Two-Sided Market Structure Creates an Antitrust Blind Spot for Non-Paying Users

A job seeker uploads a resume to Indeed. Under Indeed’s privacy policy, the profile that results “is set so that employers can find you by default.”[1] On the other side of the site, Indeed sells employers a product called Smart Sourcing, which it advertises as access to “Indeed’s pool of 245 million resumes,” priced at $520 a month for 100 contacts and “$5.20 per contact” after that.[2] Indeed’s own statement of United States privacy rights, under a heading that reads “‘Sale’ or Targeted Advertising (‘Share’) of Personal Data,” explains the arrangement in one sentence: “If you set your profile to searchable, we display your profile and recommend your profile to employers and recruiters.”[3] The seeker paid nothing. The employer paid $5.20. Whether the transaction between them was a “sale” of the seeker’s personal information is a question Indeed’s page raises and does not answer.

In June 2026, the data-removal company Incogni published a study of nine job-search and networking platforms and reported that eight of them “sell user data (according to the CCPA definition of a data sale).”[4] The best-scoring platform in the study, Snagajob, “was still found to sell user data according to the CCPA definition, suggesting that the bar is generally low with these platforms.”[5] Incogni is a vendor with a product to sell, and its method was to read privacy policies rather than to observe practices, so I read the policies myself. The finding holds. Six of the nine say, in their own words, that what they do with a seeker’s data is or “may be considered” a sale under California law. A seventh, Indeed, files its transfers of personal data to “employers, affiliates and/or marketers” under a heading that begins with the word “Sale” and offers an opt-out from “Selling.”[6] An eighth, ZipRecruiter, says in one sentence that it does “not monetize your personal information by selling it to third parties” and in the next that “we may sell or share, and in the preceding twelve (12) months we have sold or shared,” identifiers, internet activity, and geolocation data with “[t]hird-party advertising partners or advertising networks.”[7] The ninth is LinkedIn, which states flatly that “[w]e do not sell your personal information,” and then discloses that it may “share” it, including “with Microsoft to personalize the ads they show you off of LinkedIn.”[8] Incogni ranked LinkedIn among the three most invasive platforms of the nine.[9]

The platforms range from Indeed, used by 83 percent of the job seekers Incogni surveyed, to SimplyHired, used by 9 percent.[10] A practice that is uniform across that range is unlikely to be explained by any one firm’s market power. It is explained by the structure of the business. This essay works through that structure and what two bodies of law make of it. The Federal Trade Commission’s theory is that privacy is a dimension of product quality and that a firm facing no competitive pressure has no reason to improve it. The job board market has nine competitors and no privacy competition at all, which means the theory is missing a term. Antitrust doctrine, for its part, has a rule for markets with two sides, and the rule, applied to a job board, either nets the seeker’s loss against the employer’s gain or declines to count the seeker as a customer. The seeker’s data is the price of the service, and no doctrine now on the books treats it as one.

I. Two Sales, One Definition

California defines a sale of personal information as “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for monetary or other valuable consideration.”[11] The Attorney General has read “other valuable consideration” broadly. When DoorDash contributed customer data to a marketing cooperative in exchange for the right to market to other members’ customers, the state sued, alleging that “[a]ny transaction under which a business receives a benefit for sharing consumer information can be a sale for purposes of the CCPA,” and DoorDash paid $375,000 to settle.[12] The statute separately defines “sharing” as disclosure “to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration,” and gives the consumer a single right to opt out of both.[13] Since January 1, 2023, job applicants have been consumers for these purposes. The exemption that once covered them expired on that date, and the California Privacy Protection Agency’s first decision addressing job applicants, against Tractor Supply in September 2025, faulted the company for “[f]ailing to notify California job applicants of their privacy rights and how to exercise them” and for an opt-out webform that “had no effect upon how the company shared consumers’ personal information through third party tracking technologies.”[14]

Read against that definition, the job boards’ policies describe two different sales, and the distinction matters for everything that follows.

The first is the advertising sale. It is the one most of the policies confess to. ZipRecruiter’s admission concerns “showing you ads about ZipRecruiter Services.”[15] Glassdoor’s data table lists “Advertising Partners & Ad Exchanges” among the recipients of profile information and job interests.[16] Snagajob says disclosures to “third-party advertising providers for targeted advertising purposes” and to “analytics partners” “may be considered a ‘sale’ of personal information under applicable law.”[17] Nexxt participates in a network that receives “a SHA-256 hashed file of your email address” and derives “activity and intent signals” for “third party marketing partners,” which “may be considered a sale or sharing of personal information.”[18] FlexJobs, whose policy names Bold LLC as its operator, says that the sharing of “interaction Information” with “analytics providers, advertising partners, third-party partners, and social media sites” “may or may not include a monetary compensation” and “may be considered a sell.”[19] This is the sale the ad-tech industry made universal, and a job board’s version of it differs from a retailer’s only in what the tracking reveals: that the person is looking for work.

