This is Cash App's privacy policy, which explains exactly what personal information — including your Social Security number, facial scans, bank account numbers, precise location, and transaction history — Cash App collects, shares with partners and data brokers, and uses to build behavioral profiles about you. The most important thing for everyday users is that Cash App explicitly states it uses your personal data to train AI and machine learning models, and purchases additional data about you from third-party data brokers to build advertising profiles, without a clear opt-out mechanism described in the main policy. California residents and users in states with biometric privacy laws should review their rights under the 'Additional Information for Residents of Certain U.S. States' section and consider limiting permissions such as precise location and contact list access in their device settings.
This Privacy Notice, effective March 11, 2026, governs Block, Inc.'s (Cash App) collection, use, disclosure, and retention of personal information from US users of the Cash App mobile application and website, operating under a consent-based framework whereby continued use of the Services constitutes agreement to the described data practices. The Notice creates significant obligations for Cash App to collect extensive categories of personal data including government-issued identification, Social Security numbers, biometric/facial scan data, precise geolocation, financial account numbers, employment information, and behavioral profiles, while disclosing this data to affiliates, credit bureaus, fraud partners, merchants, advertising partners, and data brokers. Notable provisions include the use of user data to train AI and machine learning models, collection of inferred characteristics from third-party data brokers to build behavioral profiles, and the sharing of biometric information for identity verification — practices that deviate from minimal-collection norms and create heightened risk under state biometric and consumer privacy laws. The document engages the GLBA, FCRA, CCPA/CPRA, state biometric privacy laws (including BIPA), COPPA, and FTC Act Section 5, with primary enforcement exposure from the CFPB (as a financial services provider), FTC, and State Attorneys General; material compliance considerations include the adequacy of consent mechanisms for biometric data collection, the lawfulness of using customer data for AI model training without explicit opt-in, and the breadth of third-party data broker sourcing and advertising profiling.
REGULATORY EXPOSURE: This Notice engages multiple federal and state regulatory frameworks: the Gramm-Leach-Bliley Act (GLBA, 15 U.S.C. §6801 et seq.) and its implementing Safeguards Rule (16 C.F.R. P…
REGULATORY EXPOSURE: This Notice engages multiple federal and state regulatory frameworks: the Gramm-Leach-Bliley Act (GLBA, 15 U.S.C. §6801 et seq.) and its implementing Safeguards Rule (16 C.F.R. Part 314) govern financial data handling; the Fair Credit Reporting Act (FCRA, 15 U.S.C. §1681) is im…
Compliance intelligence locked
Regulatory exposure, material risk, and due diligence action items.
3 changes analyzed since monitoring began.