Global Privacy Notice

Last Modified: October 30, 2024  

As the leading provider of information, analytics, and online marketplaces to the commercial real estate industry, CoStar Realty Information, Inc. and our affiliates (collectively, “CoStar,” “we,” or “us”) respect your privacy and are committed to protecting your Personal Information (defined below). This Global Privacy Notice describes the types of Personal Information we collect and our practices for using, maintaining, sharing, and protecting it. It also describes the rights and choices you may have with respect to your Personal Information and how you may contact us about our privacy practices. Our privacy practices may vary among the countries in which we operate to reflect local practices and legal requirements, and specific privacy practices may apply to some of our products and services. By using our products and services, you consent to the collection, storage, use, and disclosure of your Personal Information as described in this Global Privacy Notice.

This Global Privacy Notice applies to the CoStar Marketplaces (defined below), CoStar Products (defined below), and any associated websites, products, services, mobile applications, or other websites or applications which we currently own, or in the future may own or control, to which this Global Privacy Notice is posted (collectively, “Services”).

CoStar Marketplaces:

CoStar Products:

If you are a current or former CoStar job applicant, employee, owner, director, officer, or contractor, please Contact Us for the appropriate privacy policy that describes our collection, use, and disclosure of your personal information.

When using our Services, you may choose to interact with features from third parties that operate independently from CoStar, such as social media widgets and links to third-party websites. CoStar has no control over and is not responsible for the privacy practices of such third parties. This Global Privacy Notice does not apply to the extent CoStar does not own or control any linked websites or features you visit or use. We recommend that you familiarize yourself with the privacy practices of these third parties.

Children Under 16

CoStar Services are not intended for children under 16 years of age, and we do not knowingly collect Personal Information from children under 16. If you are under 16, do not use or provide any information on the Services, register, or make any purchases. If we learn we have collected or received Personal Information from a child under 16 without verification of parental consent, we will delete it. If you believe we might have any information from or about a child under 16, please Contact Us.

Table of Contents

1. Types of Personal Information
2. Collection of Personal Information
3. Use of Personal Information
4. Disclosure of Personal Information
5. International Transfer of Personal Information
6. Security of Personal Information
7. Retention of Personal Information
8. Manage Your Personal Information
9. Jurisdiction Specific Notices
10. Global Policy Notice Changes
11. Contact Us

1. Types of Personal Information

“Personal Information” means any information directly or indirectly relating to an identified or identifiable individual. Personal Information may not include de-identified or aggregate information, certain publicly available information, or information covered by other legal frameworks.

Additionally, we may collect any other information that you choose to share with us on the Services. We may use this information and the other information identified in the above table to draw inferences about you regarding your preferences, characteristics, or behavior.

Biometric and Geolocation Information

Some areas of CoStar Products may require or request you to opt-in to CoStar collecting photos, facial geometry, and geolocation information from you when you log in to certain CoStar Products. We use geolocation information to provide you with relevant information that you have requested, such as local searches for rental properties and corresponding maps or directions. If you don’t want to use these location-based features, you can turn off or disable location services on your device or browser. We also use this information to authenticate you as the user of such CoStar Products, maintain a secure session, and detect potential abuse and fraudulent use of the CoStar Products. For example, CoStar may scan and analyze a photo you submit to us through the use of your device’s camera to confirm your identity for security purposes each time you access the CoStar Products. CoStar does this by using facial recognition technology to compare your photo to the most recent photo uploaded to your account. CoStar will securely store this information on servers located in the United States, and this information will only be accessed by authorized CoStar employees. We will retain biometric information until the initial purpose for collecting or obtaining such information has been satisfied or within three years, whichever occurs first. If you have questions regarding CoStar’s use of biometric or geolocation information, please Contact Us.

2. Collection of Personal Information

CoStar may collect Personal Information using the following methods:

• Directly from you when you provide it to us, or to others through the Services. This includes information you enter into web forms or chatbots, information you provide in phone calls, video conferences, subscription agreements, and contracts or other content you submit to the Services.
• Through your participation in conferences, research, focus groups, surveys, promotions, and contests, whether operated by us or our vendors or business partners.
• From references or sources that you provide or are publicly available online or in other formats, such as brochures, property listings, public records, or industry groups. In addition to sources you may provide, this includes parties such as other property owners, tenants, landlords, agents, managers, or developers.
• From third-party vendors including data analytics and email marketing service providers.
• From researching public websites where permitted by the website Terms of Use. For example, this may include company websites, search engines, news websites, and social media platforms.
• Automatically through tracking technologies (such as cookies, web beacons, or log files), including over time and across third-party websites or other online services.

