This is Coinbase's privacy policy explaining what personal information they collect when you use their crypto trading platform, including your government ID, financial account details, transaction records, device data, and in some cases biometric data. The most important thing to know is that Coinbase shares your personal and financial data with a wide range of third parties — including advertising partners, blockchain analytics firms, and law enforcement — and may do so without notifying you. You can exercise rights to access, correct, delete, or export your data by submitting a request through Coinbase's Privacy Rights portal at privacy.coinbase.com.
This document is Coinbase's Global Privacy Policy governing the collection, use, storage, and sharing of personal data across Coinbase's cryptocurrency exchange platform and affiliated services, with legal bases including contractual necessity, legal obligation, and legitimate interests under applicable frameworks including GDPR and CCPA. The policy obligates Coinbase to collect extensive categories of personal data including government-issued identity documents, financial account information, transaction history, device and behavioral data, and biometric data for identity verification, while requiring users to provide accurate information as a condition of service access. A notably expansive provision permits sharing personal data with a broad range of third parties including affiliates, financial institution partners, data analytics providers, advertising networks, and blockchain analytics companies, and Coinbase explicitly states it may share data with law enforcement without user notification where legally permissible, which represents a broader disclosure scope than many comparable fintech privacy policies. The policy engages GDPR (Arts. 6, 9, 17, 20, 46), CCPA/CPRA (§§1798.100–1798.199), COPPA, Bank Secrecy Act/AML obligations, and FinCEN requirements, with enforcement exposure from the FTC, CFPB, state attorneys general, and EU/EEA data protection authorities. Material compliance considerations include the adequacy of cross-border data transfer mechanisms for EU personal data, the sufficiency of consent mechanisms for sensitive data categories including biometrics, and the alignment of data retention practices with both AML record-keeping obligations and data minimization principles under GDPR Art. 5(1)(e).
REGULATORY EXPOSURE: This policy implicates GDPR Arts. 5, 6, 9, 13, 17, 20, and 46 (EU/EEA users; enforced by relevant EU DPAs including Ireland's DPC as Coinbase's EU lead supervisory authority), CC…
REGULATORY EXPOSURE: This policy implicates GDPR Arts. 5, 6, 9, 13, 17, 20, and 46 (EU/EEA users; enforced by relevant EU DPAs including Ireland's DPC as Coinbase's EU lead supervisory authority), CCPA/CPRA §§1798.100–1798.199 (California AG and California Privacy Protection Agency), COPPA (FTC enf…
Compliance intelligence locked
Regulatory exposure, material risk, and due diligence action items.
2 changes analyzed since monitoring began.