Cash App Privacy Policy

This Privacy Notice, effective March 11, 2026, is published by Block, Inc. on behalf of Cash App and governs the collection, use, disclosure, retention, and processing of personal information from users who visit the Cash App website or use the Cash App mobile application and related services, with consent asserted as the operative legal basis through continued use of the services. The notice states that Cash App collects identification information (including government-issued IDs, Social Security numbers, facial scans, and biometric data), financial information (bank account and payment card numbers), precise geolocation, device identifiers, browsing activity, employment information, and transaction history, and authorizes use of this data for purposes including training artificial intelligence and machine learning models, drawing behavioral inferences to build user profiles, credit risk assessment, marketing, and fraud prevention. The notice authorizes sharing personal information with Block affiliates (including Square), identity verification services, credit bureaus, fraud detection partners, merchants, advertising platforms, data brokers, and third-party marketing partners, and discloses receipt of inferred characteristics and advertising segments from data brokers to supplement user profiles; the breadth of AI training use and data broker enrichment provisions are operationally distinct relative to commonly observed financial services privacy practices, though the agreement's assertion of broad consent-based authorization may be constrained by applicable state privacy laws. The notice engages the California Consumer Privacy Act (CCPA/CPRA), the Gramm-Leach-Bliley Act (GLBA) as reflected in the included U.S. Consumer Privacy Notice section, the Illinois Biometric Information Privacy Act (BIPA) given the explicit collection of facial scans and biometric data, the FTC Act, and state biometric privacy statutes; users in California, Illinois, and other states with comprehensive privacy laws have heightened rights under this notice. Material compliance considerations include the adequacy of consent mechanisms for biometric data collection, the scope of AI training authorizations relative to state opt-out requirements, data broker enrichment disclosures, and the retention framework applicable to financial records under GLBA.