For more information about how we use Personal Information collected through tracking technologies and the ways you may be able to manage it, see Use of Personal Information, our Cookie Policy, and Manage Your Personal Information.

3. Use of Personal Information

We may use your Personal Information for the following purposes:

• Communicating with you.
• Providing you with or otherwise facilitating the Services, or specific products or services requested through the Services.
• Authenticating use, detecting potential fraudulent use, and otherwise maintaining the security of the Services.
• Developing, testing, improving, and demonstrating the Services.
• Creating and maintaining a customer relationship management system, member directories, and invitation lists for CoStar events.
• Carrying out our legal and contractual obligations and enforcing our rights, including tax preparation, billing and payment processing.
• Anonymizing and aggregating information for analytics and reporting.
• Advertising, marketing, and selling the Services, including linking together or merging Personal Information with other Personal Information so that we may better understand your needs and inform you about our Services and those of our partners.
• Administering, registering, or enrolling you in, or facilitating your participation in recreational, educational, or entertainment activities; surveys or questionnaires; promotions or sweepstakes, or any other services, events, or activities sponsored by us or third parties, or offered in connection with our Services.
• Sending you prizes and gifts.
• Short-term transient use, as defined in the California Consumer Privacy Act.
• Training and quality assurance.
• For any other purpose with your consent.

Online Advertising

When you use the Services, we and third parties may use cookies and other tracking technologies to collect information, including Personal Information, to help us target content to you on the Services or elsewhere. This information may be associated with other information or combined with information from other sources, including information these third parties might track about your online activities over time and across the Internet. Third parties use this information to provide interest-based advertising and retargeting on our behalf, which may include placing our advertisements on other websites you visit, including your social media accounts, or matching a cookie or device ID to your email address so we can send you promotional emails that may be of interest to you.

To make informed choices about targeted advertising, see Manage Your Personal Information.

Automated Decision-Making

We may use an automated process to identify properties that may be of particular interest to you and to bring these to your attention. We may do this by profiling your activity when using the Services. This profiling takes place based on properties you browse, searches you conduct, and your location. It helps us to understand what sort of properties you are interested in and to categorize your activity to help us determine the Services that may be best suited to your needs.

4. Disclosure of Personal Information

We may disclose Personal Information:

• To affiliates and other entities within CoStar’s group of companies, business or distribution partners, and service providers.
• To other CoStar customers or subscribers to the Services, such as the listing agent when you visit their profile page, indicate an interest in a particular listing, or submit a bid or request for more information.
• To other CoStar customers or subscribers within the context of any directories or inventories we may provide on the Services or that you opt into.
• To other CoStar customers or subscribers within the Services within the context of our content sharing or messaging features, or other community forum or pages offered through the Services. Please exercise caution when sharing or posting within our Services, and do not include information that you do not wish to make public.
• To third parties with whom you choose to share content on the Services or otherwise refer to our Services, for example, through our “Email a Listing to Friend” feature or similar features.
• With background check providers and/or consumer credit reporting agencies.
• To third parties when you use a third-party feature in our Services. This may include social media networks when you share content through those networks or use a social media account to log in to our Services.
• To enforce or apply our Terms of Use and other agreements or comply with any court order, law, or legal process, including government or regulatory requests.
• To a buyer or other successor in the evaluation and/or event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of CoStar’s assets.
• To advisors, consultants, auditors, or similar professionals to assess our business, financial, and legal obligations, or operations.
• If we believe it is necessary to protect the rights, property, or safety of CoStar or others.
• For any other purpose disclosed by us when you provide Personal Information.
• With your consent, such as when you choose to provide your information to third parties.

Third Parties for Business Support

CoStar discloses your Personal Information to third parties to assist us in our business. For example, we use vendors and third-party firms to assist with data analytics, email marketing, payment processing, customer relationship management, and IT infrastructure and support.

5. International Transfer of Personal Information

CoStar is a global business. We may transfer your Personal Information to the United States, where we are headquartered, and to other countries which may not have the same privacy laws as the country in which you initially provided the information, but we will protect your Personal Information in accordance with this Global Privacy Notice, or as otherwise disclosed to you.

6. Security of Personal Information

CoStar implements security safeguards to protect your Personal Information.

We take steps to secure Personal Information through administrative, technical and physical safeguards designed to protect against the risk of accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure, or use. For example, we encrypt payment card information in accordance with the Payment Card Industry Data Security Standard (PCI DSS) and store sensitive information such as geolocation data on CoStar servers located in the United States with access limited to authorized CoStar employees.