The second sale is the resume itself, and the policies are less sure what to call it. Monster’s disclosure page lists the categories of data it has “SOLD,” among them “Employment Information,” “Education & Skills,” and “Profiles, Inferences, & Generated Data,” and among the buyers, “Other Monster members and service customers.”[20] Its rights page explains the mechanism: “any registered company (or individual recruiter) user who purchases access to the databases can view your resume and contact details,” and the employer product page sets the price, “$299/month” for a subscription and “2 credits ($2)” for “[e]ach resume view or action.”[21] ZipRecruiter tells employers its Resume Database holds “over 56M resumes” and lets them “click to unlock contact info instantly.”[22] Nexxt describes a “Semi-Private” setting in which “[o]nly Employers who have purchased resume searching” can see a seeker’s information.[23]LinkedIn sells Recruiter, a search and messaging product built on “1B+ professionals,” by contacting sales.[24] Indeed’s Smart Sourcing subscription is the largest of these, and Indeed’s parent reports “over 665 million verified job seeker profiles created on Indeed” and “3.5 million employers that use Indeed each year to hire.”[25]

The statute has an answer for this second sale, and the platforms’ defaults are built on it. A business does not sell personal information when “[a] consumer uses or directs the business to intentionally: (i) Disclose personal information. (ii) Interact with one or more third parties.”[26] A seeker who sets a resume to searchable has, on this reading, directed the disclosure, and the employer’s payment for it is beside the point. Indeed’s policy is written to secure that reading: “By creating a profile set to ‘Employers can find you’ through the Site including when you upload a file resume on the Site, you are requesting and authorizing Indeed to make available your profile data to third parties.”[27] Monster’s is written the same way. An employer who purchases access can view the resume “when you upload your resume with the standard, default search options enabled.”[28] FlexJobs’ terms say that “[w]hen you decide to share a resume you will be automatically included as part of the database and your resume will be searchable by anyone unless you actively opt-out.”[29]

The word that carries each of these sentences is “default.” The direction that takes the resume sale outside the statute is supplied by the platform, in advance, as the setting a seeker receives by uploading a document. Indeed’s own pages disagree about how the default works. The privacy policy says the profile “is set so that employers can find you by default.” The privacy FAQ says a new profile “starts in an unspecified state, which means employers cannot find you until you make a choice,” and that “[t]he default option recommended when you first see the prompt is ‘Employers can find you.’”[30] Either way, the seeker’s “direction” is a pre-selected answer to a prompt, given by someone who, in Incogni’s survey, is more likely than not to have skimmed or skipped the policy that explains it.[31] And Indeed itself does not appear confident that the direction exception does the work. Its CCPA page files the searchable profile under the “Sale” heading, its SimplyHired affiliate lists “We display your public resume to employers and recruiters” first among the activities that “may fall under the definition of ‘sell’ or ‘share,’” and both sites tell the user that opting out of transfers to Indeed’s affiliates requires “a personal data deletion request.”[32]

So the honest summary of Incogni’s eight-of-nine is this. Every platform sells the seeker’s browsing to advertisers, and every platform that has a resume database sells the resume to employers under a consent it supplies to itself. The one platform that says it sells nothing sells access to a billion profiles under a different verb. The finding describes an industry that has arrived, from nine directions, at the same answer.

II. Why Nine Competitors Produce No Competition

The Federal Trade Commission’s 2024 report on social media platforms offered an account of why data practices do not improve. Privacy, the staff wrote, “can be an important part of the overall quality of a company’s product offering,” and “[l]ack of competition, in turn, can lead to consumer harm,” because “the lack of competition can mean that firms are not competitively pressured to improve product quality with respect to privacy, data collection, and other service terms, such that users lack real choice and are forced to surrender to the data practices of a dominant company or a limited set of firms.”[33] The staff recommended that antitrust enforcers “carefully scrutinize potential anticompetitive acquisitions and conduct” and remain “vigilant to anticompetitive harms that may manifest in non-price terms like diminished privacy.”[34]

The job board market is a test of that account, and the account fails it. There is no dominant firm whose data practices the seeker is forced to accept. There are nine, and more, and a seeker can and does use several. Incogni found that 34 percent of its respondents had uploaded a resume to more than two platforms.[35] If privacy were a dimension of quality on which platforms competed for seekers, one would expect at least one of nine to differentiate on it, the way one of nine restaurants differentiates on price. None does. Snagajob, the best of the set on Incogni’s criteria, sells. The explanation lies in who the seeker is to the platform.

