Poshmark is a peer-to-peer resale/social-commerce marketplace app whose privacy policy discloses collecting broad account, transaction, and behavioral data, augmenting user profiles with information bought from 'commercial data brokers or aggregators,' and using cookies, SDKs, and tracking URLs for interest-based advertising via partners including Google Analytics, Connexity, and Taboola. Its own CCPA notice discloses disclosing personal information to advertising and affiliate networks 'in exchange for monetary or non-monetary consideration' -- a self-declared 'Sale' of personal information -- and Apple's App Store privacy label confirms Purchases, Contact Info, Identifiers, and Usage Data are used to track users across apps and websites owned by other companies. Poshmark, Inc. was a Nasdaq-listed Delaware corporation until it was acquired by NAVER Corporation, a South Korean public company, in a 2022-2023 all-cash merger, after which it became an indirect subsidiary of NAVER; ownership is traceable through Poshmark's own SEC filings up to the merger. Poshmark's own August 2019 blog notice confirms an unauthorized third party acquired data from some Poshmark users, including emails, usernames, and salted hashed passwords -- an incident Have I Been Pwned catalogs (breach date May 16, 2018) as affecting approximately 36,395,491 accounts -- with no evidence found of an FTC or state-AG enforcement action tied to the incident.
TRACK RECORD
1 BREACH
[2018-05-16] · BREACH
Have I Been Pwned lists a breach record for Poshmark: "Poshmark".
Approximately 36,395,491 accounts affected, per HIBP.
Apple's App Store privacy label for the Poshmark app discloses that data linked to a user's identity -- including Purchase History, Contact Info, User Content (Photos/Videos), Search History, and Identifiers -- may be collected and used for advertising/marketing, analytics, product personalization, and app functionality purposes.
Poshmark's privacy policy discloses that it may obtain demographic and other information about users from third-party commercial data brokers or aggregators, supplementing data collected directly from users.
Poshmark, Inc.'s SEC Form 10-K discloses that the company was incorporated in Delaware, originally under the name GoshPosh, Inc., before being renamed Poshmark, Inc., and traded on Nasdaq prior to being acquired.
Poshmark, Inc.'s SEC Form 8-K discloses that under its Agreement and Plan of Merger with NAVER Corporation (a South Korean public company), a NAVER merger subsidiary was merged into Poshmark, with Poshmark surviving as an indirect subsidiary of NAVER, making the current ultimate corporate parent traceable to this mandatory SEC filing.
Poshmark's California Privacy Notice discloses that it may disclose personal information to online advertising and affiliate networks and marketing partners in exchange for monetary or non-monetary consideration, which it explicitly labels as a 'Sale' of personal information under California law, alongside separately labeled 'Sharing' for cross-context behavioral advertising.
Have I Been Pwned's breach catalog lists the "Poshmark" incident (poshmark.com), breach date 2018-05-16, affecting approximately 36,395,491 accounts. Data classes exposed per HIBP: Email addresses, Genders, Geographic locations, Names, Passwords, Usernames. Source: Have I Been Pwned (haveibeenpwned.com), CC BY 4.0.
Poshmark's own August 1, 2019 blog security notice confirms that an unauthorized third party acquired data belonging to some Poshmark users, including usernames, names, gender, city, email addresses, size preferences, one-way salted encrypted passwords, and linked social media profile information; Poshmark later required all users who had not reset their password to do so.
Apple's App Store privacy label for the Poshmark app discloses that Purchases, Contact Info, Identifiers, and Usage Data may be used to track users across apps and websites owned by other companies.
Poshmark's privacy policy discloses that Poshmark, its service providers, and third-party partners collect device data, IP address, and online activity data through automated tracking technologies including cookies, web beacons, SDKs, and tracking URLs, naming Google Analytics, Connexity, and Taboola as companies using these technologies for ad optimization and content recommendations, and states the service does not respond to Do Not Track signals.