Gusto collects financial account information including bank account numbers and routing numbers in order to process payroll direct deposits and other financial transactions.
This analysis describes what Gusto's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The provision establishes the data collection scope required for account verification and onboarding. This financial information collection is foundational to the employer's ability to access and use the payroll platform services.
The updated policy explicitly discloses that Gusto sells or shares personal information (defined under state privacy laws) with third parties including business, advertising, and technology partners. The company describes 'sale' as providing information in exchange for valuable consideration, and 'share' as providing information for cross-context behavioral advertising. This disclosure formalizes practices that may have been permitted under previous language but were not explicitly described. You can opt out of sales or sharing of personal information through the Cookies, Analytics, and Other Tracking Technologies section.
View change record →The updated Privacy Policy now explicitly states it covers retirement account management (401k, SEP IRA, IRA accounts) and adds Stripe alongside Plaid as a third-party service provider that collects financial institution data. The policy restructures how it describes Gusto's role in different contexts: when Gusto acts as a service provider processing payroll or other data on behalf of employers, when it acts as an employer itself, or when it operates as a co-employer under a professional organization (PEO) arrangement, with separate privacy notices applying in each case. The policy introduces a new commitment that de-identified data will not be re-identified except to verify compliance with applicable law. If you connect a bank account through Stripe, that data will be treated under Stripe's Privacy Policy, which you should review separately.
View change record →Removal of this high-severity standalone provision eliminates explicit transparency about financial account information collection, which is a particularly sensitive data type given Gusto's payroll processing function.
View full change record →Gusto stores your bank account and routing numbers for payroll processing, meaning a data breach at Gusto could expose you to direct financial loss or fraud. Ensure your bank account details are up to date and monitor accounts for unauthorized activity.
How other platforms handle this
Cookies may also allow us and our service providers to collect data about your use of our services, including text you enter, screen recordings of your mouse movements, and other interactions as you browse and use our services, even if you don't have an account or Profile.
We collect certain information when you open an account such as your GitHub handle, name, email address, password, payment information and transaction information.
You may give us your Identity Data, Contact Data, Financial Data, Profile Data, and other information by filling in forms or by corresponding with us by post, phone, e-mail or otherwise.
"Gusto will also need to collect, review and verify certain information about the Bank Account in order to confirm Employer's eligibility for the Platform and Services and in order to set up the Employer Account. This information includes identifying information about the Bank Account such as (but is not limited to) the number and financial institution name, identifying information about the Bank Account signatory, as well as information about payment recipients and transactions.Excerpt from Gusto's Privacy Policy
Collection and storage of financial account data implicates CFPB jurisdiction, Gramm-Leach-Bliley Act (GLBA) obligations, and applicable state financial data protection laws.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Netflix updated its Privacy Statement on April 18, 2026, disclosing voice recording collection and expanded household ad profiling for the first time.
Google's Privacy Policy covers Search, Gmail, YouTube, Maps, and every site running Google Analytics. Here is what it actually authorizes.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The provision establishes the data collection scope required for account verification and onboarding. This financial information collection is foundational to the employer's ability to access and use the payroll platform services.
Gusto stores your bank account and routing numbers for payroll processing, meaning a data breach at Gusto could expose you to direct financial loss or fraud. Ensure your bank account details are up to date and monitor accounts for unauthorized activity.
ConductAtlas has identified this type of provision across 296 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Gusto.