Salesforce

PRODUCTIVITY & CLOUD

LAST UPDATED 31 AUG 2026

30

OF 100

PARANOIA SCORE

F

WHAT THE POLICIES SAY

Salesforce's public privacy statement discloses broad categories of personal data collection (including device, telephony and location data tied to mobile features) and states that it does not "sell" personal data under the CCPA but does share identifiers and internet-activity information with third-party advertisers for ad targeting. The company's corporate structure is disclosed through routine SEC filings as a publicly traded holding company that has absorbed Slack, Tableau and MuleSoft as consolidated business lines, though it has since stopped breaking out their individual financial results. Salesforce's track record includes a 2020 Dutch GDPR legal proceeding tied to its former Krux/Audience Studio data-management product, a 2023 guest-access misconfiguration that exposed customer records on public Salesforce Community sites, and a 2025 supply-chain attack via the Salesloft Drift integration that resulted in unauthorized access to data in numerous customers' Salesforce environments.

TRACK RECORD

1 ENFORCEMENT ACTION

[2020-09-01]

In a 2020 SEC filing, Salesforce disclosed that it had been made a party to a legal proceeding brought by a Dutch privacy advocacy group alleging that the company violated the GDPR and Dutch Telecommunications Act through the processing and sharing of data in connection with its Audience Studio and Data Studio products.

sec.gov ↗

TIMELINE

1 ENTRY

[2026-08-31] · NEW RECEIPTS

11 new sources on file for Salesforce.

Salesforce's file gained 11 new sourced claims since its last review.

salesforce.com ↗

ULTIMATE PARENT

Salesforce

THIS FILE HEADS ITS OWN CHAIN.

SUBSIDIARIES ON FILE (1)

TOOLS WE RECOMMEND

PLUS

RECEIPTS

11 ON FILE

COLLECTION

Salesforce's privacy statement discloses that when certain mobile features are used, the company may collect telephony log information, device event information, and location information (via IP address, GPS, and nearby device/Wi-Fi/cell tower sensors).

salesforce.com ↗

[2021-12-17] · COLLECTION

As assessed by PrivacySpy on 2021-12-17 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service collect personal data from third parties? — Yes.

privacyspy.org ↗

[2024-12-01] · COLLECTION

Salesforce's candidate privacy statement discloses that it collects certain sensitive data categories, including political opinions or religious or philosophical beliefs, to the extent legally permitted.

salesforce.com ↗

[2021-09-01] · OWNERSHIP TRANSPARENCY

Salesforce, Inc. is a publicly traded company that identifies itself in SEC filings as a global CRM technology company operating a consolidated 'Customer 360' platform.

sec.gov ↗

[2021-12-17] · OWNERSHIP TRANSPARENCY

As assessed by PrivacySpy on 2021-12-17 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Somewhat.

privacyspy.org ↗

[2021-12-17] · SHARING

As assessed by PrivacySpy on 2021-12-17 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — Yes.

privacyspy.org ↗

[2022-12-28] · SHARING

Salesforce's privacy statement states that, as a business covered by the CCPA, it does not sell Personal Data.

salesforce.com ↗

[2020-09-01] · TRACK RECORD

In a 2020 SEC filing, Salesforce disclosed that it had been made a party to a legal proceeding brought by a Dutch privacy advocacy group alleging that the company violated the GDPR and Dutch Telecommunications Act through the processing and sharing of data in connection with its Audience Studio and Data Studio products.

sec.gov ↗

[2023-04-27] · TRACK RECORD

In April 2023, KrebsOnSecurity reported that a guest-access misconfiguration in Salesforce Community sites allowed unauthenticated users to access records that should have required login, exposing sensitive data at organizations including banks, healthcare providers, and government agencies.

krebsonsecurity.com ↗

[2025-08-26] · TRACK RECORD

In August 2025, Google's Threat Intelligence Group and Mandiant reported a widespread data-theft campaign in which a threat actor used compromised OAuth tokens tied to the Salesloft Drift integration to access and exfiltrate data from customers' Salesforce instances.

cloud.google.com ↗

TRACKING TECH

Salesforce's help documentation states that its websites use three categories of cookies — required, functional, and advertising — with functional and advertising cookies subject to user choice.

help.salesforce.com ↗

DATA SOURCES

PrivacySpy

CC BY · PRIVACYSPY.ORG ↗

Claims are summarized from these sources and may be edited from the original.

LAST REVIEWED 2026-08-31 · METHODOLOGY v1.7