Unfortunately, we cannot guarantee the security of information transmitted through the Internet, and where we have given you (or where you have chosen) a password, you are responsible for keeping this password confidential.

CoStar has designated a Cybersecurity Team to investigate and respond to all security issues and vulnerabilities regarding its offerings. You can contact this team at: CoStarSecurity1@costar.com.

7. Retention of Personal Information

CoStar will retain your information only for as long as is reasonably necessary for the purposes set out on this Global Privacy Notice, for as long as your account is active (i.e., for the lifetime of your CoStar customer account), or as needed to provide the Services to you. If you no longer want CoStar to use your information to provide the Services to you, you may close your account. CoStar will retain and use your information to the extent necessary to comply with our legal obligations, resolve disputes, enforce our agreements, and as otherwise described in this Global Privacy Notice. Please note that closing an account may not make your email address, username, or property name (if any) available for reuse on a new account. We also retain log files for internal analysis purposes. These log files are retained for a brief period of time, except in cases where they are used to protect the safety and security of the Services, to maintain and improve functionality of the Services, or to comply with legal obligations.

8. Manage Your Personal Information

You may manage your Personal Information by making certain choices. If you believe that any Personal Information you have provided to us is out-of-date or inaccurate, you may review and correct such information if it is within your online account by logging in at any time or Contact Us. You may also have additional rights detailed below depending on where you live. As a security precaution, we may need to request information from you to help us confirm your identity when exercising a right related to your Personal Information. When you use the Services, you agree to receive direct mail, email newsletters and other promotional email communications, as well as promotional telephone communications.

Direct Marketing Opt-Out

If you no longer wish to receive direct marketing emails from CoStar, you may click the “Unsubscribe” link in an email at any time to stop receiving emails for that particular subject. Depending on the Services, you may also be able to manage notification preferences in your account. Note that CoStar may still contact you about the Terms of Use, Global Privacy Notice, or other legal notices, or in connection with providing you Services you have requested from us.

Tracking/Online Advertising Opt-Out

You may disable or delete browser cookies through your browser settings. Cookies are generally easy to disable or delete, but the method varies between browsers. To learn how you can manage Flash cookies, visit Adobe’s Flash player settings page.. If you disable or delete cookies, or if you are running third-party software that intercepts or deletes cookies, please note that some parts of our websites may not work properly.

You can opt out of third parties collecting your Personal Information for targeted advertising purposes in the United States or Canada by visiting the National Advertising Initiative’s (NAI) opt-out page and the Digital Advertising Alliance’s (DAA) opt-out page and in the European Economic Area (EEA) by visiting the Programme’s opt-out page.

Our Services do not recognize “Do Not Track” signals.

Exercising Your Rights

To make a request, please Contact Us by email, call us toll-free at (800) 204-5960, or submit the request through your CoStar account or our rights request web form . In order to verify your request, CoStar may require you to provide additional information to confirm your identity.

For requests related to erasure, restriction of processing, termination of consent to processing, or objection to processing, all further user data collection will stop once a request is verified.

Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your Personal Information. To make a request on your behalf, an authorized agent may Contact Us by email with proof of your written and signed permission to do so. Note that CoStar may also require you to verify your identity and confirm that you gave permission.

9. Jurisdiction Specific Notices

9.1 Additional Notice to California Residents

We collect the Personal Information identified in the table in Section 1 (“Types of Personal Information”), which falls into the following categories of Personal Information according to the California Consumer Privacy Act:

• Identifiers
• Categories of Personal Information described in California Civil Code § 1798.80(e)
• Characteristics of protected classifications under state or federal law
• Commercial information
• Audio and visual information
• Internet or other electronic network activity information
• Geolocation data
• Professional or employment-related information
• Inferences drawn from other Personal Information (e.g., profile reflecting your preferences, characteristics, and behavior)
• Sensitive personal information, including: precise geolocation, biometric information, login credentials (username and password), and the content of messages sent through the Services

As described in more detail in Section 2 (“Collection of Personal Information”), CoStar collects Personal Information from the following categories of sources:

• Directly and indirectly from you
• Other CoStar customers
• Service providers, including data analytics providers
• Third parties, including advertising services and social media networks
• Consumer reporting agencies
• Companies with public websites
• Government entities

CoStar discloses the following categories of Personal Information for the business or commercial purposes identified above in Section 3 (“Use of Personal Information”) and Section 4 (“Disclosure of Personal Information”) with the following categories of third parties in the 12 months preceding the date this Global Privacy notice was last modified:

