Compliance runs per jurisdiction rather than on a single global policy: GDPR in the EU and UK, CCPA in California, and equivalents elsewhere.
How partner access works
Partner access flows through the platform's compliance controls rather than raw cross-border data dumps. That distinction matters. Handing a label a spreadsheet of EU fan records is the kind of transfer that creates exposure, so access is granted through controls that carry the lawful basis with it.
Consent as the foundation
Consent is captured expressly, per channel, with timestamps and disclosure versions logged. When a regulator or a label's own compliance team asks what a fan agreed to and when, there is a record rather than an assumption.
Set per campaign
The privacy policy and opt-in language are configured per campaign before launch, naming the actual parties involved. Each release also ships its own Terms of Service and Privacy Policy alongside the campaign FAQ.
Controller and processor
Fan privacy requests are honored under the controller and processor structure of the campaign, which is defined during setup rather than improvised when the first request arrives.
What your team should do
Bring your own compliance requirements to kickoff. If your label has specific obligations on data residency, retention, or partner access, those are easier to build into the campaign than to retrofit after launch.