The policy states that personal information is retained for as long as necessary to provide services, meet legal obligations, resolve disputes, and enforce agreements, and that data will be deleted or anonymized when no longer needed.
This analysis describes what Acorns's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The retention standard stated in this provision is broadly defined by reference to service necessity, legal obligations, dispute resolution, and agreement enforcement, without specifying maximum retention periods for particular data categories, which may create compliance ambiguity under regulations that impose specific retention period requirements or data minimization obligations.
Interpretive note: The policy does not specify retention periods by data category, and whether the stated criteria satisfy CPRA's retention disclosure requirements is a jurisdiction-dependent legal question not resolvable from the document text alone.
The updated policy removes explicit language describing how data flows when users sign in via Apple or Google, including what information those services share with Acorns and how it is used. Previously, the policy stated that Acorns receives information such as name and email address through third-party sign-in services solely to manage accounts and provide services. The revised language also shifts the AI chatbot from an optional feature users 'may access' to a stated service Acorns 'uses' to direct users to internal articles. Users no longer have a published explanation of third-party sign-in data practices in the privacy notice, though the terms suggest data shared through third-party services remains subject to those providers' terms.
View change record →This new provision establishes data retention and deletion standards, providing transparency on how long Acorns keeps personal information.
View full change record →Removal of this provision eliminates explicit disclosure of data retention practices and post-account-closure retention policies, reducing transparency about how long data is maintained.
View full change record →Under these terms, Acorns retains personal information, including financial account data and behavioral data, for an undefined duration tied to service provision, legal compliance, and dispute resolution. No specific maximum retention periods are stated for individual data categories in the reviewed provision.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"We retain your personal information for as long as necessary to provide our Services, comply with our legal obligations, resolve disputes, and enforce our agreements. When we no longer need your personal information, we will take steps to delete or anonymize it.Excerpt from Acorns's Privacy Policy
1) REGULATORY LANDSCAPE: GLBA does not specify universal retention periods but requires reasonable data security practices including controls over data that is no longer needed.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The retention standard stated in this provision is broadly defined by reference to service necessity, legal obligations, dispute resolution, and agreement enforcement, without specifying maximum retention periods for particular data categories, which may create compliance ambiguity under regulations that impose specific retention period requirements or data minimization obligations.
Under these terms, Acorns retains personal information, including financial account data and behavioral data, for an undefined duration tied to service provision, legal compliance, and dispute resolution. No specific maximum retention periods are stated for individual data categories in the reviewed provision.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Acorns.