Recruit Holdings describes Indeed and Glassdoor as “a global two-sided talent marketplace” and its products as “pay-for-performance and subscription pricing models” for employers.[36] ZipRecruiter’s annual report says the company derives “substantially all of our revenue from sales of products and services related to the distribution of job advertisements to job seekers across the internet,” and that “[o]ur marketplace is free to job seekers.”[37] Microsoft reports that LinkedIn’s revenue “is mainly affected by demand from enterprises and professionals for subscriptions to Talent Solutions, Sales Solutions, and Premium Subscriptions offerings, as well as member engagement and the quality of the sponsored content delivered to those members to drive Marketing Solutions.”[38] The economics of this arrangement have been understood since Jean-Charles Rochet and Jean Tirole described platforms that “must ‘get both sides of the market on board’” and observed that they “often treat one side as a profit center and the other as a loss leader, or, at best, as financially neutral.”[39] The management literature calls the two sides the “subsidy side” and the “money side,” and explains that the platform “sets prices for that side below the level it would charge if it viewed the subsidy side as an independent market.”[40] Profit-maximizing platforms, as David Evans and Richard Schmalensee put it, “often set prices above marginal cost on one side and below marginal cost on the other side.”[41]

The job seeker is the subsidy side. That is why the service is free. It is also why the seeker’s privacy does not improve with competition. A platform competes for seekers in order to deliver them to employers, and it competes on the terms that deliver the most of them at the least cost: the number of listings, the ease of applying, and the reach of the site. A seeker who does not read the policy, believes the data goes only to employers, and says she is comfortable sharing will not defect to a rival over a data practice she does not know about. Incogni’s survey found all three: 46 percent of seekers comfortable sharing their data, 37 percent believing platforms share only with employers, and nearly half who skim or skip the policy, which at every platform but LinkedIn was written at a college-graduate reading level and took an average of 35 minutes to read.[42] With no demand-side signal, there is no supply-side response, and a platform that unilaterally restricted what it collected would pay a cost on the money side for a benefit the subsidy side cannot see. The uniformity Incogni measured is the equilibrium.

The FTC’s account, then, is right about the mechanism and wrong about the cause. Firms do not compete on privacy where competition does not reward it. The report located the failure of reward in dominance. In job boards the failure is located in the price structure, and it would survive the entry of a tenth competitor, because the tenth would face the same two sides and price them the same way. The distinction has a doctrinal consequence, because the FTC’s own theory was tested at trial in the year after the report and lost. In its monopolization case against Meta, the agency argued that Meta had “raised the quality-adjusted price of its apps” by degrading them, an argument it had to make because “Facebook and Instagram are free, just as they always have been.” The court found that “[t]he record, however, shows the opposite: Meta’s apps have continuously improved,” and concluded that “[d]irect proof that a product is worse than some unknown counterfactual is elusive.”[43] The court’s quality evidence concerned ad load, user sentiment, and the feed. It made no finding about privacy. The European Court of Justice, asked a related question by a German court, went the other way, holding that a competition authority may treat a dominant firm’s non-compliance with data protection law as “a vital clue” to whether its conduct departs from competition on the merits, because “access to personal data and the fact that it is possible to process such data have become a significant parameter of competition between undertakings in the digital economy.”[44] The two courts were looking at the same kind of firm and reached opposite conclusions about whether privacy is something competition law can see.

III. Ohio v. American Express and the Side That Is Sold

Suppose a seeker, or a state, wanted to challenge the resume sale under the antitrust laws. The claim would be that the platforms’ uniform terms reflect an absence of competition on the seeker side of the market, and that the harm is the seeker’s exposure. The first obstacle is Ohio v. American Express, and the way the obstacle operates depends on which of two things a court decides a job board is.

Amex concerned credit card networks, which the Court described as “a special type of two-sided platform known as a ‘transaction’ platform,” whose “key feature” is “that they cannot make a sale to one side of the platform without simultaneously making a sale to the other.”[45] Such platforms “facilitate a single, simultaneous transaction between participants,” and for that reason, the Court held, the market must be defined to include both sides, and a plaintiff cannot prevail by showing harm on one of them: “Evidence of a price increase on one side of a two-sided transaction platform cannot by itself demonstrate an anticompetitive exercise of market power.”[46] The plaintiffs, who had shown that Amex’s rules raised merchant fees, lost because they had not shown that the rules “increased the cost of credit-card transactions above a competitive level, reduced the number of credit-card transactions, or otherwise stifled competition in the credit-card market.”[47]

The Court drew the line around its rule with care, and the example it used sits close to the job board. “Newspapers that sell advertisements,” it wrote, “arguably operate a two-sided platform because the value of an advertisement increases as more people read the newspaper. But in the newspaper-advertisement market, the indirect network effects operate in only one direction; newspaper readers are largely indifferent to the amount of advertising that a newspaper contains. Because of these weak indirect network effects, the market for newspaper advertising behaves much like a one-sided market and should be analyzed as such.”[48] The authority for that sentence is Times-Picayune, a 1953 tying case about classified and general advertising, in which the Court described the newspaper’s business in words that describe the job board’s: “every newspaper is a dual trader in separate though interdependent markets; it sells the paper’s news and advertising content to its readers; in effect that readership is in turn sold to the buyers of advertising space.”[49]

