Glassdoor Sells User Data to the Employers Its Reviewers Are Warning You About
In March 2024, a Glassdoor user named Monica Cellio wrote to the company’s support desk about her account. When she next looked at her profile, her full name and her city had been added to it. She had entered neither. By her account, Glassdoor took the name from the “From” line of the email she sent.[1] She objected, and objected again, and a support manager gave her the company’s final answer: “I stand behind the decision that your name has to be placed on your profile and it cannot be reverted or nullified/anonymized.”[2] If she wanted the name gone, she could delete the account. When the story broke that month, Glassdoor told reporters that “User reviews on Glassdoor have always and will always be anonymous,” and its chief executive published an essay under the title “Anonymous Posts Will Always Stay Anonymous,” in which he wrote that “Anonymity is the lifeblood of Glassdoor.”[3]
Both statements were true at once. The reviews stayed anonymous on the page. The company holding them now knew, and had chosen to record, who wrote them.
Two years later, on July 1, 2026, Glassdoor LLC merged into Indeed, Inc., and Glassdoor’s privacy policy was revised to state that “Indeed, Inc. is the data controller for our services.”[4] Indeed is a recruiting business. Its parent, Recruit Holdings, describes Indeed and Glassdoor together as “a global two-sided talent marketplace” and reports that the segment earned 9.67 billion dollars in the fiscal year that ended in March 2026, from “the 3.5 million employers that use Indeed each year to hire.”[5] The file that links each anonymous review to a verified name is now held by the company whose paying customers are the employers under review.
This essay is about that arrangement. Privacy law sees one piece of it. A company changed its rules after it had collected the data, and the Federal Trade Commission has treated that practice as unfair for more than twenty years. Competition law sees a different piece. A seller of recruiting services acquired the site where workers rate the buyers, and the acquisition closed without objection. Neither field sees the whole. A review site is worth something to workers only to the extent that it is adverse to the employers it reviews. Glassdoor’s ownership and its data architecture have dissolved that adversity one policy revision at a time, and no doctrine on the books is built to say so.
I. What Was Promised and What Changed
The place to begin is with what Glassdoor held about its users before any of this happened. In 2017 the Ninth Circuit described the site this way: “The reviews on Glassdoor.com are anonymous. But to post reviews, users must first provide Glassdoor with their e-mail addresses, though the addresses do not appear on the site.”[6] That was the file. An email address, a review, and a privacy policy that warned users the address could be produced in response to legal process. Glassdoor fought a grand jury subpoena for the identifying information of eight reviewers, information that on the court’s description of the service consisted of an email address, all the way to the court of appeals, and it lost. The loss is worth remembering, because the court’s reasoning turned on what the company had told its users to expect. “Glassdoor’s Privacy Policy puts its users on notice before their first submission is posted that their identifying information could be revealed to the government in response to a subpoena or court order,” the court wrote, and “[t]he fact that Glassdoor’s users do not have a reasonable expectation of complete privacy further undermines Glassdoor’s contention that enforcing the subpoena would violate its users’ rights to anonymous speech or association.”[7]
The following spring, Recruit Holdings agreed to buy Glassdoor for 1.2 billion dollars in cash. Recruit already owned Indeed. Its chief executive explained the logic in a sentence: “Glassdoor’s database of employer information and the job search capabilities of Indeed complement each other well.”[8] The deal was announced on May 9, 2018 and closed on June 21, a timetable that leaves no room for an extended antitrust review and is consistent with none having occurred.[9]
In September 2021, Glassdoor announced that “through its parent company it has completed the acquisition of Fishbowl,” a professional social network on which users chose to appear “by job title only, by the company they work for, or with their full name.”[10] Fishbowl’s model rested on verified identity. Over the next two years Glassdoor folded Fishbowl’s features into its own site, consolidated the two services’ terms into a single document, and in July 2023 revised its privacy policy.[11] The revised policy contained three sentences that matter here. “We may update your Profile with data we obtain from third parties or extract from your resume.” “Glassdoor affiliates include Indeed and Indeed Flex.” And, of the sharing it did with those affiliates, “Under some laws, this type of data sharing may be considered a ‘sale’.”[12] The same policy told users that “Glassdoor cannot guarantee your anonymity.”[13]
That is the policy under which Cellio’s name was added. Glassdoor’s chief executive explained the practice in his March 2024 essay, and the explanation concerned Community, the discussion product Glassdoor built from Fishbowl, rather than the reviews: “To make Community work, we ask users to share their name, job title and company name with Glassdoor during the sign-up process. We securely confirm our users’ identities behind the scenes, and we do not share any personal details publicly or to employers.”[14] The company’s statement to Fortune was blunter. “[E]ntering your real name is required to verify your profile but other users won’t see your name unless you choose to share it.”[15]
The last two steps came in the year that followed. Beginning November 18, 2025, new Glassdoor users were required to sign in through an Indeed account, and existing users were told that “[s]tarting on April 20th, 2026, you may be required to log in with a connected account to get full access to Glassdoor.”[16] The terms of that connection are worth quoting. “By connecting your accounts, you expressly agree that once you connect your accounts, you may not disconnect them.” Glassdoor and Indeed “[e]ach receive a complete copy of your Profile data.” Indeed’s own policy adds that “[y]our decision to delete your Indeed account will terminate access to linked Glassdoor services, as the accounts cannot be unlinked once merged,” and that the synchronized attributes include “professional history, job preferences, and contact information.”[17] Then, on July 1, 2026, the two legal entities became one.[18]
Set the 2017 file next to the 2026 file. In 2017, a subpoena that Glassdoor resisted through two courts yielded, for each of eight reviewers, what the company then held: an email address. Today the same subpoena, served on Indeed, Inc., yields a verified name, a job title, an employer, and a professional history synchronized from a recruiting profile, and the reviewer has agreed in advance that the link cannot be undone. The Ninth Circuit’s premise has not changed. A user who was warned that the file could be produced has no reasonable expectation that it will not be. What has changed is what the file contains.
