California residents have specific legal rights under CCPA and CPRA to access, delete, correct, and limit use of their personal data held by Affirm, and to opt out of having their data sold or shared with third parties.
This analysis describes what Affirm's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
These rights give California residents meaningful control over their financial and behavioral data at Affirm, including the ability to stop data sharing for marketing purposes.
Interpretive note: The interaction between GLBA's partial CCPA exemption and CPRA's expanded rights means the practical scope of available rights for specific data categories depends on legal mapping that the policy does not fully resolve.
California residents can request access to or deletion of their personal information and opt out of data sharing for advertising purposes by using Affirm's privacy request portal, providing concrete control over how their data is used.
How other platforms handle this
If you are a California resident, you may have certain rights under the California Consumer Privacy Act (CCPA). These rights may include: the right to know about personal information collected, disclosed, or sold; the right to delete personal information collected from you; the right to opt-out of t...
If you are a California resident, you have the right to know what personal information we collect, use, disclose, and sell about you. You have the right to request deletion of your personal information, subject to certain exceptions. You have the right to opt out of the sale or sharing of your perso...
If you are a California resident, you have the right to know what personal information we collect about you, the right to delete personal information we have collected from you, the right to correct inaccurate personal information, the right to opt out of the sale or sharing of your personal informa...
Monitoring
Affirm has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"If you are a California resident, you have the right to know what personal information we collect, use, disclose, and sell; the right to delete personal information we have collected from you; the right to opt-out of the sale or sharing of your personal information; the right to correct inaccurate personal information; and the right to limit the use and disclosure of sensitive personal information.— Excerpt from Affirm's Affirm Privacy Policy
REGULATORY LANDSCAPE: This provision reflects obligations under the California Consumer Privacy Act as amended by CPRA, enforced by the California Privacy Protection Agency and the California AG. The rights enumerated include access, deletion, correction, opt-out of sale and sharing, and sensitive data limitation, all of which have specific implementation requirements under CCPA regulations. GLBA provides a partial exemption for certain financial data processing, but CPRA's scope may extend to data uses beyond GLBA's coverage, creating a layered compliance obligation. GOVERNANCE EXPOSURE: Medium. The interaction between GLBA's partial CCPA exemption and CPRA's expanded rights for non-GLBA-covered data uses requires careful legal mapping to ensure the correct rights are offered for each data category. Failure to implement functional opt-out of sharing or sensitive data limitation mechanisms exposes Affirm to CPPA enforcement. JURISDICTION FLAGS: Applies specifically to California residents. Other U.S. states with comprehensive privacy laws (Colorado, Virginia, Connecticut, Texas, Montana, and others) have analogous rights frameworks that may require similar mechanisms for residents of those states, with varying scope and enforcement contexts. The policy should be evaluated for whether it adequately addresses multi-state rights obligations. CONTRACT AND VENDOR IMPLICATIONS: Affirm's service providers and contractors must operate under CCPA-compliant data processing agreements that restrict use of personal information to specified business purposes and support consumer rights request fulfillment, including deletion and correction propagation to downstream processors. COMPLIANCE CONSIDERATIONS: Compliance teams should verify that all five CPRA rights (know, delete, correct, opt-out of sale and sharing, limit sensitive data) are implemented with functional mechanisms, that response timelines meet the 45-day CCPA requirement, that the GLBA exemption scope is correctly applied so that non-exempt data uses are covered by CCPA rights, and that annual consumer rights request metrics are tracked for CPRA reporting obligations.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
These rights give California residents meaningful control over their financial and behavioral data at Affirm, including the ability to stop data sharing for marketing purposes.
California residents can request access to or deletion of their personal information and opt out of data sharing for advertising purposes by using Affirm's privacy request portal, providing concrete control over how their data is used.
ConductAtlas has identified this type of provision across 15 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Affirm.