The job board descends from the classified advertisement, and its economics still look like one. Ioana Marinescu and Ronald Wolthoff, studying CareerBuilder, described the model in a sentence: “While job seekers can use the site for free, CareerBuilder charges firms several hundred dollars to post a job ad on the website for one position for one month.”[50]A posting is sold whether or not any seeker applies. The employer buys reach, the seeker reads for free, and the readership is what the employer bought. On that view the job board falls on the newspaper side of Amex’s line, the employer-facing market is analyzed alone, and the seeker side is what Times-Picayune said the readership is: the thing “in turn sold.” The doctrine then never reaches the question of netting the seeker’s harm against the employer’s benefit, because the seeker is the product rather than the customer, and the product’s exposure is the customer’s gain.

The other view is available, and the platforms’ newer products invite it. Indeed sells Smart Sourcing by the contact, ZipRecruiter by the unlock, and Monster by the resume view. A match between a particular employer and a particular seeker, sold when the employer pays and the seeker’s profile is delivered, looks more like a transaction than a classified ad does. The indirect network effects run in both directions, since seekers value more listings and employers value more seekers, which is the feature the Court said newspapers lack. A court could hold that a pay-per-contact job board “cannot make a sale to one side of the platform without simultaneously making a sale to the other,” and on that holding Amexapplies in full. The market is the two-sided market for matches, the seeker’s exposure is one side of a two-sided price, and the plaintiff must show harm to the market “as a whole.” The employer’s gain from a fuller, more searchable, more contactable resume database is the offset. The seeker’s harm is netted.

The Ninth Circuit has left the boundary open. In PLS.com, it declined to decide “whether Amex applies only to transaction networks” or to any platform with “strong indirect network effects,” and held that in either case Amex “does not require a plaintiff to allege harm to participants on both sides of the market,” because “[i]t is possible that a practice harming participants on one side of the market could outweigh the benefits to participants on the other, causing anticompetitive effects on the market as a whole.”[51] That holding is the most a seeker could ask for under current law, and it still requires the seeker’s harm to be weighed against the employer’s benefit and to come out heavier. A court in the District of Columbia read Amex more narrowly still, as a Section 1 case about a non-monopolist that does not displace the ordinary analysis of exclusionary conduct under Section 2.[52] None of these readings treats the seeker’s data as a price. Each asks whether, after the seeker’s exposure is set against the employer’s access, the market as a whole is worse off. On the money side of a job board, where revenue per posting is rising and the resume database is the product, the answer will usually be no.

So the two characterizations converge. If the job board is a newspaper, the seeker is the readership sold and has no market in which to be harmed. If the job board is a transaction platform, the seeker’s harm is netted against the buyer’s gain. The doctrine has two doors and both open onto the same room. This is the interference fallacy in the form antitrust gives it: the question asked is whether a price rose, the seeker’s price is zero, and the thing the seeker actually pays is invisible to a test built to measure prices.

IV. What the Seeker Actually Pays

Set the doctrine aside and describe the seeker’s position in plain terms. She has uploaded a document containing her name, address, employment history, education, and whatever else a resume holds. The platform has set the document to be findable by default, and has written its policy so that the default is her “direction” to disclose it. The platform’s employer-facing site sells access to that document by the month, the contact, or the view. The platform’s advertising partners receive her identifiers and the fact of her search. If she wishes to stop the platform from transferring her data to its corporate affiliates, the platform’s own page tells her that “a personal data deletion request is required.”[53] If she is one of the 37 percent who believe her data goes only to employers, she is wrong about the advertising sale and right, in a sense the statute does not recognize, about the resume sale.

Measured against the domination test I proposed in The Interference Fallacy, the arrangement has all three markers. The power is asymmetric, because the platform holds the document and the employer holds the money and the seeker holds a settings page. It is arbitrary, because the terms are set by the platform and revised at will, in the modal verb that governs every material clause. And it is standing, because the resume database exists and is sold whether or not any particular employer ever opens her file. The consent question, which is the one privacy law asks, is answered by the default. The price question, which is the one antitrust asks, is answered by the zero. Neither question reaches the standing capacity of nine companies to sell her document to the people she is applying to, on terms they wrote.