II. Changing the Rules After the Game Has Been Played
The Federal Trade Commission’s position on this pattern is old and consistent. In 2004 it brought its first case against a company for changing its privacy policy after the fact. Gateway Learning Corp. had promised on its website that “We do not sell, rent or loan any personally identifiable information regarding our consumers with any third party unless we receive a customer’s explicit consent.”[19] In April 2003 it began renting customer names and addresses to marketers anyway, and in June 2003 it posted a revised policy permitting the practice. “When Respondent posted the revised privacy policy, it did not take any additional steps to alert consumers that it had changed its privacy policy.”[20] The Commission alleged deception, and separately alleged that the retroactive application of the new policy to data collected under the old one was an unfair practice in its own right: “Respondent retroactively applied such changes to personal information it had previously collected from consumers. Respondent’s retroactive application of its revised privacy policy caused or is likely to cause substantial injury to consumers that is not outweighed by countervailing benefits to consumers or competition and is not reasonably avoidable by consumers.”[21] The consent order required opt-in consent before any material change could be applied to data collected before the change was posted.[22] Howard Beales, then the director of the Bureau of Consumer Protection, summarized the rule: “You can change the rules but not after the game has been played.”[23]
The Commission has applied the theory twice more in ways that bear on Glassdoor. In its 2012 order against Facebook, it alleged that the company’s December 2009 changes, which designated as “publicly available” information that users had previously been able to restrict, were unfair because “Facebook retroactively applied these changes to personal information that it had previously collected from users, without their informed consent.”[24] The complaint named among the resulting harms the exposure of “potentially controversial political views or other sensitive information to third parties – such as prospective employers.”[25] In 2023, in 1Health.io, the Commission went a step further. The genetic testing company had revised its privacy policy in 2020 to permit broader sharing of health data collected under narrower terms, and the complaint alleged unfairness even though the company “has not yet implemented the broader information sharing practices stated in its 2020 privacy policies,” because “it could do so at any time without further notice to consumers.”[26] The Commission’s staff report on social media platforms, issued in September 2024, lists “making retroactive changes to data privacy or security practices or policies, without notifying and obtaining consent” among the categories of data practice the agency treats as unfair, and cites 1Health.io for the point.[27]
These are consent orders rather than litigated holdings, and the statutory standard they apply is the one Congress codified in 1994: an act is unfair if it “causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers themselves and not outweighed by countervailing benefits to consumers or to competition.”[28]Run Glassdoor’s history through that test. The data at issue is a corpus of employer reviews submitted by users who were told they were anonymous and who, as the Ninth Circuit described the service in 2017, had supplied the company with nothing more identifying than an email address. The change is the attachment of a verified name, title, and employer to the account that submitted them, followed by the synchronization of that account with a recruiting profile and the transfer of the whole to a new controller. The injury is the one 1Health.io recognized before any disclosure had occurred: the file exists, and it can be used or produced at any time on terms the user does not control. The injury is not reasonably avoidable, because the alternative Glassdoor offered Cellio was deletion, and because a user who has connected an Indeed account has agreed that it “cannot be unlinked.” And the countervailing benefit the company has identified is the integrity of a discussion product, Community, that the reviews never needed.
Glassdoor has an answer, and it should be stated at full strength. The reviews are not publicly linked to the profile. The current policy says so: “Content submitted with semi-/anonymous identifiers such as your company name or job title is not associated with the publicly-visible portion of your Profile.”[29] The company says it declines requests to identify reviewers, that it has “successfully protected the anonymity of its users in over 100 cases,” and that it “will even appear in court to oppose these requests.”[30] Its privacy policy has always warned of subpoenas. On this view nothing was promised that has been withdrawn. The name is confirmed “behind the scenes,” and the scenes are the same ones the Ninth Circuit described in 2017.
