eBay is a global online marketplace operated by eBay Inc. (NASDAQ: EBAY), an SEC-filing Delaware public company. Its User Privacy Notice (effective April 21, 2025) covers account, transaction, device and connection data, general location via IP address and, with permission, precise mobile location, plus data from external providers; payments arm eBay Commerce Inc. also collects Social Security numbers and credit data. eBay runs an advertising business with on-site Promoted Listings and offsite placements, and its notice permits disclosures to advertising partners including Google, Meta, Microsoft, Pinterest, and TikTok; California disclosures acknowledge state-law "sale" and "sharing," with opt-outs including Global Privacy Control. Track record includes a 2014 breach of about 145 million user records and a 2024 deferred prosecution agreement with a $3 million criminal penalty.
TRACK RECORD
1 ENFORCEMENT ACTION
[2024-01-11]
On January 11, 2024, the U.S. Attorney's Office for the District of Massachusetts announced that eBay Inc. agreed to pay a $3 million criminal penalty — the statutory maximum for the six felony charges — under a deferred prosecution agreement over a 2019 harassment and intimidation campaign by then-employees targeting a Massachusetts couple who published an e-commerce newsletter, with a three-year independent corporate compliance monitor required.
As assessed by PrivacySpy on 2021-05-26 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service collect personal data from third parties? — Yes.
eBay Commerce Inc.'s U.S. Consumer Privacy Notice (revised January 4, 2024), the GLBA notice covering eBay's payment services, states that the personal information it collects and shares can include name, address, Social Security number, account balances, payment history, and credit history and credit scores.
eBay's User Privacy Notice (effective April 21, 2025), Section 4, states that eBay collects location data including general location via IP address and, with the user's permission, the precise location of the mobile device, along with computer and connection information and camera metadata from uploaded item images.
As assessed by PrivacySpy on 2021-05-26 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Somewhat.
eBay's User Privacy Notice (effective April 21, 2025), Section 2, names the specific eBay affiliate acting as data controller for each region — eBay Inc. for the USA, eBay Canada Limited for Canada, eBay GmbH for the EU — with full legal addresses, and Section 3 provides data protection officer contact channels.
eBay Inc. is a Delaware-incorporated public company (Nasdaq: EBAY, Commission file number 001-37713) headquartered at 2025 Hamilton Avenue, San Jose, California, and files audited annual reports with the SEC; its Form 10-K for fiscal year 2025 was filed on February 19, 2026.
As assessed by PrivacySpy on 2021-05-26 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — Yes, but you may opt-out.
eBay's User Privacy Notice (effective April 21, 2025), Section 5, lists among the categories of recipients of users' personal data 'third-party advertising partners such as Google, Meta, Microsoft, Pinterest, and TikTok,' alongside eBay Affiliates, external service providers, and law enforcement or government authorities.
eBay's U.S. State Privacy Disclosures (effective July 1, 2025) acknowledge that under California privacy law's broad definitions, eBay's practices include the 'Sale' and 'Sharing' of personal information — including transfers to third parties for cross-context behavioral advertising — and provide corresponding opt-out rights.
eBay publishes a responsible disclosure program through its Security Center, inviting professional security researchers to report security and AI vulnerabilities on eligible ebay.com domains, with a report form and a public acknowledgements page for validated reports.
In May 2014, eBay disclosed that attackers who compromised employee login credentials accessed a database containing approximately 145 million user records — including names, encrypted passwords, email addresses, physical addresses, phone numbers, and dates of birth — in an attack carried out between late February and early March 2014, as reported contemporaneously by CNBC/Reuters.
On January 11, 2024, the U.S. Attorney's Office for the District of Massachusetts announced that eBay Inc. agreed to pay a $3 million criminal penalty — the statutory maximum for the six felony charges — under a deferred prosecution agreement over a 2019 harassment and intimidation campaign by then-employees targeting a Massachusetts couple who published an e-commerce newsletter, with a three-year independent corporate compliance monitor required.
eBay's 'Your Privacy Choices' page provides an opt-out from cross-context personalized advertising and states that eBay will honor approved browser-based universal opt-out mechanisms such as the Global Privacy Control, associating the signal with the user's eBay account when logged in.
eBay operates an advertising business ('eBay Advertising') that includes on-site Promoted Listings and Promoted Stores as well as 'Promote offsite' campaigns that place sellers' listings on external channels such as Google, per eBay's Seller Center eBay Advertising overview.
eBay's User Privacy Notice (effective April 21, 2025), Section 4.3, states that eBay uses cookies and similar technologies to collect usage- and device-related data, including device IDs, advertisement IDs, cookie IDs, and data about the user's interactions with advertisements shown by eBay's advertising partners.