it with the real data flow, roles, purposes, and legal terms for your provider.
Common Third-Party Categories
A website may load a vendor directly, through a tag manager, or through an embedded feature. Review the entire chain rather than relying only on a procurement list.
| Category | Possible information | Questions to check |
|---|---|---|
| Hosting and content delivery | IP address, server logs, stored site data | Which regions host data? How long are logs kept? |
| Analytics and experimentation | Device identifiers, events, pages viewed | Which tags run, and what choices control them? |
| Advertising and measurement | Campaign events, identifiers, conversion data | Is data used for cross-context advertising or audience building? |
| Payments and fraud prevention | Billing details, transaction status, risk signals | Which party handles card data and fraud decisions? |
| Email and customer support | Contact details, support messages, order history | Who can access tickets and how are records deleted? |
| Social embeds and login | Account identifiers, page interaction, profile data | Does loading the feature send data before interaction? |
Include hidden or indirect integrations in the audit: pixels inside ad tags, anti-spam services on forms, video players, maps, chat widgets, and SDKs can all communicate with external providers.
Affiliate, Sponsorship, and Other Commercial Disclosures
A commercial disclosure answers a different question: does the publisher have a relationship that may affect how readers evaluate a recommendation? Examples include affiliate commissions, paid sponsorships, free products, employment, or another benefit. This is not the same as explaining which companies receive personal data.
Place it where it helps readers evaluate the content
The FTC’s Endorsement Guides FAQ explains that affiliate relationships should be disclosed clearly and conspicuously, close enough to recommendations and links for readers to understand the connection. The right wording and placement depend on the content and audience.
Privacy recipient notice
“We use an analytics provider to measure site performance.”
Affiliate relationship notice
“We may earn a commission if you buy through links in this article.”
For related guidance, see our ad monetization policy guide.
Common Mistakes to Avoid
Claiming “we never share data” while using vendors
Service providers may receive information to perform hosting, payment, support, or analytics functions. Describe the actual relationship.
Using a broad label with no useful detail
A phrase like “trusted partners” does not tell readers what categories of organizations receive data or why.
Assuming disclosure itself creates permission
A privacy notice cannot replace a legal basis, required consent, transfer safeguard, or processor contract.
Forgetting tools loaded by other tools
Review tag managers, widgets, SDKs, pixels, and embedded media as well as direct vendor contracts.
Mixing privacy and affiliate notices
Data recipient information and commercial connections answer different questions; make both clear where relevant.
Leaving the notice stale
New vendors, new purposes, and changed settings should trigger a review of the policy and any choice interface.
Making universal claims about every law
Scope, definitions, thresholds, and rights differ. Avoid saying one disclosure format satisfies all jurisdictions.
Burying choices in a long policy
Link people directly to the relevant preference, request, or contact method when a choice or right is available.
How to Create and Maintain a Disclosure
- Inventory the data flows. Review forms, cookies, scripts, SDKs, payment flows, embedded content, and vendor contracts.
- Record the purpose and data. For each integration, note what information is involved, why it is used, and who can access it.
- Determine roles and choices. Check whether the organization acts as processor, service provider, independent recipient, or another role for each activity.
- Check the applicable law. Identify notice, consent, opt-out, recipient, transfer, and retention requirements for the people and markets involved.
- Write for ordinary readers. Use specific categories, plain language, and contextual notices near forms or controls where useful.
- Test the actual experience. Confirm that a reader can find the notice and that consent or preference tools behave as described.
- Set change triggers. Revisit the notice when vendors, purposes, data types, regions, or settings change.
Free Third-Party Disclosure Generator
Create a structured starting draft, then replace generic language with your actual integrations, purposes, and user choices.
Open the disclosure generatorFrequently Asked Questions
Is a third-party disclosure always a separate document?
No. It may be part of a privacy notice, a cookie notice, a commercial relationship disclosure, or another page, depending on what is being disclosed and the applicable rules. The information should appear where people can find it and before a relevant choice or transaction when required.
Does every website have to publish a list of every vendor?
Requirements depend on the laws that apply and the site’s practices. Some privacy laws call for recipients or categories of recipients; other regimes may specify categories of information and types of third parties. Maintain a current internal vendor inventory even if the public notice uses categories.
Is a service provider the same as a third-party recipient?
A service provider or processor handles information for an organization under defined terms. Other recipients may use data for their own purposes. The roles and legal labels depend on the facts and the applicable law, so do not treat every vendor as the same kind of recipient.
Is a third-party disclosure the same as an affiliate disclosure?
No. A privacy recipient notice explains who receives or handles personal data and why. An affiliate or sponsorship disclosure explains a commercial connection that could affect how readers evaluate a recommendation. A site may need both.
What should I do when I add a new analytics or advertising tool?
Review what information it collects, what it does with the information, whether it sets cookies or similar technologies, what choices apply, and whether your notices and consent settings need updating. Add the vendor and data flow to your internal inventory.
Can a disclosure make any data sharing lawful?
No. A notice supports transparency but does not by itself establish a legal basis, create valid consent, satisfy a contract requirement, or authorize a transfer. Confirm that the processing and the user choices comply with the laws that apply.
Conclusion
A third-party disclosure should explain real data relationships in language people can use. Map your vendors, identify the information and purpose for each flow, determine the roles and choices that apply, and keep the notice aligned with the site as it changes. If you publish affiliate or sponsored content, explain those commercial connections separately and where readers can see them.
Before publishing
Compare the notice with your vendor inventory, privacy settings, and actual data flows.
After publishing
Assign an owner and review the disclosure when a vendor, purpose, or user choice changes.
Need a companion privacy notice?
Use our Privacy Policy Generator to prepare a draft that you can align with your real data practices.