The answer has the same shape as the one available to 1Health.io, and it fails for the same reason. The Gateway theory condemns the standing capacity to disclose on terms the user never accepted, and 1Health.io establishes that the theory applies before any disclosure has occurred. That capacity is measured by what the file holds and who holds it. A company that has told a court, in its own defense, that it “gather[s] and publish[es] information from sources it has agreed not to identify” has conceded that the identity of the source is the thing the user bargained to withhold.[31] Adding the identity to the file and then transferring the file to a recruiting company is a material change in the practice applied to information collected under the earlier terms. Whether the company has yet exercised the capacity is the question 1Health.io made irrelevant.
There is a second problem, and it is the one that shows the limits of privacy law rather than Glassdoor’s. Every instrument in the Gateway line is written in terms of disclosure to a third party. The Gateway order barred Gateway from disclosing pre-change data “to any third party” without opt-in consent.[32] California’s statute defines a “sale” as a transfer of personal information “by the business to a third party for monetary or other valuable consideration,” and Glassdoor’s own 2023 policy conceded that its sharing with Indeed “may be considered a ‘sale’.”[33] Under the statute’s definition of a “business,” an affiliate is treated as part of the same business only if it “shares common branding with the business,” meaning “a shared name, servicemark, or trademark that the average consumer would understand that two or more entities are commonly owned.”[34] Glassdoor and Indeed carry different names and different marks, and although Indeed has begun to describe Glassdoor in its boilerplate as “part of Indeed,” a statement of ownership is a different thing from a shared mark. So from 2018 until July 2026, on the face of the statute, a transfer of profile data from Glassdoor to Indeed was a disclosure to a third party, and a user could opt out of it.
Then the entities merged, and the third party became the first party. A transfer from Glassdoor to Indeed is now a transfer within Indeed, Inc. There is nothing to opt out of. The statute anticipates this in a narrow way. Its exception for data transferred “as part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control” attaches one condition: if the acquirer “materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer.”[35] The condition is notice alone. The federal theory requires opt-in consent for a retroactive change, and the state statute requires a notice for a merger, and between them a company can accomplish by reorganization what neither would let it accomplish by policy. The consent frameworks measure movement across a corporate boundary. They cannot see the boundary move.
III. Owning the Referee
Competition law starts from the other end, with what Recruit bought, and the answer is in Recruit’s own disclosures. The HR Technology segment “operates a global two-sided talent marketplace” built on Indeed and Glassdoor. “Employers can post and advertise jobs and build their company’s employment brand” across both. Indeed “offers a range of products for employers to source, screen, interact with, and interview candidates,” priced through “pay-for-performance and subscription pricing models.”[36] Average revenue per job posting on Indeed in the United States rose seventeen percent in the last fiscal year “despite stagnant hiring demand.”[37] The job seeker pays nothing. The employer pays for everything, and the employer is the party the reviews describe.
Glassdoor’s employer products make the relationship concrete. An employer may open a free account, respond to reviews, and flag a review for moderation.[38] A paying employer may do more. The Enhanced Profile lets it feature content, and the company’s own guide describes the feature this way: “Featuring a review and interview review gives you the control to showcase what it’s like to work or interview at your company.”[39] Indeed markets the two sites as one system. “When you sponsor a job on Indeed, it will automatically be posted on Glassdoor.” The Employer Branding Hub “brings your Indeed Premium Company Page and Glassdoor Enhanced Profile into a single interface.” A product called Review Intelligence “extracts sentiment analysis and trends from your Glassdoor and Indeed reviews.”[40] The employer that a worker reviewed is offered, for a fee, a dashboard of the reviews, an analysis of their sentiment, the ability to choose which one appears first, and a job advertisement placed beside them.
Glassdoor insists that none of this touches moderation, and the insistence is specific. “Let’s be clear: employers cannot pay to have reviews removed.” “In fact, clients who purchase our recruiting solutions must explicitly agree to this in their contracts.” “We apply the same standard of review for all content (whether or not the content involves an employer client of Glassdoor).”[41] Take those statements as true. They answer an accusation that no serious critic needs to make, because the conflict of interest in a review platform owned by the reviewed side’s vendor is built into the structure of the business and requires no bribe. The platform’s revenue rises with the employer’s willingness to buy, the review corpus is an input into products sold to the reviewed, and every design choice about what the reviewer must supply, what the platform retains, and who may see it is made by a company whose customers sit on one side of the table.
