Third-Party Marketing and Analytics Data Sharing

What it is

Acorns may share your personal information with outside companies for advertising and analytics purposes, not just to operate the service you signed up for.

Why it matters (compliance & governance perspective)

Sharing personal and financial data with marketing and advertising networks goes beyond what many consumers expect from a financial services app and may constitute a sale or sharing of personal information under the CPRA, triggering opt-out rights for California residents.

Consumer impact (what this means for users)

Your personal information, which in Acorns' case includes financial behavior and account data, may be shared with advertising networks and analytics firms for marketing purposes unrelated to your investment or banking service.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: Sharing personal data with non-affiliated third parties for marketing purposes implicates GLBA Regulation P, which requires financial institutions to provide opt-out rights before sharing nonpublic personal information with non-affiliated third parties for marketing. Under the CPRA, sharing personal information with third parties for cross-context behavioral advertising constitutes sharing subject to opt-out rights regardless of whether monetary consideration is exchanged. The FTC is the primary enforcement authority for both Regulation P (for non-bank financial companies) and CPRA-adjacent unfair or deceptive practice claims. GOVERNANCE EXPOSURE: High. The combination of sensitive financial data and third-party marketing sharing creates elevated regulatory exposure, particularly under the CPRA's expanded definition of sharing and the GLBA opt-out notice requirements. Regulators have increasingly scrutinized financial data being used for advertising profiling. JURISDICTION FLAGS: California residents have the explicit right under the CPRA to opt out of sharing of personal information for cross-context behavioral advertising. Virginia, Colorado, Connecticut, and Texas residents have analogous rights under their respective state privacy laws. Non-US users are not clearly addressed in the policy, which may create compliance gaps if Acorns serves users in jurisdictions with stricter marketing consent requirements. CONTRACT AND VENDOR IMPLICATIONS: Advertising networks and analytics providers receiving personal data should be subject to data processing agreements that prohibit secondary use of financial data beyond the stated purpose. Teams should confirm that recipient contracts include data use limitations, deletion obligations, and audit rights consistent with GLBA and CPRA requirements. COMPLIANCE CONSIDERATIONS: Compliance teams should audit the current GLBA Regulation P opt-out notice to confirm it clearly identifies all non-affiliated third-party marketing recipients. The CPRA opt-out mechanism for sharing should be reviewed to ensure it is functional, prominent, and covers all data categories shared with advertising networks. A data flow map identifying which data elements flow to which marketing partners is a prerequisite for this review.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Collection of Sensitive Financial and Identity Data medium
• Data Collection from Third-Party Sources Including Data Brokers medium
• Business Transfer Data Disclosure medium
• COPPA and Acorns Early Minor Data Collection high
• California Consumer Privacy Rights medium
• Account Linking and Third-Party Data Aggregator Access medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.