If you live in California, you have specific legal rights to see what data Chase has about you, ask Chase to delete it, correct it, limit use of sensitive data, and opt out of Chase sharing your data for advertising purposes.
This analysis describes what Chase's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
California's CCPA and CPRA give residents meaningful control over their personal data held by financial institutions, including rights not available to consumers in most other U.S. states.
Interpretive note: The precise scope of CCPA/CPRA rights as applied to Chase depends on which data categories fall within the GLBA exemption, which requires case-by-case data mapping and is not fully resolved by this policy alone.
California residents have enforceable rights to access, delete, correct, and limit use of their personal information held by Chase, and can opt out of sharing of their data with third parties for advertising, which provides materially stronger protections than those available to Chase customers in other states.
How other platforms handle this
If you are a California resident, you may have certain rights under the California Consumer Privacy Act (CCPA). These rights may include: the right to know about personal information collected, disclosed, or sold; the right to delete personal information collected from you; the right to opt-out of t...
If you are a California resident, you have the right to know what personal information we collect, use, disclose, and sell about you. You have the right to request deletion of your personal information, subject to certain exceptions. You have the right to opt out of the sale or sharing of your perso...
If you are a California resident, you have the right to know what personal information we collect about you, the right to delete personal information we have collected from you, the right to correct inaccurate personal information, the right to opt out of the sale or sharing of your personal informa...
Monitoring
Chase has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"If you are a California resident, you have the right to know what personal information we collect, use, disclose, and sell or share. You have the right to request that we delete personal information we have collected from you. You have the right to opt out of the sale or sharing of your personal information. You have the right to correct inaccurate personal information. You have the right to limit the use and disclosure of sensitive personal information.— Excerpt from Chase's Chase Privacy Notice
REGULATORY LANDSCAPE: This provision reflects obligations under the California Consumer Privacy Act as amended by the California Privacy Rights Act, enforced by the California Privacy Protection Agency and the California Attorney General. The CPRA established specific requirements for handling sensitive personal information, honoring opt-out requests for sale or sharing, and responding to consumer rights requests within defined timeframes. Financial institutions subject to GLBA have partial exemptions under CCPA/CPRA for data processed under GLBA, but those exemptions are narrowly construed and do not cover all personal information Chase holds. GOVERNANCE EXPOSURE: High. The GLBA exemption under CCPA/CPRA applies to personal information collected and processed in the course of providing financial services, but does not exempt all data Chase collects, including online behavioral data, device identifiers, and browsing history used for marketing. Compliance teams must maintain accurate mapping of which data categories fall within the GLBA exemption and which are subject to CCPA/CPRA rights requests. JURISDICTION FLAGS: This provision applies specifically to California residents. However, other states including Virginia, Colorado, Connecticut, Texas, Oregon, and Montana have enacted comprehensive privacy laws with similar, though not identical, consumer rights frameworks. Teams should evaluate whether equivalent rights request workflows are required in those jurisdictions or whether California-specific infrastructure can serve as a template. CONTRACT AND VENDOR IMPLICATIONS: Service providers processing California residents' personal data on Chase's behalf must be bound by CPRA-compliant service provider agreements that prohibit use of data outside disclosed purposes and grant Chase audit rights. Any vendor that receives data subject to a consumer deletion request must honor those requests under applicable contractual and regulatory requirements. COMPLIANCE CONSIDERATIONS: Compliance teams should audit the end-to-end consumer rights request workflow, including verification procedures, response timelines, and the accuracy of data provided in response to access requests. The GLBA exemption scope should be documented and reviewed periodically to ensure the policy's disclosures accurately reflect the data categories for which CCPA/CPRA rights apply. Teams should also confirm that the opt-out mechanism for sharing of personal information is accessible, functional, and honored across all Chase digital properties and third-party advertising partners.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
California's CCPA and CPRA give residents meaningful control over their personal data held by financial institutions, including rights not available to consumers in most other U.S. states.
California residents have enforceable rights to access, delete, correct, and limit use of their personal information held by Chase, and can opt out of sharing of their data with third parties for advertising, which provides materially stronger protections than those available to Chase customers in other states.
ConductAtlas has identified this type of provision across 15 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Chase.