The economics of employer reviews explain why that structure matters more here than it would for a restaurant guide. Jason Sockin and Aaron Sojourner studied the supply of information on Glassdoor and found a “catch-22”: “the content most valuable to job seekers (negative information) is the kind most risky to supply.” Higher ratings increase applications to smaller firms, “creating an incentive for them to discourage negative reviews.” And “[c]oncerns about employer retaliation discourage negative reviews and motivate employees who do disclose to conceal aspects of their identity, degrading the information’s value.”[42] The value of the platform to workers, on this evidence, depends on the credibility of its adversity to employers, and that credibility depends on the reviewer’s belief that the platform will not become the instrument of retaliation. A verified name file, held by the employer’s vendor, is that belief’s negation.
The antitrust agencies have a vocabulary for part of this. The 2023 Merger Guidelines define a “conflict of interest” as “the divergence that can arise between the operator’s incentives to operate the platform as a forum for competition and its incentive to operate as a competitor on the platform itself,” and warn that “[a] platform operator that is also a platform participant may have a conflict of interest whereby it has an incentive to give its own products and services an advantage over other participants competing on the platform.”[43] The Guidelines are aimed at the operator who competes on its own platform. Glassdoor presents the adjacent case, an operator of a forum for worker information that sells to the parties the forum evaluates. Guideline 5 supplies the rest of the frame: a merger may lessen competition when the merged firm “may gain or increase access to rivals’ competitively sensitive information,” and among the products that raise the concern are those “that provide or increase the merged firm’s access to competitively sensitive information.”[44]Substitute the worker for the rival and the reviewer’s identity for the sensitive information, and the description fits. Nothing in the Guidelines makes the substitution, because merger analysis has never treated the non-paying side of a review platform as the customers whose product quality a merger might degrade.
Congress has made the substitution in one setting. The findings that open the credit rating agency provisions of Dodd-Frank describe rating agencies as playing “a critical ‘gatekeeper’ role in the debt market,” and state that in “advising arrangers of structured financial products,” they “face conflicts of interest that need to be carefully monitored.”[45] The gatekeeper was paid by the party it rated, and Congress concluded that the arrangement required structural supervision, having found the gatekeepers’ own assurances of integrity insufficient. Glassdoor is a gatekeeper in the same sense for the labor market, and its owner is paid by the rated.
The empirical literature on whether such conflicts actually bias the gatekeeper is mixed, and the mixture is instructive. Reuter and Zitzewitz found that mutual fund recommendations in personal finance publications “are correlated with past advertising.”[46] DellaVigna and Hermle, studying movie reviews in conglomerate-owned outlets, found no systematic bias and concluded that “media reputation in this competitive industry acts as a powerful disciplining force.”[47] The word that carries the second finding is “competitive.” Reputation disciplines a conflicted gatekeeper when its audience can compare it to an unconflicted one. In the 2026 Incogni survey of American job seekers, 83 percent had used Indeed in the past five years and 23 percent had used Glassdoor. No independent employer-review site of comparable reach appears in the survey at all.[48] The discipline that saved the movie critics is not available to the job seeker, because the reviewed side’s vendor owns the only review site most of them have heard of, and owns the job search engine beside it.
IV. The Standing Power to Unmask
The two halves of the problem meet in a single fact. Glassdoor’s promise to reviewers has always concerned the company’s disposition. It would resist requests to open the file. “When Glassdoor receives a request to reveal a reviewer’s identity, our immediate response is generally to decline.”[49] That is a promise about what the company will do, and a disposition is exactly what a change of ownership changes.
The courts have shown what the promise is worth when tested. The Ninth Circuit held in 2017 that a grand jury acting in good faith may have the reviewers’ identities, and that Glassdoor’s own warnings defeated any expectation to the contrary.[50] In 2022, a magistrate judge in the Northern District of California ordered Glassdoor to identify the authors of five anonymous reviews of a toy company so that the company could sue them for defamation in New Zealand. “Glassdoor knows who wrote the reviews, Zuru doesn’t,” the court wrote, and “[b]ecause Glassdoor hasn’t made that showing, and because Zuru’s defamation claim is plausible, the Court will require Glassdoor to reveal who wrote the reviews.”[51] Glassdoor called the ruling a rare outlier. It may be. The point is what the order produced. What a court can compel is whatever the file contains, and the file now contains a verified identity and a recruiting profile rather than an email address.
In The Interference Fallacy I proposed a test for the kind of power that privacy and competition law each miss: power that is asymmetric, arbitrary, and standing. Apply it here. The asymmetry is complete. Indeed, Inc. holds the file, sells to the employers described in it, and the reviewer holds nothing. The arbitrariness is written into the policy in the modal verb that governs every material term: Glassdoor “may update your Profile with data we obtain from third parties,” “may attempt to verify your employment history or status through various methods,” and revised the terms on which the file is kept in July 2023, in November 2025, and in July 2026, each time by posting a revision and, in the later two, by conditioning continued access on acceptance.[52] And the power is standing. It exists whether or not it is exercised. Glassdoor’s assurance that it has “never and will never reveal a user’s name alongside their content” is an assurance about conduct, offered by a company that has agreed in its own policy that it will “[c]omply with relevant laws or to respond to subpoenas, warrants, or legal processes served on us,” and that is now a division of the company selling to the other side.[53] The reviewer cannot contest the terms, cannot disconnect the account, and cannot delete the one without losing the other.
