Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy authorizes sharing of user personal information with service providers, business partners, advertising partners, and analytics providers, with advertising partners specifically described as receiving information to deliver targeted advertisements.
This analysis describes what Acorns's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes disclosure of personal information, which may include financial account data, device identifiers, and behavioral data, to advertising partners for targeted advertising purposes, a practice that may constitute sale or sharing under CCPA and that engages GLBA's restrictions on sharing nonpublic personal information with nonaffiliated third parties.
Interpretive note: Whether specific categories of financial data are included in advertising partner sharing is not fully specified in the reviewed excerpt, and the GLBA versus CCPA treatment of particular sharing arrangements depends on entity classification and the nature of the information shared.
The updated policy removes explicit language describing how data flows when users sign in via Apple or Google, including what information those services share with Acorns and how it is used. Previously, the policy stated that Acorns receives information such as name and email address through third-party sign-in services solely to manage accounts and provide services. The revised language also shifts the AI chatbot from an optional feature users 'may access' to a stated service Acorns 'uses' to direct users to internal articles. Users no longer have a published explanation of third-party sign-in data practices in the privacy notice, though the terms suggest data shared through third-party services remains subject to those providers' terms.
View change record →Removed language explicitly allowing sharing 'for their own marketing purposes,' added clarification that partners assist in providing services/advertisements, and introduced 'service providers' and 'business partners' categories.
View full change record →Under this provision, Acorns may share personal information with advertising partners for targeted advertising and with analytics providers for usage analysis. The agreement does not in this provision specify which categories of personal information are shared with advertising partners, and the distinction between service providers and third parties under CCPA, which determines opt-out rights, is not fully delineated in this clause.
How other platforms handle this
The right to know with whom we have shared your Personal Data, for what purposes, and what Personal Data has been shared (including whether Personal Data was disclosed to third parties for their own direct marketing purposes)
If GitHub detects the GPC signal from your device, GitHub will not share your data (we do not sell your data).
If you choose to reveal any personal information about yourself to other users, you do so at your own risk. We strongly encourage you to use caution in disclosing any personal information online.
Monitoring
Acorns has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"We may share your information with third parties, including: service providers that perform services on our behalf; business partners, including companies that offer products or services in conjunction with our Services; advertising partners that assist us in delivering relevant advertisements to you; and analytics providers that help us understand how our Services are used.Excerpt from Acorns's Privacy Policy
1) REGULATORY LANDSCAPE: Sharing personal information with advertising and analytics partners engages CCPA's opt-out-of-sale and opt-out-of-sharing for cross-context behavioral advertising provisions, enforced by the California Privacy Protection Agency and California Attorney General. Under GLBA, sharing nonpublic personal information with nonaffiliated third parties for marketing purposes requires a prior opt-out opportunity to be provided to consumers; whether advertising partners qualify as nonaffiliated third parties under GLBA requires entity-specific assessment. FTC Act standards apply to accuracy and completeness of disclosures about third-party data sharing. 2) GOVERNANCE EXPOSURE: High. Sharing financial services consumer data with advertising partners creates concurrent obligations under both GLBA and CCPA, which have overlapping but distinct opt-out frameworks. Failure to provide GLBA-compliant opt-out notices before sharing with advertising partners, or failure to honor CCPA opt-out-of-sharing requests, represents material regulatory exposure. 3) JURISDICTION FLAGS: California residents have an operative right to opt out of sharing for cross-context behavioral advertising under CPRA, independent of whether sharing constitutes a sale. Businesses subject to GLBA must provide annual privacy notices and opt-out opportunities before sharing nonpublic personal information with nonaffiliated third parties for marketing. 4) CONTRACT AND VENDOR IMPLICATIONS: Data sharing agreements with advertising and analytics partners should be reviewed to confirm whether those partners are structured as service providers with contractual use restrictions or as independent third parties, as this classification determines CCPA obligations and GLBA treatment. Agreements should include provisions restricting advertising partners from using received data for purposes beyond those disclosed in the privacy policy. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should confirm that GLBA privacy notices and opt-out mechanisms are current and that advertising partner sharing is within the scope of disclosed and properly noticed information sharing categories. CCPA opt-out-of-sharing mechanisms should be tested for functionality, and Global Privacy Control signal honoring should be verified for California users.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision authorizes disclosure of personal information, which may include financial account data, device identifiers, and behavioral data, to advertising partners for targeted advertising purposes, a practice that may constitute sale or sharing under CCPA and that engages GLBA's restrictions on sharing nonpublic personal information with nonaffiliated third parties.
Under this provision, Acorns may share personal information with advertising partners for targeted advertising and with analytics providers for usage analysis. The agreement does not in this provision specify which categories of personal information are shared with advertising partners, and the distinction between service providers and third parties under CCPA, which determines opt-out rights, is not fully delineated in this …
ConductAtlas has identified this type of provision across 295 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Acorns.