Three things would change the answer, and all three are structural. The first is the default. A resume database that required an affirmative choice to be included, made on a page that stated the price the employer pays for access, would supply the “direction” the statute requires instead of manufacturing it, and the California Privacy Protection Agency has the authority to say so by regulation. The second is the treatment of the resume sale as a sale. Indeed’s own CCPA page cannot decide whether displaying a searchable profile to paying employers is one, and the DoorDash complaint’s principle that “[a]ny transaction under which a business receives a benefit for sharing consumer information can be a sale” points toward the answer. If the resume database is a sale, the seeker has an opt-out that does not require deleting the account, the platform must say so at collection, and the uniform practice becomes a uniform disclosure. The third is the one competition law would have to supply, which is to treat the subsidy side of a platform as a market whose product quality includes the data it demands, and to ask, when the platforms that sell to employers consolidate, whether the seeker side was made worse. The 2023 Merger Guidelines have a vocabulary for conflicts of interest on multi-sided platforms.[54] They have not yet been asked to apply it to a side that is sold.

None of this has been tried. The only California enforcement action to reach a job applicant’s data was brought against an employer’s careers page, and no action against a job board has been identified.[55] The Incogni study measured the industry by counting the platforms that admit to selling, and found eight. The number to count is the number that compete for the seeker by declining to. It is zero, and it will remain zero until the seeker becomes, in law, a customer of the platform rather than the thing the platform sells.

---

[1] Indeed, Privacy Policy (last updated Aug. 12, 2026), https://hrtechprivacy.com/brands/indeed (stating that “[w]hen you create a profile on Indeed, it is set so that employers can find you by default” and that “profile data (employers can find you) including your resume data . . . may be available to third parties, such as employers”).

[2] Indeed, Find Employees That Match Your Hiring Criteria, https://www.indeed.com/hire/find-employees?co=US (advertising Smart Sourcing as access to “Indeed’s pool of 245 million resumes”); Indeed, Indeed Smart Sourcing, https://www.indeed.com/hire/resume-search (listing the Professional plan at “$520/month $4,992/year,” “100 contacts per month with a 6-month rollover,” and “[u]nlimited additional contacts for $5.20 per contact”).

[3] Indeed, Your U.S. Privacy Rights, https://www.indeed.com/legal/ccpa-dns (stating, under the heading quoted in the text, that “Indeed shares your personal data with third parties for a variety of reasons, including helping people find more relevant jobs, help employers find relevant candidates and optimizing advertising,” and that “[t]hese third parties include employers, affiliates and/or marketers”).

[4] Incogni, Are Job-Search Platforms Exploiting Job Seekers for Their Personal Data? 2 (June 3, 2026), https://blog.incogni.com/are-job-search-platforms-exploiting-job-seekers-for-their-personal-data/ (reporting the eight-of-nine finding). The nine platforms scored were Snagajob, Nexxt, FlexJobs, Glassdoor, Indeed, SimplyHired, Monster, LinkedIn, and ZipRecruiter. Id. at 10. The study’s methodology section states that it “only evaluated details that were publicly available.” Id. at 15.

[5] Id. at 14.

[6] Indeed, Your U.S. Privacy Rights, supra note 3 (defining “sold” as provision “to a third party for monetary or other valuable consideration, which is a fairly broad term,” and presenting the opt-out under the heading “Opt Out of ‘Selling’ or Targeted Advertising (‘Sharing’ Under CCPA)”).

[7] ZipRecruiter, California Privacy Notice (last updated June 25, 2024), https://www.ziprecruiter.com/assets/static/pdf/legal/california-privacy-notice-en-2024-06-25.pdf (containing both quoted sentences in the section headed “Sale or Sharing of Personal Information”). The six platforms whose policies describe a sale or a practice that “may be considered” one are SimplyHired, Glassdoor, Monster, Snagajob, Nexxt, and FlexJobs. See infra notes 16-20, 32.

[8] LinkedIn, California Privacy Disclosure (last revised Feb. 23, 2026), https://www.linkedin.com/legal/california-privacy-disclosure (stating that “[w]e do not sell your personal information,” that “[w]e may share your personal information, including information about your visits to LinkedIn, with our partners in order to market LinkedIn’s services to you on other platforms,” and that “[i]f you are a member, we may also share your personal information with Microsoft to personalize the ads they show you off of LinkedIn”).

[9] Incogni, supra note 4, at 10-11 (ranking ZipRecruiter, Monster, and LinkedIn as the most invasive of the nine).

[10] Id. at 3 (reporting usage in the past five years among 1,000 surveyed Americans: Indeed 83 percent, LinkedIn 57 percent, ZipRecruiter 40 percent, Glassdoor 23 percent, Monster 22 percent, Snagajob 16 percent, SimplyHired 9 percent). Nexxt and FlexJobs were scored but do not appear in the usage chart.

[11] Cal. Civ. Code § 1798.140(ad)(1) (West 2026) (defining “sell”).

