Intuit Privacy Statement

This document is Intuit's Global Privacy Statement, governing the collection, use, disclosure, and retention of personal information across Intuit's family of products and services, including TurboTax, QuickBooks, Mint, Credit Karma, and Mailchimp, with stated legal bases varying by jurisdiction including consent, contractual necessity, and legitimate interests. The statement asserts that Intuit collects a broad range of personal data including financial information, government-issued identifiers, geolocation, device and usage data, biometric-adjacent data such as voice recordings, and data inferred from user behavior, and that this information may be used for product improvement, targeted advertising, fraud prevention, and AI-driven features. Notably, the statement authorizes sharing personal information with a wide range of third parties including service providers, business partners, advertising networks, and data analytics companies, and reserves the right to use aggregated or de-identified data derived from user inputs without restriction, which may engage tension with emerging state privacy law standards on re-identification risk. The statement engages GDPR and UK GDPR for EU and UK users, the California Consumer Privacy Act as amended by CPRA for California residents, and sector-specific frameworks including the Gramm-Leach-Bliley Act given Intuit's financial product offerings; compliance exposure is heightened by the breadth of data categories processed, the cross-border transfer mechanisms asserted, and the integration of AI and machine learning into data processing described in the statement. Material compliance considerations include the adequacy of consent mechanisms for advertising and behavioral profiling uses, the sufficiency of data subject rights infrastructure across multiple jurisdictions, and the operational implications of Intuit's stated authority to transfer data internationally under standard contractual clauses or equivalent mechanisms.