Gusto uses cookies and tracking tools on its platform to monitor your activity and collect information about how you use its services.
This analysis describes what Gusto's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Tracking technologies on a payroll and HR platform may capture behavioral data alongside sensitive employment information, and users may not be aware of the extent of this tracking.
The updated Privacy Policy now explicitly states it covers retirement account management (401k, SEP IRA, IRA accounts) and adds Stripe alongside Plaid as a third-party service provider that collects financial institution data. The policy restructures how it describes Gusto's role in different contexts: when Gusto acts as a service provider processing payroll or other data on behalf of employers, when it acts as an employer itself, or when it operates as a co-employer under a professional organization (PEO) arrangement, with separate privacy notices applying in each case. The policy introduces a new commitment that de-identified data will not be re-identified except to verify compliance with applicable law. If you connect a bank account through Stripe, that data will be treated under Stripe's Privacy Policy, which you should review separately.
View change record →The updated terms make explicit that using Gusto's background check service constitutes a binding agreement. Previously, the terms of the service relationship may have been less clearly stated. Now, the agreement clarifies that an authorized signatory represents they have authority to bind the organization, and that three actions trigger binding acceptance: checking a box, initiating a background check, or accessing the service. This means employers should ensure the person clicking through has actual authority to commit the organization to the full Background Check Customer Agreement before proceeding.
View change record →The updated terms now explicitly state that employers accept mandatory individual arbitration and waive the right to participate in class-action lawsuits or pursue relief in court with a jury trial. This significantly limits employers' ability to challenge Gusto's practices collectively or seek resolution through the court system. Any disputes employers have with Gusto must be resolved individually through arbitration, which typically involves private, binding proceedings with limited appeal options and discovery rights compared to court litigation.
View change record →Severity downgraded from medium to low; previous version had empty excerpt while current version includes detailed explanation of how cookies work and specific tracking technologies used (beacons, tags, scripts).
View full change record →Gusto tracks your activity on its platform using cookies, beacons, and scripts, which means behavioral data about how you interact with your payroll and HR information is collected in addition to the sensitive personal data you actively submit.
How other platforms handle this
At Ledger, earning and maintaining our users' trust is a top priority. That's why we are deeply committed not only to protecting your privacy and securing your personal data, but also to being fully transparent about how we handle it.
If you are located in the European Economic Area, Switzerland, or the United Kingdom, you have the right to access, correct, or erase your personal data; the right to restrict or object to our processing of your personal data; the right to data portability; and, where our processing is based on your...
We may display advertisements on our Services and those advertisements may be targeted to your interests based on your personal information. We may share your personal information with advertising partners for interest-based advertising purposes. You may opt out of interest-based advertising by visi...
Monitoring
Gusto has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We use cookies and similar tracking technologies to track the activity on our Platform and hold certain information. Cookies are files with small amounts of data which may include an anonymous unique identifier. Cookies are sent to your browser from a website and stored on your device. Tracking technologies also used are beacons, tags, and scripts to collect and track information and to improve and analyze our services.— Excerpt from Gusto's Gusto Privacy Policy
1) REGULATORY LANDSCAPE: Cookie and tracking technology use engages CCPA/CPRA requirements for disclosure and opt-out of tracking that constitutes 'sharing' for cross-context behavioral advertising. The FTC Act applies to deceptive practices in cookie disclosures. California's cookie opt-out requirements under CPRA and the associated Global Privacy Control (GPC) signal recognition obligations are directly applicable to Gusto as a California-registered business. The CAN-SPAM Act applies if tracking is used for email marketing purposes. 2) GOVERNANCE EXPOSURE: Medium. The use of tracking technologies on a platform that handles sensitive payroll data warrants review to confirm that analytics and marketing cookies are not capturing sensitive session data (e.g., payroll amounts visible in the UI) through behavioral tracking. The notice should clearly distinguish between essential cookies and optional tracking. 3) JURISDICTION FLAGS: California CPRA requires businesses to honor Global Privacy Control signals as opt-out of sale or sharing. Colorado, Connecticut, and other states with comprehensive privacy laws have similar requirements for opt-out of targeted advertising. EU/EEA users would be covered by GDPR/ePrivacy Directive cookie consent requirements if Gusto operates internationally. 4) CONTRACT AND VENDOR IMPLICATIONS: Third-party analytics and advertising vendors receiving data through tracking technologies should be listed in Gusto's cookie disclosure or subprocessor list. Procurement teams should confirm these vendors are subject to appropriate data processing agreements, particularly if tracking captures behavioral data from within the authenticated payroll portal. 5) COMPLIANCE CONSIDERATIONS: Legal teams should audit Gusto's cookie management platform to confirm GPC signal recognition is implemented, cookie categories are accurately disclosed, and users have a functional mechanism to reject non-essential cookies. Session data captured through tracking within the authenticated payroll portal should be assessed for sensitivity classification.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Tracking technologies on a payroll and HR platform may capture behavioral data alongside sensitive employment information, and users may not be aware of the extent of this tracking.
Gusto tracks your activity on its platform using cookies, beacons, and scripts, which means behavioral data about how you interact with your payroll and HR information is collected in addition to the sensitive personal data you actively submit.
ConductAtlas has identified this type of provision across 78 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Gusto.