[12] Complaint ¶ 8, People v. DoorDash, Inc., No. CGC-24-612520 (Cal. Super. Ct. Feb. 21, 2024), https://www.oag.ca.gov/system/files/media/doordash-complaint.pdf (alleging that DoorDash’s transfer of customer data to a marketing cooperative in exchange for advertising access “was therefore a sale under the CCPA”); Press Release, Cal. Dep’t of Just., Off. of the Att’y Gen., Attorney General Bonta Announces Settlement with DoorDash (Feb. 21, 2024), https://www.oag.ca.gov/news/press-releases/attorney-general-bonta-announces-settlement-doordash-investigation-finds-company (announcing the $375,000 civil penalty and quoting the Attorney General that “DoorDash’s participation in a marketing cooperative is a sale under the CCPA”).

[13] Cal. Civ. Code § 1798.140(ah)(1) (West 2026) (defining “share”); id. § 1798.120(a)(1) (providing the right “to opt out of sale or sharing”); id.§ 1798.135(a)(1) (requiring a “Do Not Sell or Share My Personal Information” link).

[14] Cal. Civ. Code § 1798.145(m)(4) (West 2026) (providing that the applicant and employee exemption “shall become inoperative on January 1, 2023”); Press Release, Cal. Privacy Prot. Agency, Nation’s Largest Rural Lifestyle Retailer to Pay $1.35M over CCPA Violations (Sept. 30, 2025), https://cppa.ca.gov/announcements/2025/20250930.html (describing the decision as “the first to address the importance of CCPA privacy notices and privacy rights of job applicants” and listing the violations); Order of Decision ¶¶ 39, 57, 65, In re Tractor Supply Co., No. ENF24-M-TR-04 (Cal. Privacy Prot. Agency Sept. 26, 2025), https://cppa.ca.gov/pdf/20250930_tractor_supply_bd_sfo.pdf (finding that “[s]tarting on January 1, 2023, Businesses such as Tractor Supply must notify job applicants about their CCPA rights,” that the opt-out webform “had no effect,” and imposing a fine of $1,350,000).

[15] ZipRecruiter, California Privacy Notice, supra note 7.

[16] Glassdoor, Privacy Policy (rev. July 1, 2026), https://hrtechprivacy.com/brands/glassdoor (listing recipients in the advertising row of its data table and stating that “[u]nder some laws, this type of data sharing may be considered a ‘sale’”).

[17] Snagajob, Privacy Policy § 4 (last updated Sept. 5, 2024), https://snagajob.pactsafe.io/versions/66d5ba6f3d12e45ddeaca629.pdf (stating that such disclosures “may be considered a ‘sale’ of personal information under applicable law, or the processing/sharing of personal information for targeted advertising purposes”). Snagajob’s legal hub at https://legal.snagajob.com/ presents its policies on a single page, and the version quoted is the most recent retrievable as a standalone document.

[18] Nexxt, Privacy Policy (last updated Dec. 22, 2025), https://www.nexxt.com/policies/privacy (describing the CoverClicks network); Nexxt, California Privacy Policy (last updated May 28, 2025), https://www.nexxt.com/caprivacypolicy (stating that Nexxt has “sold or disclosed for a business purpose” categories including “[e]ducation, employment history, and other professional or employment-related information” and “[c]haracteristics of protected classifications under California or federal law (including race and gender)”).

[19] FlexJobs, Privacy Policy §§ 4, 9 (last updated July 18, 2026), https://www.flexjobs.com/privacypolicy.aspx (naming “Bold LLC and Auxiliant S.à.r.l” as the provider and stating that “[b]ecause of CCPA’s broad definition of data selling, in some instances, our sharing of data may be considered a sell”). Bold is the company that acquired the Monster and CareerBuilder job boards out of bankruptcy in 2025 and is the defendant in Rocket Resume, Inc. v. BOLD Ltd., No. 5:26-cv-02852 (N.D. Cal. filed Apr. 2, 2026).

[20] Monster, How We Disclose Information to Others (last updated July 31, 2025), https://www.monster.com/inside/privacy-notice/cookies (defining a sale as “disclosure of your information to a third party in exchange for monetary or other consideration” and listing the categories and recipients quoted in the text).

[21] Monster, Your Privacy Rights and Options, https://www.monster.com/inside/privacy-notice/privacy-rights (describing the “Visible to Employers” setting); Monster, 10M+ Resume Database - Search for Employers, https://hiring.monster.com/products/resume-search/ (listing Monster+ Pro at “$299/month” and stating that “[e]ach resume view or action costs 2 credits ($2)”).

[22] ZipRecruiter, Search Resume Database, https://www.ziprecruiter.com/resume-database/ (advertising “over 56M resumes” and the ability to “click to unlock contact info instantly”).

[23] Nexxt, FAQ, https://www.nexxt.com/faq (describing the Public, Semi-Private, and Private visibility settings).

