Gusto shares your personal information with third-party service providers, financial partners, and in some cases marketing affiliates to operate its services and for targeted advertising purposes.
This analysis describes what Gusto's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the operational framework for employer-initiated third-party service integrations and allocates responsibility for legal compliance and data accuracy to the employer rather than to Gusto when employer data is shared with third-party service providers.
The updated policy explicitly discloses that Gusto sells or shares personal information (defined under state privacy laws) with third parties including business, advertising, and technology partners. The company describes 'sale' as providing information in exchange for valuable consideration, and 'share' as providing information for cross-context behavioral advertising. This disclosure formalizes practices that may have been permitted under previous language but were not explicitly described. You can opt out of sales or sharing of personal information through the Cookies, Analytics, and Other Tracking Technologies section.
View change record →The updated Privacy Policy now explicitly states it covers retirement account management (401k, SEP IRA, IRA accounts) and adds Stripe alongside Plaid as a third-party service provider that collects financial institution data. The policy restructures how it describes Gusto's role in different contexts: when Gusto acts as a service provider processing payroll or other data on behalf of employers, when it acts as an employer itself, or when it operates as a co-employer under a professional organization (PEO) arrangement, with separate privacy notices applying in each case. The policy introduces a new commitment that de-identified data will not be re-identified except to verify compliance with applicable law. If you connect a bank account through Stripe, that data will be treated under Stripe's Privacy Policy, which you should review separately.
View change record →Your data may flow to companies you've never heard of, including advertising partners. California residents and users in certain other states can opt out of this sharing of personal information.
How other platforms handle this
Protect us, our business, our users, and others, for example to enforce our terms of service, prevent spam or other unwanted communications, and investigate or protect against fraud
we may use, retain or share information with law enforcement or others in circumstances where a person's vital interests require protection, such as in the case of emergencies.
Under Section 1798.83, Ancestry currently does not share any Personal Information with third parties for their own direct marketing purposes.
"Employer will be able to elect to receive services from our third party partners (each a 'Third-Party Service')... If Employer chooses to and authorizes Gusto to share Employer Data with a Third-Party Service ('Shared Employer Data') then Employer (a) represents it has obtained all legal rights to do so, (b) assumes all risks related to such Shared Employer Data, (c) acknowledges it is solely responsible for the accuracy of such Shared Employer Data, and (d) agrees that it is solely responsible for the lawfulness of sharing such Shared Employer Data with the applicable Third-Party Service.Excerpt from Gusto's Privacy Policy
Sharing data with marketing and advertising partners may constitute a 'sale' or 'sharing' of personal information under CCPA/CPRA and similar state laws, triggering opt-out obligations and requiring disclosure.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.
Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes the operational framework for employer-initiated third-party service integrations and allocates responsibility for legal compliance and data accuracy to the employer rather than to Gusto when employer data is shared with third-party service providers.
Your data may flow to companies you've never heard of, including advertising partners. California residents and users in certain other states can opt out of this sharing of personal information.
ConductAtlas has identified this type of provision across 288 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Gusto.