CoStar may also “sell” or “share” certain Personal Information. In the 12 months preceding the date this Global Privacy Notice was last modified, CoStar sold or shared:

• Identifiers (e.g., IP address and other online identifiers), categories of Personal Information described in California Civil Code § 1798.80(e), geolocation, Internet or other electronic network activity information, and commercial information (e.g., purchasing tendencies or records of products or services purchased or considered) to advertising providers for the purpose of advertising our Services. We may also “sell” these categories to other CoStar customers or subscribers so that they may contact you about properties or services you may be interested in.
• For CoStar Products: Identifiers (e.g., name, email address), categories of personal information described in California Civil Code §1798.80(e) (e.g., phone number), and professional information (e.g., name, title, email address, business address) to other CoStar customers or subscribers for the purpose of making business contact information available through the Professional Directory or similar features in CoStar Products.

If you are a resident of California, you have the right to: (1) request that CoStar disclose what Personal Information we collect, use, disclose, and sell; (2) request deletion of Personal Information, subject to certain exceptions; (3) request that CoStar correct inaccurate or incomplete Personal Information; (4) opt-out of the sale of Personal Information; (5) opt-out of the “sharing,” or disclosing Personal Information for the purposes of cross-context behavioral advertising, and (6) not receive discriminatory treatment by CoStar for exercising these rights.

Requests to Know

You have the right to request that we disclose the following information:

• Specific pieces of Personal Information CoStar has collected about you;
• Categories of Personal Information CoStar has collected about you, disclosed about you for a business purpose, or sold;
• Categories of sources from which the Personal Information is collected;
• Categories of third parties with whom CoStar shares or to whom CoStar sells Personal Information; and
• The business or commercial purpose for collecting, selling, and sharing Personal Information.

Opt-Out of the Sale or Sharing of Personal Information

You have the right to opt-out of the sale of your Personal Information. To make such a request, please Contact Us by email or visit Do Not Sell My Personal Information. To opt-out of CoStar sharing your Personal Information with third parties to advertise our Services, please additionally manage Tracking/Online Advertising Opt-Out privacy controls.

Please click here for statistics relating to California Consumer Privacy Act requests received by CoStar brands under this Global Privacy Notice in the prior calendar year.

We do not have actual knowledge that we sell or share the Personal Information of consumers under the age of 16.

We do not use or disclose sensitive personal information for purposes other than those specified in Cal. Civ Code § 1798.121.

Exercising Your Rights

To make such a request, please follow the instructions in Section 8 Exercising Your Rights above.

“Shine the Light” Request

California residents may also have the right to request certain information regarding our disclosure of Personal Information to third parties for their direct marketing purposes. To make such a request, please Contact Us.

9.2 Additional Notice to Certain Other U.S. Residents

If you are a resident of certain U.S. States, you may have some or all of the following rights. Specifically, these states include Nevada, Virginia, Colorado, Connecticut, Utah, and Iowa. These rights are based on verifiable residency status, and CoStar reserves the right to honor your request to exercise these rights based on your residency. You may have the right to request the following: (1) that CoStar disclose and provide a copy of what Personal Information we collect, use, disclose, and sell; (2) that CoStar delete your Personal Information, subject to certain exceptions; (3) that CoStar correct inaccurate or incomplete Personal Information; (4) opt-out of the sale of Personal Information; (5) opt-out of targeted advertising; (6) opt out of profiling in furtherance of decisions that produce legal or similarly significant effects about you, and (7) not receive discriminatory treatment by CoStar for exercising these rights.

To make such a request, please follow the instructions in Section 8 Exercising Your Rights above.

If you are appealing our decision, please email us following the instructions in the below section, Contact Us, and reference and/or attach information to identify your original request. In order to verify your request, CoStar may require you to provide additional information to confirm your identity.

9.3 Additional Notice to European Economic Area (EEA) and United Kingdom Residents

Where we need to collect Personal Information by law or under the terms of a contract we have with you and you fail to provide that information when requested, we may not be able to perform the contract we have or are trying to enter into with you. In this case, we may have to cancel a product or service you have with us but will notify you first.

We rely on the following lawful bases to process your Personal Information for these non-exhaustive purposes:

Consent

We may obtain your consent to process your Personal Information in certain circumstances, which may include when we send you relevant marketing, you elect to receive information from us, or you Contact Us to register an interest in our Services or company. We may also rely upon our legitimate interest in developing our business as a basis for sending you marketing information and information about our Services (see below).

