Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that residents of qualifying U.S. states, including California, have rights to access, delete, and correct their personal data, to opt out of sales or sharing of personal data, and to limit use of sensitive personal information, subject to GLBA exceptions; requests are processed via email to privacy@betterment.com, with data access and portability requests limited to twice per 12-month period.
This analysis describes what Betterment's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the mechanism and frequency limits for consumer data rights requests under state privacy laws, and conditions the exercise of those rights on GLBA exemptions that may reduce the scope of available remedies for financial data categories.
The updated policy discloses a new Fully Paid Securities Lending program through Apex Clearing, under which Betterment will share customer personal information and account details with Apex if customers choose to participate. The revised terms also establish that generative AI service providers have committed that personal information will not be used for model training. For customers participating in promotional offers requiring offline fulfillment, the policy now explicitly states that personal information including mailing address may be shared with third-party partners. You can review the FPSL Program supplemental disclosures for details about the securities lending arrangement, or choose not to participate in the program.
View change record →The agreement states that eligible state residents may submit access, deletion, correction, and opt-out requests by emailing privacy@betterment.com, with identity verification required; access and data portability requests are limited to two per 12-month period, and deletion requests may be denied where GLBA or other legal retention obligations apply.
Cross-platform context
See how other platforms handle Opt-Out Rights Under State Privacy Laws (CCPA/CPRA and Others) and similar clauses.
Compare across platforms →Monitoring
Betterment has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act ('CPRA') of 2020 and other California laws (collectively, the 'CCPA'), this may also include information about employees and employee applicants as well as enterprise data (such as business-to-business). Your privacy choices and rights. Under the State Privacy Laws, you may have the rights to access, delete, and correct your personal data, to opt out of 'sales' or 'shares' of your personal data, and to limit the use and disclosure of your sensitive personal information, subject to certain exceptions under federal law, including the Gramm-Leach-Bliley Act ('GLBA'). To request to exercise any of these rights, please email privacy@betterment.com, including sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative. You may only make a verifiable Data Subject Request for access or data portability twice within a 12-month period.Excerpt from Betterment's Privacy Policy
1) REGULATORY LANDSCAPE: This provision directly implements CCPA as amended by CPRA, including consumer rights to access, delete, correct, and opt out of data sales or sharing. The California Privacy Protection Agency (CPPA) and California Attorney General have enforcement authority. Analogous rights under Colorado CPA, Virginia VCDPA, Connecticut CTDPA, and other enacted state privacy laws are referenced. GLBA exemptions limit the scope of CCPA rights for financial data held by covered financial institutions, but the scope of that exemption is subject to ongoing regulatory interpretation. 2) GOVERNANCE EXPOSURE: Medium. The two-per-12-month cap on data access and portability requests is consistent with CCPA's stated frequency limit. The verification requirement for requests must be calibrated to avoid creating unreasonable barriers to rights exercise, which CPPA guidance has addressed. Denial of deletion requests based on GLBA must be applied on a data-category-specific basis rather than as a blanket exemption. 3) JURISDICTION FLAGS: California creates the most detailed compliance obligations. Colorado, Virginia, Connecticut, Texas, Oregon, Montana, and other states with enacted privacy laws create analogous but not identical obligations. Compliance teams should map which rights are available in which states and whether Betterment's single email-based process satisfies each state's procedural requirements. 4) CONTRACT AND VENDOR IMPLICATIONS: Service provider agreements with all vendors who have received customer personal information must include provisions requiring those vendors to assist in fulfilling data subject requests, including deletion and access requests, within required timeframes. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should confirm the data subject request process meets CCPA's 45-day response requirement (with a 45-day extension for complex requests), that the verification process does not create unreasonable barriers under CPPA guidance, that the authorized representative process is documented and consistently applied, and that deletion request denials are documented with specific legal basis citations for each data category withheld.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes the mechanism and frequency limits for consumer data rights requests under state privacy laws, and conditions the exercise of those rights on GLBA exemptions that may reduce the scope of available remedies for financial data categories.
The agreement states that eligible state residents may submit access, deletion, correction, and opt-out requests by emailing privacy@betterment.com, with identity verification required; access and data portability requests are limited to two per 12-month period, and deletion requests may be denied where GLBA or other legal retention obligations apply.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Betterment.