Affirm substantially expanded its Privacy Policy on June 3, 2026, adding over 200 sentences of new disclosure and structural content. The updated policy explicitly identifies Affirm as a financial institution under the Gramm-Leach-Bliley Act, clarifies that certain personal information is governed by federal banking law rather than state privacy laws, and adds detailed sections explaining how Affirm collects, uses, and discloses information, including new disclosures about sharing with fraud prevention and identity verification providers. The previous version lacked this regulatory framing and level of operational detail.
Consumers: Affirm now explicitly lists new third parties it shares data with, which were not previously detailed in the policy.
Consumers: Affirm has added a contact method for privacy requests and clarified that federal law governs certain personal information.
Data controllers integrating Affirm: Organizations relying on Affirm for lending may need to update their own privacy practices to reflect this federal law preemption assertion.
The updated Privacy Policy establishes that Affirm qualifies as a financial institution under the Gramm-Leach-Bliley Act, meaning personal information collected in connection with Affirm services is governed by federal banking law rather than applicable state privacy laws. The policy now explicitly discloses collection of identity and profile information including full name, date of birth, Social Security number, email, mailing address, phone number, and password. The updated terms also disclose new data sharing arrangements with fraud prevention, identity verification, and risk intelligence providers, which were not previously detailed. You can contact Affirm's privacy team using the phone number provided in the updated policy to exercise data privacy rights.
→ Review the updated Privacy Policy, particularly Section 9 ('Affirm's Privacy Notice for Consumer Financial Information') which describes your data rights under federal banking law
→ Contact Affirm's privacy team using the phone number provided in the updated policy if you wish to exercise data subject rights or request information about how your data is shared
Policy now explicitly asserts Affirm is a financial institution under GLBA, with certain data governed exclusively by federal law, not state privacy statutes.
Policy now discloses sharing of personal information with fraud prevention, identity verification, and risk intelligence providers.
Policy now explicitly lists identity and profile information collected, including Social Security numbers, dates of birth, and contact information.
This change record describes what was added, removed, or modified in the document. Analysis reflects what the updated agreement states or permits. It does not constitute a legal determination about enforceability. Applicability may vary by jurisdiction. Methodology
Affirm's Privacy Policy update on June 3, 2026 substantially expands disclosure of data practices, regulatory status, and data sharing arrangements. The policy explicitly asserts that Affirm qualifies as a financial institution under the Gramm-Leach-Bliley Act …
Regulatory exposure, obligation change, escalation trigger, board-ready language, and recommended action for legal and compliance teams.
Unlock the full institutional analysis — InsightConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-C-002632.
Affirm expanded its browser extension data collection disclosures and added Individual Taxpayer Identification Number (ITIN) to the types of personal …
Affirm updated its mailing address for customer service requests across five different procedures in the Terms of Service. The previous …
Affirm updated the marketing language describing its products and features on the privacy policy's app download section. The previous text …
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Get alerted when this policy changes again, including what changed and why it matters.