Depop is a resale/fashion marketplace app operated by Depop Ltd., which Etsy, Inc. acquired in 2021 and owned until mid-2026. Etsy's own SEC filings document the completed change of ownership: on February 15, 2026 Etsy entered a Sale and Purchase Agreement to sell Depop to eBay Inc., and Etsy's Q2 2026 shareholder letter (filed August 5, 2026) states the sale was completed on July 30, 2026, bringing roughly $1.4 billion in cash into Etsy in Q3 2026 — Depop is now owned by eBay Inc. (Nasdaq: EBAY). Depop's own website (depop.com) and help center are fully Cloudflare-gated and returned no fetchable content in this research (live 403s and no Wayback snapshot at the standard privacy-policy path); Etsy's own privacy policy (its pre-sale text, which still lists Depop Ltd. as an Etsy Group Company) substitutes as the best-available primary source, stating it shares Buyer/Seller account, verification, usage and device data with 'Etsy Group Companies' including Depop Ltd. for purposes spanning ID verification, fraud prevention, marketing and legal compliance. The Depop iOS app's own App Store privacy label discloses an unusually broad footprint, including a declared 'Data Used to Track You' category (cross-app/cross-site tracking) covering purchases, location, contact info, search and browsing history. No breach or regulator action specific to Depop was found in this research; Etsy's 10-K discloses group-wide information-security governance (NIST CSF-aligned self-assessments, penetration testing, a CISO).
TRACK RECORD
1 ENFORCEMENT ACTION
[2026-02-15]
Etsy, Inc.'s Form 10-K states that its information security program undergoes periodic self-assessments aligned with the NIST Cybersecurity Framework, includes penetration testing of its systems (including credit-card payments infrastructure), and maintains a vulnerability-reporting process, overseen by a named Chief Information Security Officer role; no breach disclosure or regulator action specific to Depop was found in this research.
The Depop iOS App Store privacy label states that data linked to the user's identity may be collected for Third-Party Advertising and Developer's Advertising or Marketing purposes, including Purchase History, Contact Info (Physical Address, Email Address, Name, Phone Number), Contacts, Browsing History and Identifiers, alongside Usage Data, Device ID and User Content collected for Analytics, Customer Support and App Functionality.
Etsy, Inc.'s Form 10-K for fiscal year 2025 discloses that on February 15, 2026 Etsy entered into a Sale and Purchase Agreement to sell Depop to eBay Inc., with the sale expected to close in the second quarter of 2026 subject to regulatory approval and other closing conditions.
Etsy's Q2 2026 shareholder letter, filed as an exhibit to an SEC Form 8-K on August 5, 2026, states plainly that 'On July 30, 2026 we completed the sale of Depop to eBay' -- the sale that was pending as of the FY2025 10-K has closed, and Depop is now owned by eBay Inc. (Nasdaq: EBAY), a publicly traded, SEC-reporting company; the same letter reports the sale brought approximately $1.4 billion in cash into Etsy in Q3 2026 and that Depop is presented as a discontinued operation in Etsy's results going forward.
Etsy, Inc.'s Global Privacy Policy states it may share Buyer Account Information, Seller Account Information, Seller Verification Information, Service Usage Information, Device and Browser Information, and Cookie Information with 'Etsy Group Companies,' a defined term explicitly listing Depop Ltd. as an Etsy-owned affiliate, for purposes including ID verification, fraud prevention, payment processing, marketing, and legal/regulatory compliance. (pre-sale policy text: an August 15, 2026 Wayback snapshot -- taken after Etsy completed the July 30, 2026 sale of Depop to eBay -- shows Etsy's privacy policy still lists 'Depop Ltd.' as an Etsy-owned affiliate/Etsy Group Company; this reflects Etsy's not-yet-updated policy text, not Depop's current ownership.)
Etsy, Inc.'s Form 10-K states that its information security program undergoes periodic self-assessments aligned with the NIST Cybersecurity Framework, includes penetration testing of its systems (including credit-card payments infrastructure), and maintains a vulnerability-reporting process, overseen by a named Chief Information Security Officer role; no breach disclosure or regulator action specific to Depop was found in this research.
The Depop App Store privacy label declares a 'Data Used to Track You' category — used for cross-app and cross-website tracking by other companies — covering Purchases, Location, Contact Info, User Content, Search History, Browsing History, Identifiers, Usage Data, Diagnostics and Other Data.