The consent question asks whether Cellio agreed. The price question asks whether employers paid more after 2018. The first is answered by a click and the second by a seventeen percent rise in revenue per posting, and neither answer touches the thing that is wrong, which is that the party that promised to stand between the worker and the employer now belongs to the employer’s vendor and holds the worker’s name.
V. What Would Restore the Adversity
The remedies follow from the diagnosis, and they are structural rather than disclosural, because disclosure is the instrument that failed.
The first is the Gateway remedy, applied. Names attached after July 2023 to accounts created under the earlier terms should be severable at the user’s request without deletion of the account, which is the relief Cellio asked for and was refused. Glassdoor’s own explanation supports it: the name serves Community, and a user who does not use Community has supplied a name for nothing. A regulator applying 1Health.io would not need to find that any name had been disclosed. It would need to find that the capacity to disclose was created retroactively, and the policy history establishes that on its face.
The second is minimization. The review function has never required a verified identity. The Ninth Circuit’s 2017 description of the service shows that it then ran on an email address. A rule limiting what a review platform may retain about the author of an anonymous review to what the review function needs would remove the file that every subpoena, every acquisition, and every policy revision has enlarged. This is the prescription of The Interference Fallacy stated in the terms of a single service: limit what may be accumulated, so that the watching power cannot grow, rather than asking each watched person to consent to its growth.
The third is separation. Congress answered the rating agencies’ conflict with structural supervision, on the finding that the agencies’ own assurances were insufficient. A review platform owned by a recruiting vendor should be required to hold the reviewer-identity file apart from the recruiting business, under terms that bar the recruiting side from access and that survive a change of ownership, so that the next merger cannot do what this one did.
The fourth is the one that would have prevented the problem, and it belongs to merger review. When a vendor to employers acquires the site where workers evaluate employers, the relevant customers on the review side are the workers, the relevant product is the adversity of the site to the vendor’s customers, and the relevant question is whether the acquisition degrades it. The 2018 transaction closed in six weeks. No theory then available asked that question, and none does now. The Guidelines’ conflict-of-interest concept could be extended to reach it without any change in the statute, because the harm is to the quality of a product sold, at a price of zero, to a side of the market the merged firm has every reason to treat as inventory.
None of this has been tried. I have found no enforcement action, no state proceeding, and no class action arising from the 2024 addition of names to Glassdoor profiles, and none arising from the merger. The Incogni researchers who examined the platform in 2026 scored Glassdoor among the least invasive of the nine job sites they studied, noted that it lets every user opt out of the sale of their data, and recorded the real-name episode as a controversy.[54] That is the measurement the current law makes, and it is accurate as far as it goes. It counts disclosures. The thing to count is the file, who holds it, and whom they sell to.
[1] Monica Cellio, Time to Delete Your Glassdoor Account, Cellio.org (Mar. 12, 2024), https://cellio.org/blog/2024/delete-glassdoor (recounting that Glassdoor added her real name and location to her profile after she emailed support and quoting a support manager’s statement that the name “cannot be reverted or nullified/anonymized”); see also Zack Whittaker, Users Say Glassdoor Added Real Names to User Profiles Without Their Consent, TechCrunch (Mar. 20, 2024), https://techcrunch.com/2024/03/20/glassdoor-added-real-names-profiles-without-consent/ (reporting that she “accused Glassdoor of getting her full name from the email she sent to customer support” and that “the only other option is to delete your account”).
[2] Cellio, supra note 1 (quoting the manager’s email).
[3] Whittaker, supra note 1 (quoting Glassdoor’s statement that “User reviews on Glassdoor have always and will always be anonymous” and that Glassdoor “has never and will never reveal a user’s name alongside their content, unless that is what the user chooses”); Christian Sutherland-Wong, Glassdoor CEO: Anonymous Posts Will Always Stay Anonymous, Fortune (Mar. 22, 2024), reprinted at https://www.glassdoor.com/about/press-release/glassdoor-ceo-anonymous-posts-will-always-stay-anonymous/ (stating that “Anonymity is the lifeblood of Glassdoor”).
[4] Glassdoor, Privacy Policy (rev. July 1, 2026), https://hrtechprivacy.com/brands/glassdoor (stating that “Indeed, Inc. is the data controller for our services”); Glassdoor, Summary of Changes to Glassdoor’s Terms of Use and Privacy Policy, https://hrtechprivacy.com/glassdoor-summary-of-changes (recording, under the revision dated July 1, 2026, that “Glassdoor services are now operated by Indeed following the merger of Glassdoor LLC and Indeed, Inc. on July 1, 2026”).
