Gusto collects highly sensitive personal data including your Social Security number, bank account numbers, and health insurance information as part of delivering payroll and HR services.
This analysis describes what Gusto's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This data is among the most sensitive a company can hold; unauthorized exposure could enable identity theft, financial fraud, or discrimination.
The updated policy explicitly discloses that Gusto sells or shares personal information (defined under state privacy laws) with third parties including business, advertising, and technology partners. The company describes 'sale' as providing information in exchange for valuable consideration, and 'share' as providing information for cross-context behavioral advertising. This disclosure formalizes practices that may have been permitted under previous language but were not explicitly described. You can opt out of sales or sharing of personal information through the Cookies, Analytics, and Other Tracking Technologies section.
View change record →The updated Privacy Policy now explicitly states it covers retirement account management (401k, SEP IRA, IRA accounts) and adds Stripe alongside Plaid as a third-party service provider that collects financial institution data. The policy restructures how it describes Gusto's role in different contexts: when Gusto acts as a service provider processing payroll or other data on behalf of employers, when it acts as an employer itself, or when it operates as a co-employer under a professional organization (PEO) arrangement, with separate privacy notices applying in each case. The policy introduces a new commitment that de-identified data will not be re-identified except to verify compliance with applicable law. If you connect a bank account through Stripe, that data will be treated under Stripe's Privacy Policy, which you should review separately.
View change record →Previous version had empty excerpt; current version now includes detailed enumeration of specific identifiers collected including SSN, driver's license, and passport numbers.
View full change record →If your employer uses Gusto, the platform holds your SSN, bank account details, salary history, and health insurance information, making the security and handling of this data directly relevant to your financial and personal safety.
How other platforms handle this
If you choose to reveal any personal information about yourself to other users, you do so at your own risk. We strongly encourage you to use caution in disclosing any personal information online.
You can contact us in order to (1) update or correct your personally identifiable information, (2) change your preferences with respect to communications and other information you receive from us, or (3) delete the personally identifiable information maintained about you...
Access information about you consistent with legal requirements. In addition, you may have the right in some cases to receive or have your electronic information transferred to another party.
"We collect the following categories of personal information: Identifiers such as your name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, Social Security number, driver's license number, passport number, or other similar identifiers. Personal information categories listed in the California Customer Records statute such as name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.Excerpt from Gusto's Privacy Policy
1) REGULATORY LANDSCAPE: Collection of Social Security numbers, financial account data, and health insurance information implicates the FTC Act (Section 5), GLBA for financial data, and potentially HIPAA if benefits data processing qualifies Gusto as …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This data is among the most sensitive a company can hold; unauthorized exposure could enable identity theft, financial fraud, or discrimination.
If your employer uses Gusto, the platform holds your SSN, bank account details, salary history, and health insurance information, making the security and handling of this data directly relevant to your financial and personal safety.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Gusto.