What can I do about this clause?

{'method': 'WEB_FORM', 'recipient': 'https://www.coinbase.com/settings/privacy-rights', 'difficulty': 'EASY', 'action_type': 'EXPORT_DATA', 'instructions': 'California residents and other eligible users can request a copy of all personal data Coinbase holds about them by visiting coinbase.com/settings/privacy-rights and submitting a Data Access Request. Coinbase must respond within 45 days under CCPA.', 'deadline_days': None, 'deadline_hours': None}

Which regulatory agencies enforce this type of clause?

{'agency': 'FTC', 'reason': 'The FTC enforces data security requirements under the Gramm-Leach-Bliley Safeguards Rule for financial institutions and can act against inadequate protection of KYC personal data', 'complaint_url': 'https://reportfraud.ftc.gov/'}, {'agency': 'State_AG', 'reason': 'State attorneys general enforce CCPA data access rights, state data breach notification laws, and consumer privacy protections applicable to KYC data collected by Coinbase', 'complaint_url': 'https://www.naag.org/find-my-ag/'}

What is the severity of this clause?

ConductAtlas classifies this KYC/AML Identity Verification and Data Collection clause as high severity. Severity reflects the magnitude of rights affected, the breadth of users impacted, and the degree of discretion the platform retains.

KYC/AML Identity Verification and Data Collection — Coinbase

What it is

Coinbase requires you to provide extensive personal and financial information — including government ID and bank account details — before allowing you to use the platform, as required by federal anti-money laundering laws.

Consumer impact (what this means for users)

You must provide Coinbase with your full legal name, address, date of birth, government-issued ID, taxpayer identification number, and bank account information, all of which Coinbase stores and may share with government agencies, regulators, or law enforcement upon request without notifying you.

What you can do

⚠️ These actions may provide transparency or partial mitigation but may not fully address the underlying issue. Effectiveness varies by jurisdiction and individual circumstances.

Export Your Data

California residents and other eligible users can request a copy of all personal data Coinbase holds about them by visiting coinbase.com/settings/privacy-rights and submitting a Data Access Request. Coinbase must respond within 45 days under CCPA.

Why it matters (compliance & risk perspective)

The sensitive personal and financial information you provide to Coinbase — including your government ID, Social Security number, and bank account details — is stored by the company and may be disclosed to government authorities upon legal request.

View original clause language

Before permitting you to use certain Coinbase Services, we may require you to provide information we need to verify your identity. The information we request may include certain personal information, including, but not limited to, your name, address, telephone number, e-mail address, date of birth, taxpayer identification number, a government-issued identification, and information regarding your bank account. In providing this information to us, you confirm it is accurate and complete.

Institutional analysis (Compliance & legal intelligence)

REGULATORY FRAMEWORK: KYC/AML data collection obligations arise under the Bank Secrecy Act (31 U.S.C. § 5318) and FinCEN's Customer Identification Program rules (31 C.F.R. § 1022.220). IRS Form 1099-DA reporting requirements apply to cryptocurrency brokers (effective 2025 per the Infrastructure Investment and Jobs Act). OFAC beneficial ownership verification requirements (31 C.F.R. § 1010.230) apply for legal entity customers. CCPA (Cal. Civ. Code § 1798.100) governs consumer rights over collected personal data. Gramm-Leach-Bliley Act (15 U.S.C. § 6801) financial privacy provisions may apply to Coinbase's data sharing practices.

🔒

Compliance intelligence locked

Regulatory citations, enforcement risk, and due diligence action items.

Watcher $9.99/mo Professional $149/mo

Watcher: regulatory citations. Professional: full compliance memo.

Applicable agencies

FTC

The FTC enforces data security requirements under the Gramm-Leach-Bliley Safeguards Rule for financial institutions and can act against inadequate protection of KYC personal data
File a complaint →
State AG

State attorneys general enforce CCPA data access rights, state data breach notification laws, and consumer privacy protections applicable to KYC data collected by Coinbase
File a complaint →

Provision details

Document information

Document

Coinbase User Agreement

Entity

Coinbase

Document last updated

March 24, 2026

Tracking information

First tracked

March 20, 2026

Last verified

April 9, 2026

Record ID

CA-P-002480

Document ID

CA-D-00047

Evidence Provenance

Source URL

https://www.coinbase.com/legal/user_agreement/united_states

Wayback Machine

View archived versions →

SHA-256

28b08bdc2391062cc0b1b467b0c8cfeb1e19b51011dcce671448d97947da4585

Verified

✓ Snapshot stored ✓ Change verified

How to Cite

ConductAtlas Policy Archive
Entity: Coinbase | Document: Coinbase User Agreement | Record: CA-P-002480
Captured: 2026-03-20 06:40:29 UTC | SHA-256: 28b08bdc2391062c…
URL: https://conductatlas.com/platform/coinbase/coinbase-user-agreement/kycaml-identity-verification-and-data-collection/
Accessed: April 24, 2026

Classification

Severity

High

KYC/AML Identity Verification and Data Collection