Track 1 platform and get the weekly governance digest. No credit card required.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
This document establishes Cash App's data collection and processing practices for users of the Cash App mobile application and website operated by Block, Inc. The policy authorizes collection of Social Security numbers, facial scans, biometric data, bank account numbers, precise location, transaction history, device identifiers, and browsing activity, with authorization to use this data for AI model training, behavioral profiling, creditworthiness assessment, and information sharing with advertisers, data brokers, and credit bureaus. Users in California and other states with designated privacy rights may submit data access, deletion, or opt-out requests through the Cash App privacy rights portal at https://cash.app/legal/us/en-s/privacy.
This Privacy Notice, effective March 11, 2026, is published by Block, Inc. on behalf of Cash App and governs the collection, use, disclosure, retention, and processing of personal information from users who visit the Cash App website or use the Cash App mobile application and related services, with consent asserted as the operative legal basis through continued use of the services. The notice states that Cash App collects identification information (including government-issued IDs, Social Security numbers, facial scans, and biometric data), financial information (bank account and payment card numbers), precise geolocation, device identifiers, browsing activity, employment information, and transaction history, and authorizes use of this data for purposes including training artificial intelligence and machine learning models, drawing behavioral inferences to build user profiles, credit risk assessment, marketing, and fraud prevention. The notice authorizes sharing personal information with Block affiliates (including Square), identity verification services, credit bureaus, fraud detection partners, merchants, advertising platforms, data brokers, and third-party marketing partners, and discloses receipt of inferred characteristics and advertising segments from data brokers to supplement user profiles; the breadth of AI training use and data broker enrichment provisions are operationally distinct relative to commonly observed financial services privacy practices, though the agreement's assertion of broad consent-based authorization may be constrained by applicable state privacy laws. The notice engages the California Consumer Privacy Act (CCPA/CPRA), the Gramm-Leach-Bliley Act (GLBA) as reflected in the included U.S. Consumer Privacy Notice section, the Illinois Biometric Information Privacy Act (BIPA) given the explicit collection of facial scans and biometric data, the FTC Act, and state biometric privacy statutes; users in California, Illinois, and other states with comprehensive privacy laws have heightened rights under this notice. Material compliance considerations include the adequacy of consent mechanisms for biometric data collection, the scope of AI training authorizations relative to state opt-out requirements, data broker enrichment disclosures, and the retention framework applicable to financial records under GLBA.
Institutional analysis available with Compliance
Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Compliance.
Start Compliance free trial8 important changes detected
8 versions captured · Last updated: June 2026
Cash App's privacy policy now includes a new link labeled 'Your Privacy Choices' in its footer navigation. This addition provides users direct access to privacy control options. The change is …
View change record →Cash App updated its children's privacy terms on April 10, 2026 to permit parental account authorization instead of a blanket prohibition. Previously, the policy stated children under 13 could not …
View change record →Cash App's privacy policy was updated on April 3, 2026, with 1 sentence removed and 5 sentences modified. The specific operational changes cannot be determined from the change summary provided, …
View change record →Cash App removed a reference to 'Cash App Terms of Service (accounts created prior to June 24, 2021)' from its privacy policy's linked documents section on April 2, 2026. This …
View change record →Cash App removed the 'Your Privacy Choices' link from its Privacy Policy navigation on March 25, 2026. This link previously directed users to privacy control options or settings. The removal …
View change record →Cash App updated its policy on children under 13 on March 15, 2026. Previously, the policy permitted parental authorization for children under 13 to use the service; the updated terms …
View change record →New explicit disclosure that Cash App trains AI and machine learning models on user data and creates behavioral profiles for service enhancement.
New disclosure revealing that Cash App obtains third-party data from data brokers and advertising platforms to supplement customer profiles, going beyond previous advertiser sharing provisions.
New explicit disclosure that Cash App creates credit risk profiles and behavioral inferences about users to assess creditworthiness and maintain profiles of personal characteristics.
New explicit disclosure specifying data sharing with Square and other affiliated business units, clarifying corporate data flows within Block's ecosystem.
New comprehensive disclosure of employment data collection through staff management features, including sensitive payroll and scheduling information.
Removal of this provision may indicate consolidation into more specific provisions like 'Data Broker and Third-Party Marketing Partner Enrichment,' though the empty excerpt makes its original scope unclear.
Removal of explicit law enforcement disclosure provision (though such disclosures typically remain required by law), and the empty excerpt obscures what safeguards were previously stated.
Removal of explicit financial account and payment card data collection disclosure; this core Cash App functionality disclosure loss is significant despite the empty excerpt.
Removal of state-specific privacy rights provision; users lose explicit reference to CCPA, VCCPA, and other state law consumer rights previously disclosed.
Removal of data retention policy provision means users are no longer informed of how long Cash App retains their personal data.
Previous version had empty excerpt; current version now specifies detailed collection of facial scans, biometric data, and government IDs for verification purposes.
Previous version had empty excerpt; current version now explicitly states that continued service use constitutes consent to all privacy practices.
Previous version had empty excerpt; current version now provides detailed description of precise geolocation collection and mentions opt-out mechanisms.
Previous provision was 'Children's Data Collection (Ages 13 and Up)' with empty excerpt; current version uses simplified heading without age specification detail.
Monitoring
Cash App has updated this document before.
Monitor includes same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
Compliance Governance Intelligence
Need provision-level monitoring and regulatory mapping?
Compliance includes governance timelines, compliance memos, audit-ready analysis, and full provision tracking.
Start Compliance free trialCross-platform context
See how other platforms handle AI and Machine Learning Model Training Using Customer Data and similar clauses.
Compare across platforms →Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 318+ platforms.