[5] Recruit Holdings Co., Earnings Release for Q4 FY2025 (May 15, 2026), https://recruit-holdings.com/en/ir/library/upload/Recruit_202603Q4_earnings_en.html (describing the HR Technology segment as operating “a global two-sided talent marketplace” built on Indeed and Glassdoor, reporting segment revenue of 1,458.4 billion yen, or “9.67 billion US dollars,” for the fiscal year ended March 31, 2026, and citing “the 3.5 million employers that use Indeed each year to hire”).
[6] In re Grand Jury Subpoena, No. 16-03-217 (United States v. Glassdoor, Inc.), 875 F.3d 1179 (9th Cir. 2017), No. 17-16221, slip op. at 4, https://cdn.ca9.uscourts.gov/datastore/opinions/2017/11/08/17-16221.pdf (describing Glassdoor.com as “a website where employers promote their companies to potential employees, and employees post reviews of what it’s like to work at their companies,” and noting that users supplied only an email address that “do[es] not appear on the site”).
[7] Id., slip op. at 14-15 (holding that the good-faith test of Branzburg v. Hayes governs a grand jury subpoena for anonymous reviewers’ identities, and reasoning that the privacy policy’s subpoena warning left users without “a reasonable expectation of complete privacy”); see also id., slip op. at 22 (affirming the denial of the motion to quash because enforcement “does not violate the First Amendment rights of Glassdoor’s users”).
[8] Press Release, Recruit Holdings Co., Announcement of Definitive Agreement for Acquisition of Glassdoor (May 9, 2018), https://recruit-holdings.com/en/newsroom/20180509_8170/ (announcing the acquisition “for $1.2 billion in cash,” quoting Hisayuki Idekoba, and stating that “Glassdoor will operate within Recruit Holdings’ HR technology segment”).
[9] Press Release, Recruit Holdings Co., Recruit Holdings Announces Completion of Glassdoor Acquisition (June 21, 2018), https://recruit-holdings.com/en/newsroom/20180621_8244/ (announcing that the closing conditions “were satisfied ahead of the schedule”). The inference that no second request issued rests on the calendar, not on any agency statement, which I have not found.
[10] Press Release, Glassdoor, Glassdoor To Power Fishbowl, A Fast-Growing Professional Social Network (Sept. 14, 2021), https://www.glassdoor.com/about/press-release/glassdoor-powers-fishbowl/ (announcing the acquisition and describing Fishbowl’s identity options).
[11] Glassdoor, Summary of Changes, supra note 4 (recording the consolidation of the Glassdoor and Fishbowl terms effective December 1, 2022 for new users and January 1, 2023 for existing users); Paolo Confino, Glassdoor Pulls a 180 on Users, Requiring Them to Provide Their Real Names to Use Their Accounts, Fortune (Mar. 21, 2024), https://www.fortune.com/2024/03/21/glassdoor-180-users-real-names-accounts-employers-trashed-them (reporting that “Fishbowl requires users who sign up to include their real name” and attributing the change to the 2021 acquisition).
[12] Glassdoor, Privacy and Cookie Policy (rev. July 27, 2023), https://hrtechprivacy.com/glassdoor-privacy-and-cookie-policy-archive-july-27-2023-version (identifying “Glassdoor LLC” as the data controller and containing the three quoted sentences).
[13] Id. (warning that “Glassdoor cannot guarantee your anonymity as, depending on your specific situation, the circumstances and information you disclose in your Content, and the semi-/anonymous identifiers you use may allow someone to identify you or narrow down your identity to a small group of people”).
[14] Sutherland-Wong, supra note 3 (explaining the sign-up requirement and adding that “approximately one-third of users share their full name when posting in Glassdoor Community”).
[15] Confino, supra note 11 (quoting Glassdoor’s emailed statement).
[16] Glassdoor, Privacy Policy, supra note 4 (stating that “[b]eginning November 18, 2025, we offer users the ability to log in to our services using an Indeed services account,” that “[n]ew users must utilize Indeed Login to access our services,” and that existing users “may be required to log in with a connected account” after April 20, 2026).
[17] Id. (stating that connected accounts “may not disconnect” and that each service “receive[s] a complete copy of your Profile data”); Indeed, Privacy Policy (last updated Aug. 12, 2026), https://hrtechprivacy.com/brands/indeed (stating that “the accounts cannot be unlinked once merged,” that synchronized attributes include “professional history, job preferences, and contact information,” and that “Indeed and its affiliates are directly or indirectly owned by a publicly traded Japanese parent company, Recruit Holdings Co. Ltd.”).
[18] Glassdoor, Summary of Changes, supra note 4 (recording the July 1, 2026 merger).