Performance of a Contract

We rely on this lawful processing ground when we process your Personal Information to perform a contract which we have with you, or when we take steps in anticipation of entering into a contract with you, for example in connection within the provision of our Services to you and the management of our relationships with third parties.

Compliance with a Legal Obligation

We rely on this lawful processing ground when we process your Personal Information to meet legal and regulatory obligations which apply to us.

Legitimate Interests

We rely on this lawful processing ground when we process your Personal Information to provide our Services, to respond to specific requests, to manage our business operations, to manage our relationships with you and with third parties in connection with our business, and when we provide you with marketing information or other information in relation to our Services which we believe may interest you.

If you wish to have more information regarding the legitimate interests assessments we have conducted in order to reach these conclusions, please Contact Us.

For information about how users based in the EEA and United Kingdom can object to our automated decision-making, see Manage Your Personal Information. For more information, please Contact Us.

If you live in the EEA or United Kingdom, we may transfer Personal Information Types of Personal information to countries for which adequacy decisions have been issued, use contractual protections for the transfer of Personal Information to third parties, such as an intra-company agreement or the European Commission’s Standard Contractual Clauses or their equivalent under applicable law.

You may Contact Us to obtain a copy of the safeguards we use to transfer Personal Information outside of the EEA or United Kingdom.

If you live in the EEA or United Kingdom, you may have the right to (1) request access to, rectification, or erasure of your Personal Information or restrict the processing of your Personal Information; (2) object to processing; (3) data portability (receive and transfer your Personal Information); (4) lodge a complaint with a supervisory authority; and, (5) where processing of your Personal Information is based on consent, withdraw your consent at any time without affecting the lawfulness of the processing of Personal Information that occurred before you withdraw consent.

To make such a request, please follow the instructions in Section 8 Exercising Your Rights above.

9.4 Additional Notice to Canada Residents

We may use service providers located outside of Canada, including, without limitation, in the United States of America, to process Personal Information, and may transfer your Personal Information to such service providers for this purpose. When your Personal Information is processed outside of Canada, it will be subject to the laws of the countries where the information is processed and may be accessible to law enforcement and national security authorities of those countries in accordance with their laws.

You may Contact Us to obtain information about our policies and practices regarding the use of service providers located outside of Canada.

If you live in Canada, in addition to the other rights you may have hereunder, you may have the right to (1) request access to, review and to correct inaccuracies or omissions in your Personal Information; (2) to withdraw consent for collection, use or disclosure of, or to request deletion of, your Personal Information (provided that, if you do so, we may no longer be able to provide services to you that rely on such Personal Information); (3) to ask questions about our policies and practices, and to lodge complaints about our compliance with them with us or with regulatory authorities; and (4) for Quebec residents, to request an electronic copy of the Personal Information you have provided to us in a structured and commonly used technological format.

To make such a request, please follow the instructions in Section 8 Exercising Your Rights above.

10. Global Privacy Notice Changes

This Global Privacy Notice may be updated periodically to reflect changes in our privacy practices.

We will post changes on this page and identify the date the privacy notice was last revised at the top of the page. If we make material changes to our privacy practices, we will notify you through a notice on the home page of the websites covered by this Global Privacy Notice. If a material change will apply to Personal Information we have already collected, including any new purposes for which the Personal Information will be used or disclosed to which you have not previously consented, we will additionally seek your affirmative consent.

Contact Us

We have appointed a Data Protection Officer to investigate and respond to privacy issues and to be accountable for our compliance with this Global Privacy Notice. You can contact us, depending on the nature of your inquiry, by using the relevant contact information below.

In order to properly respond to your privacy questions or requests about our services, please email the relevant department outlined below or call the relevant department using the below toll-free numbers:

You may also write to:

CoStar Realty Information, Inc.    
1331 L Street, NW    
Washington, DC 20005    
Attn: Legal Department

European Economic Area (EEA) and United Kingdom Residents

If you are a resident of the EEA or the United Kingdom, CoStar Realty Information, Inc. and its affiliates are the entities responsible for the processing of your Personal Information. In order to properly respond to your privacy questions or requests about our services, please email the relevant department as outlined below:

Email: CoStarUKPrivacy1@costar.co.uk – for Belbex and BureauxLocaux

Email: privacy@onthemarket.com – for OnTheMarket

Email: dpo@businessimmo.fr – for Business Immo

Email: Datenschutz@thomas-daily.de – for Thomas Daily

or write to:

CoStar UK Limited    
26th Floor, The Shard, 32 London Bridge Street,    
London SE1 9SG, United Kingdom

You may also make a complaint to your local data protection authority.