[24] LinkedIn, LinkedIn Recruiter + Hiring Assistant, https://business.linkedin.com/talent-solutions/recruiter (advertising “1B+ professionals,” “40+ advanced filters,” and pricing by “Contact sales”).

[25] Recruit Holdings Co., Earnings Release for Q4 FY2025 (May 15, 2026), https://recruit-holdings.com/en/ir/library/upload/Recruit_202603Q4_earnings_en.html (reporting both figures in its description of “the two-sided talent marketplace created by Indeed”).

[26] Cal. Civ. Code § 1798.140(ad)(2)(A) (West 2026) (excepting consumer-directed disclosures from the definition of “sell”).

[27] Indeed, Privacy Policy, supra note 1.

[28] Monster, How We Disclose Information to Others, supra note 20 (stating that “[a]ny registered company, individual recruiter, or user who purchases access to our platform(s) can view your public or ‘visible to employers’ resume and contact details . . . when you upload your resume with the standard, default search options enabled”).

[29] FlexJobs, Terms of Use § 11 (last updated Jan. 16, 2025), https://www.flexjobs.com/termsofuse.aspx. FlexJobs’ privacy policy states, by contrast, that a subscriber’s profile “is completely hidden from the public, and only Employers who are logged in will be able to search your entire resume profile.” FlexJobs, Privacy Policy, supra note 19. The two documents agree that employers may search the resume and disagree about who else may.

[30] Indeed, Privacy Policy, supra note 1; Indeed, Privacy FAQ, https://www.indeed.com/legal/privacyfaq (answering “How do I change my profile privacy settings?”).

[31] Incogni, supra note 4, at 2 (reporting that “[a]lmost 50% of respondents indicated that they either don’t read or merely skim through the privacy policies”).

[32] Indeed, Your U.S. Privacy Rights, supra note 3 (stating that “[i]n order to opt out of the transfer of data to Indeed’s affiliates from Indeed, a personal data deletion request is required”); SimplyHired, Do Not Sell, https://www.simplyhired.com/about/ccpa (listing “We display your public resume to employers and recruiters” and “We recommend your public resume to employers and recruiters” among activities that “may fall under the definition of ‘sell’ or ‘share’ as defined by the CCPA,” and stating the same deletion requirement). SimplyHired has no privacy policy of its own. Its footer states that “SimplyHired is part of the Indeed Site” and links to Indeed’s policy. SimplyHired, https://www.simplyhired.com/.

[33] Fed. Trade Comm’n, A Look Behind the Screens: Examining the Data Practices of Social Media and Video Streaming Services 78-79 (Sept. 2024), https://www.ftc.gov/system/files/ftc_gov/pdf/Social-Media-6b-Report-9-11-2024.pdf; see also id. at vi-vii (summarizing the competition implications).

[34] Id. at vii, 84.

[35] Incogni, supra note 4, at 2, 5.

[36] Recruit Holdings Co., supra note 25 (stating that “Indeed offers a range of products for employers to source, screen, interact with, and interview candidates providing an efficient source of candidates through pay-for-performance and subscription pricing models”).

[37] ZipRecruiter, Inc., Annual Report (Form 10-K), at 10, 23 (Feb. 25, 2026), https://www.sec.gov/Archives/edgar/data/1617553/000161755326000016/zip-20251231.htm.

[38] Microsoft Corp., Annual Report (Form 10-K), at Item 1 (July 29, 2026), https://www.sec.gov/Archives/edgar/data/789019/000119312526323660/msft-20260630.htm.

[39] Jean-Charles Rochet & Jean Tirole, Platform Competition in Two-Sided Markets 1-2 (Inst. d’Économie Industrielle, Working Paper, Dec. 13, 2002), https://www.tse-fr.eu/sites/default/files/medias/doc/wp/2002/platform.pdf (quoting the abstract and introduction), published as 1 J. Eur. Econ. Ass’n 990 (2003). The quotations are from the working paper. The published text may differ in wording.

[40] Thomas Eisenmann, Geoffrey Parker & Marshall W. Van Alstyne, Strategies for Two-Sided Markets, Harv. Bus. Rev., Oct. 2006, at 92, 94-95 (introducing the terms and explaining that “the money side pays more than it would if it were viewed as an independent market”).

[41] David S. Evans & Richard Schmalensee, Ignoring Two-Sided Business Reality Can Also Hurt Plaintiffs, CPI Antitrust Chron., Apr. 2018, at 4, https://www.competitionpolicyinternational.com/wp-content/uploads/2018/04/CPI-Evans-Schmalensee.pdf.

[42] Incogni, supra note 4, at 2, 4, 6 (reporting the comfort, employer-only belief, reading, readability, and reading-time findings).

