Gusto updated its Privacy Policy effective June 1, 2026, to clarify scope and expand disclosure of data collection practices. The policy now explicitly covers retirement accounts (401k and SEP IRA/IRA accounts), restructures how it describes data processing across different roles (service provider, employer, co-employer), adds Stripe as a third-party financial data collector alongside Plaid, and introduces a commitment to maintain de-identified data without re-identification. These changes establish clearer boundaries between when the Privacy Notice applies versus when separate notices govern, and specify new service providers users should be aware of.
Consumers: If you connect your bank through Stripe, your data goes to Stripe and is governed by Stripe's rules, not just Gusto's.
Consumers: Gusto's privacy disclosures now explicitly govern how your retirement account data is handled.
Data controllers (Gusto customers): Gusto promises not to try to re-identify data it has de-identified, except when law requires it.
The updated Privacy Policy now explicitly states it covers retirement account management (401k, SEP IRA, IRA accounts) and adds Stripe alongside Plaid as a third-party service provider that collects financial institution data. The policy restructures how it describes Gusto's role in different contexts: when Gusto acts as a service provider processing payroll or other data on behalf of employers, when it acts as an employer itself, or when it operates as a co-employer under a professional organization (PEO) arrangement, with separate privacy notices applying in each case. The policy introduces a new commitment that de-identified data will not be re-identified except to verify compliance with applicable law. If you connect a bank account through Stripe, that data will be treated under Stripe's Privacy Policy, which you should review separately.
→ Review Stripe's Privacy Policy if you connect a bank account through Gusto, as your financial data will be governed by Stripe's terms.
→ If you are a PEO participant, request and review the separate privacy notices referenced as applicable to your arrangement.
Explicitly includes 401(k) and SEP IRA/IRA account access and use as covered interactions, broadening the Privacy Notice's application.
Stripe is added as a named financial data collector alongside Plaid, with users' acknowledgment required that Stripe's Privacy Policy governs that data.
Restructures disclosure by Gusto role (service provider, employer, co-employer) and explicitly references separate notices (DPA, Applicant Notice) as applicable in each context.
This change record describes what was added, removed, or modified in the document. Analysis reflects what the updated agreement states or permits. It does not constitute a legal determination about enforceability. Applicability may vary by jurisdiction. Methodology
Gusto expanded the scope of its Privacy Notice to explicitly cover retirement account administration and added Stripe as a named third-party financial data processor. The policy restructures disclosure of Gusto's data processing roles (service provider, …
Regulatory exposure, obligation change, escalation trigger, board-ready language, and recommended action for legal and compliance teams.
Unlock the full institutional analysis — InsightConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-C-002532.
Gusto's updated privacy policy adds explicit language describing how the company sells or shares personal information under U.S. state privacy …
The diff provided shows only a truncated list of linked terms and documents, not substantive policy language. The BEFORE and …
The provided diff shows only truncated header/table-of-contents text from Gusto's Terms of Service and does not reveal the specific substantive …
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Get alerted when this policy changes again, including what changed and why it matters.