Third-Party Data Sharing with Service Providers and Partners

What it is

Betterment shares your personal and financial information with a range of third parties including technology vendors, marketing firms, financial partners, and affiliated companies, and may transfer your data if the company is acquired or merged.

Why it matters (compliance & governance perspective)

Your sensitive financial data may flow to multiple external organizations beyond Betterment itself, and a corporate transaction such as an acquisition could result in your data being transferred to a new entity under different terms.

Consumer impact (what this means for users)

This provision means your SSN, account balances, and transaction history may be shared with marketing analytics firms, technology vendors, and financial partners, not just Betterment's core service teams, and that data could transfer to a new owner if Betterment is sold.

What you can do

Institutional analysis (Compliance & governance intelligence)

1) REGULATORY LANDSCAPE: This provision implicates GLBA's restrictions on sharing nonpublic personal financial information with non-affiliated third parties, which generally requires providing consumers an opt-out right before such sharing occurs. CCPA's service provider and contractor framework also applies, requiring that third parties receiving personal information for business purposes be bound by contractual restrictions on further use. The FTC enforces against deceptive or unfair data sharing practices. 2) GOVERNANCE EXPOSURE: Medium. The provision is broadly worded and covers a wide range of third-party relationships. The reference to sharing with marketing service providers is particularly notable in the context of GLBA's opt-out requirements for financial institutions sharing data with non-affiliated third parties for marketing purposes. 3) JURISDICTION FLAGS: California residents have CCPA rights to know the categories of third parties with whom their data is shared and to opt out of sale or sharing. The business transfer provision may create CCPA notification obligations if a transaction results in a materially different use of personal information. All U.S. jurisdictions may require breach notification if shared data is subsequently compromised at a third party. 4) CONTRACT AND VENDOR IMPLICATIONS: Each service provider and financial partner receiving consumer data should be subject to a written data processing agreement confirming the permissible scope of use. Procurement teams should audit whether all marketing and analytics vendors are classified as CCPA service providers or contractors with appropriate contractual terms, or whether the relationships may constitute sale or sharing under CCPA. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should maintain a current vendor register mapping all third-party data recipients against the categories of personal information disclosed in the policy; confirm that GLBA opt-out mechanisms are functioning and that opt-outs are honored in data sharing operations; and assess whether business transfer scenarios trigger CCPA consumer notification obligations.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Sensitive Financial Data Collection medium
• Third-Party Tracking Technologies and Behavioral Data Collection medium
• California Consumer Privacy Act Rights medium
• Data Retention low
• Marketing Communications and Opt-Out low
• Data Security Safeguards medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.