Gusto expanded its privacy notice to explicitly cover 401(k) and SEP IRA/IRA accounts, clarified when the notice does not apply (adding separate guidance for employer and processor contexts), added Stripe as a financial data collection partner alongside Plaid, and introduced a new section on AI-powered features and integrations. The updated terms state that when users enable optional AI integrations, their personal information may be disclosed to third-party AI providers (such as OpenAI), though Gusto commits not to permit those providers to use the data to train their models. The policy also describes how Gusto processes personal information through automated and manual methods when users interact with AI-powered features on the platform.
Consumers: Gusto's privacy practices now cover your retirement account interactions, not just general payroll and HR services.
Consumers: If you turn on AI features, Gusto will tell you that your data goes to third-party AI companies and you need to agree to their privacy policies.
Data controllers: Organizations using Gusto need to be clear in their own privacy documents about whether Gusto is processing data on their behalf or in its own capacity.
The updated privacy notice now explicitly covers retirement account access and use (401(k), SEP IRA, IRA), expanding the scope of activities governed by Gusto's privacy practices. The policy introduces optional AI-powered integrations that, when enabled, may disclose personal information to third-party AI providers such as OpenAI; Gusto states it will not permit these providers to use the data to train their models. The revised terms also clarify when the privacy notice does not apply (when Gusto acts as a processor or service provider) and direct users to the Employer Data Processing Addendum for those scenarios. You can review the specific AI providers and integration options available through your Gusto account settings before enabling any AI features.
→ Review the updated privacy notice to understand how Gusto handles retirement account data and AI integration practices.
→ Before enabling any AI-powered integrations, review the specific third-party provider terms and privacy policies that will apply to your data.
→ If you do not wish to use AI integrations, you can leave them disabled; they are optional features.
Personal information may be disclosed to third-party AI providers when users enable optional integrations; Gusto commits not to permit model training on user data.
Privacy notice now explicitly covers 401(k) and SEP IRA/IRA account access and use, in addition to payroll and HR services.
Privacy notice does not apply when Gusto acts as a processor or service provider; separate notices apply for employer and PEO arrangements.
This change record describes what was added, removed, or modified in the document. Analysis reflects what the updated agreement states or permits. It does not constitute a legal determination about enforceability. Applicability may vary by jurisdiction. Methodology
Wording edits to this record that do not change what it claims. Changes to a claim are published as corrections.
Gusto expanded its privacy notice scope to explicitly cover retirement account products and introduced disclosure of AI integration practices. The change clarifies the distinction between Gusto's role as a data controller (covered by this notice) …
Regulatory exposure, obligation change, escalation trigger, board-ready language, and recommended action for legal and compliance teams.
Unlock the full institutional analysis — InsightConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-X-002532.
Gusto's updated privacy policy now explicitly discloses that it engages in the 'sale' or 'sharing' of personal information as defined …
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
Get alerted when this policy changes again, including what changed and why it matters.