[19] Complaint ¶ 5, In re Gateway Learning Corp., No. C-4120 (F.T.C. Sept. 10, 2004), https://www.ftc.gov/sites/default/files/documents/cases/2004/09/040917comp0423047.pdf (reciting the privacy policy’s no-sale promise).
[20] Id. ¶¶ 6-8 (alleging that Gateway began renting customer data in April 2003 and posted a revised policy on June 20, 2003 without alerting consumers).
[21] Id. ¶ 13 (alleging that the retroactive application of the revised policy “was, and is, an unfair act or practice”).
[22] Decision and Order pt. III, In re Gateway Learning Corp., No. C-4120 (F.T.C. Sept. 10, 2004), https://www.ftc.gov/sites/default/files/documents/cases/2004/09/040917do0423047.pdf (ordering that Gateway “shall not apply such changes to information collected from or about consumers before the date of the posting, unless Respondent obtains the express affirmative (‘opt-in’) consent of the consumers to whom such personal information relates”).
[23] Press Release, Fed. Trade Comm’n, Gateway Learning Settles FTC Privacy Charges (July 7, 2004), https://www.ftc.gov/news-events/news/press-releases/2004/07/gateway-learning-settles-ftc-privacy-charges (quoting Beales and describing the matter as “the first FTC case to challenge deceptive and unfair practices in connection with a company’s material change to its privacy policy”).
[24] Complaint ¶ 29, In re Facebook, Inc., No. C-4365 (F.T.C. July 27, 2012), https://www.ftc.gov/sites/default/files/documents/cases/2012/08/120810facebookcmpt.pdf (alleging in Count 3 that the December 2009 changes constituted an unfair practice); see also id. ¶¶ 19-22 (describing the designation of previously restrictable information as “publicly available” and the overriding of prior user choices).
[25] Id. ¶ 26 (identifying harms from the designation, including exposure of sensitive information “to third parties – such as prospective employers, government organizations, or business competitors”).
[26] Complaint ¶¶ 23-25, 44, In re 1Health.io Inc., No. C-4798 (F.T.C. Sept. 6, 2023), https://www.ftc.gov/system/files/ftc_gov/pdf/1Health-Complaint.pdf (alleging in Count V that the retroactive application of expanded sharing terms to previously collected genetic and health data “is an unfair act or practice,” and alleging at ¶ 25 that the company had not yet implemented the broader sharing but “could do so at any time without further notice to consumers”).
[27] Fed. Trade Comm’n, A Look Behind the Screens: Examining the Data Practices of Social Media and Video Streaming Services 4-5 & n.29 (Sept. 2024), https://www.ftc.gov/system/files/ftc_gov/pdf/Social-Media-6b-Report-9-11-2024.pdf (listing retroactive privacy changes among “[u]nfair data practices” and citing 1Health.io).
[28] 15 U.S.C. § 45(n) (setting the three-part standard for unfairness).
[29] Glassdoor, Privacy Policy, supra note 4 (describing the separation between semi-anonymous content and the public profile).
[30] Glassdoor, Protecting User Anonymity, https://www.glassdoor.com/about/trust/protecting-user-anonymity/ (stating that the company’s “immediate response is generally to decline,” that it has “successfully protected the anonymity of its users in over 100 cases,” and that “a court might not allow the user to remain anonymous” where a review is shown to violate legal rights).
[31] In re Grand Jury Subpoena, No. 17-16221, slip op. at 12-13 (observing that Glassdoor, “as part of its business model,” gathers and publishes “information from sources it has agreed not to identify,” and quoting Glassdoor’s argument that “if employees cannot speak anonymously, they often will not speak at all”).
[32] Decision and Order pt. II, In re Gateway Learning Corp., supra note 22 (barring disclosure “to any third party” of personal information collected before the revised policy was posted absent opt-in consent).
[33] Cal. Civ. Code § 1798.140(ad)(1) (defining “sell”); Glassdoor, Privacy and Cookie Policy (rev. July 27, 2023), supra note 12 (acknowledging that affiliate sharing “may be considered a ‘sale’”).
[34] Cal. Civ. Code § 1798.140(d)(2) (extending the definition of “business” to a commonly controlled entity only where it “shares common branding,” and defining the term).
[35] Cal. Civ. Code § 1798.140(ad)(2)(C) (excepting merger transfers from the definition of “sell” on the stated condition of prior notice).
[36] Recruit Holdings Co., Earnings Release for Q4 FY2025, supra note 5 (describing the segment’s products and pricing).
[37] Id. (reporting that “monetization improvements led to a 17% year over year rise in the US Average Revenue per Job Posting on Indeed, or US ARPJ, despite stagnant hiring demand”).
[38] Glassdoor, Glassdoor Employer Center Guide - US, https://www.glassdoor.com/employers/resources/glassdoor-employer-center-guide/ (stating that Glassdoor approves HR, marketing, operations, and executive personnel “for a Free Employer Account” and describing responses and flagging); Glassdoor, Respond to Employee Reviews, https://www.glassdoor.com/employers/solutions/reviews/ (inviting employers to “[f]lag any review that you think doesn’t meet our community guidelines for further moderation”).