[43] FTC v. Meta Platforms, Inc., No. 20-cv-3590 (JEB), slip op. at 26, 34 (D.D.C. Nov. 18, 2025) (Boasberg, C.J.), https://storage.courtlistener.com/recap/gov.uscourts.dcd.224921/gov.uscourts.dcd.224921.693.0_1.pdf (rejecting the quality-adjusted price theory on the trial record and entering judgment for Meta), appeal docketed, No. 26-5028 (D.C. Cir. Jan. 20, 2026). At the pleading stage the court had accepted the theory, noting the FTC’s allegation that Meta “provide[d] lower levels of service quality on privacy and data protection than it would have to provide in a competitive market.” FTC v. Facebook, Inc., 581 F. Supp. 3d 34, 55 (D.D.C. 2022) (denying the motion to dismiss the amended complaint and accepting as plausible the allegation that consumers “would prefer services that offered fewer ads or different ad frameworks”).

[44] Case C-252/21, Meta Platforms Inc. v. Bundeskartellamt, ECLI:EU:C:2023:537, ¶¶ 47, 51 (July 4, 2023) (holding that a national competition authority may find GDPR non-compliance in the course of establishing an abuse of dominance, subject to cooperation with data protection authorities).

[45] Ohio v. Am. Express Co., 585 U.S. 529, 535 (2018).

[46] Id. at 544-47 (explaining that transaction platforms “facilitate a single, simultaneous transaction between participants” and that “courts must include both sides of the platform” when defining the market).

[47] Id. at 547 (holding that the plaintiffs “failed to do so”).

[48] Id. at 544-45 (citing Times-Picayune Publ’g Co. v. United States, 345 U.S. 594, 610 (1953)). The Court added in a footnote that “[n]ontransaction platforms, by contrast, often do compete with companies that do not operate on both sides of their platform,” giving the example of a newspaper competing with a television network for advertising. Id. at 546 n.9.

[49] Times-Picayune Publ’g Co. v. United States, 345 U.S. 594, 610 (1953) (holding that the newspaper’s dominance in the advertising market, “not in readership, must be decisive in gauging the legality” of its unit advertising plan).

[50] Ioana Marinescu & Ronald Wolthoff, Opening the Black Box of the Matching Function: The Power of Words 5 (Nat’l Bureau of Econ. Rsch., Working Paper No. 22508, 2016), https://www.nber.org/system/files/working_papers/w22508/w22508.pdf (describing CareerBuilder’s pricing); see also David H. Autor, The Economics of Labor Market Intermediation: An Analytic Framework 3 (Nat’l Bureau of Econ. Rsch., Working Paper No. 14348, 2008), https://www.nber.org/system/files/working_papers/w14348/w14348.pdf (observing that large job boards “increasingly provide an outsourced personnel recruitment function for large employers”).

[51] PLS.com, LLC v. Nat’l Ass’n of Realtors, 32 F.4th 824, 838-39 (9th Cir. 2022) (reversing dismissal of a Section 1 claim against real estate listing networks and leaving open whether Amex is limited to transaction platforms); accord Epic Games, Inc. v. Apple, Inc., 67 F.4th 946, 985 (9th Cir. 2023) (rejecting Apple’s argument that Amex required proof of harm to both developers and users), cert. denied, 144 S. Ct. 681 (2024).

[52] FTC v. Surescripts, LLC, 424 F. Supp. 3d 92 (D.D.C. 2020) (reasoning that Amex “concerned an alleged restraint of trade in violation of Section 1” by a defendant that “was not a monopolist” and did not control the exclusionary-conduct inquiry under Section 2).

[53] Indeed, Your U.S. Privacy Rights, supra note 3 (stating also that “[a]t this time, we are not able to provide our core products and services without transferring some data to Indeed’s affiliates”).

[54] U.S. Dep’t of Just. & Fed. Trade Comm’n, Merger Guidelines 24-25 (Dec. 18, 2023), https://www.justice.gov/d9/2023-12/2023%20Merger%20Guidelines.pdf (defining a platform operator’s “conflict of interest” and stating that the agencies “carefully examine whether the merger would create conflicts of interest that would harm competition”).

[55] The California Attorney General’s list of privacy enforcement actions for 2024 through 2026 and the California Privacy Protection Agency’s announced decisions include no action against a job board or recruiting platform. Cal. Dep’t of Just., Privacy Enforcement Actions, https://oag.ca.gov/privacy/privacy-enforcement-actions; Cal. Privacy Prot. Agency, Announcements, https://cppa.ca.gov/announcements/. In April 2026 the Agency invited preliminary comments on notices to job applicants and employees, asking among other things “[w]hat else should CalPrivacy consider regarding CCPA requirements for job applicants and workers in the employment lifecycle.” Cal. Privacy Prot. Agency, Invitation for Preliminary Comments: Notices & Disclosures and Employee Data (Apr. 2026), https://cppa.ca.gov/regulations/pdf/notices_disclosures_employee_data.pdf.