[39] Glassdoor, Glassdoor Employer Center Guide - US, supra note 38 (describing the featured-review capability under the label “Enhanced Profile”).
[40] Indeed, Glassdoor and Indeed: Working Together to Help Employers Across the Hiring Journey (last updated May 7, 2026), https://www.indeed.com/hire/resources/howtohub/how-employers-use-glassdoor-and-indeed (confirming that “Glassdoor is owned by Indeed” and describing the sponsored-job, Employer Branding Hub, and Review Intelligence products).
[41] Glassdoor, When Does Glassdoor Remove User Content?, https://www.glassdoor.com/about/trust/when-is-content-removed/ (stating that “employers cannot pay to have reviews removed” and that recruiting clients “must explicitly agree to this in their contracts”); Glassdoor, The Why Behind Glassdoor Review Moderation Process (June 11, 2021), https://www.glassdoor.com/blog/the-why-behind-glassdoor-review-moderation-process/ (stating that the same standard applies “whether or not the content involves an employer client of Glassdoor”).
[42] Jason Sockin & Aaron Sojourner, What’s the Inside Scoop? Challenges in the Supply and Demand for Information on Employers, 41 J. Lab. Econ. 1041, 1041 (2023) (finding that negative information is both most valuable to job seekers and most risky to supply, and that retaliation concerns degrade the information’s value).
[43] U.S. Dep’t of Justice & Fed. Trade Comm’n, Merger Guidelines 24-25 (Dec. 18, 2023), https://www.justice.gov/d9/2023-12/2023%20Merger%20Guidelines.pdf (defining “conflict of interest” in the analysis of multi-sided platforms under Guideline 9).
[44] Id. at 13 (stating Guideline 5 and identifying access to “rivals’ competitively sensitive information” as a mechanism of harm).
[45] Dodd-Frank Wall Street Reform and Consumer Protection Act, Pub. L. No. 111-203, § 931(2), (4), 124 Stat. 1376, 1872 (2010) (codified at 15 U.S.C. § 78o-7 note) (finding that credit rating agencies play “a critical ‘gatekeeper’ role” and “face conflicts of interest that need to be carefully monitored”).
[46] Jonathan Reuter & Eric Zitzewitz, Do Ads Influence Editors? Advertising and Bias in the Financial Media, 121 Q.J. Econ. 197, 197 (2006) (finding that recommendations in personal finance publications correlate with past advertising but that those in national newspapers do not).
[47] Stefano DellaVigna & Johannes Hermle, Does Conflict of Interest Lead to Biased Coverage? Evidence from Movie Reviews, 84 Rev. Econ. Stud. 1510 (2017) (finding no systematic bias in conglomerate-owned outlets’ reviews of affiliated studios’ films and attributing the result to reputational discipline in a competitive industry).
[48] Incogni, Are Job-Search Platforms Exploiting Job Seekers for Their Personal Data? 3 (2026), https://blog.incogni.com/are-job-search-platforms-exploiting-job-seekers-for-their-personal-data/ (reporting platform usage among 1,000 surveyed Americans who had sought work in the prior five years).
[49] Glassdoor, Protecting User Anonymity, supra note 30.
[50] In re Grand Jury Subpoena, No. 17-16221, slip op. at 10, 14-15, 22.
[51] Zuru, Inc. v. Glassdoor, Inc., No. 22-mc-80026-AGT, slip op. at 11-12 (N.D. Cal. July 11, 2022) (Tse, M.J.), https://www.govinfo.gov/content/pkg/USCOURTS-cand-3_22-mc-80026/pdf/USCOURTS-cand-3_22-mc-80026-1.pdf (denying in principal part Glassdoor’s motion to quash a subpoena issued under 28 U.S.C. § 1782 and ordering Glassdoor to identify the reviewers, on the ground that the reviewers, as foreign nationals abroad, held no First Amendment rights and that Glassdoor had not shown New Zealand law would prioritize anonymity over reputation).
[52] Glassdoor, Privacy Policy, supra note 4 (containing both quoted “may” clauses); Glassdoor, Summary of Changes, supra note 4 (listing the revisions).
[53] Whittaker, supra note 1 (quoting the “never and will never” assurance); Glassdoor, Privacy Policy, supra note 4 (listing compliance with “subpoenas, warrants, or legal processes served on us” among the purposes for which personal data is used).
[54] Incogni, supra note 48, at 10-11, 13-14 (ranking Glassdoor among the three least invasive platforms of nine, noting that it “allows all its users—regardless of geographical location—to opt out of the sale of their data,” and reporting that it “did stir up some controversy when it added users’ real names and job titles to their previously anonymous profiles”).