Intuit deploys session-replay technologies from FullStory and Medallia that record user interactions including clicks, keystrokes, mouse movements, and scrolls during sessions on Intuit's services. Users can opt out of FullStory recording at a provided URL; a comparable Medallia opt-out link is not specified in the document text provided.
This analysis describes what Intuit's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision discloses the deployment of third-party session-replay tools that capture keystroke-level user interaction data on financial and tax preparation platforms, where users routinely enter sensitive personal and financial information. Legal teams should evaluate this practice under state electronic communications interception statutes, including California's CIPA and similar laws in other states, as well as GDPR transparency and consent requirements for EU users.
The updated terms establish new procedures for handling personal data complaints related to international data transfers under the EU-U.S., UK Extension, and Swiss-U.S. Data Privacy Frameworks. Users from these jurisdictions now have access to defined complaint and dispute resolution mechanisms, including referral to TRUSTe as an alternative dispute provider at no cost, and binding arbitration under certain conditions. Additionally, the policy now requires that before personal data is used for a materially new purpose or shared with external parties not covered as processors, Mailchimp will offer users the opportunity to opt out through appropriate means or collect opt-in consent.
View change record →This discloses previously undisclosed continuous keystroke and interaction recording capabilities, which may capture sensitive financial data and passwords during user sessions.
View full change record →Under this provision, Intuit's services record detailed interaction data including keystrokes and mouse movements using third-party session-replay vendors FullStory and Medallia. The agreement provides an opt-out mechanism for FullStory recording but does not specify an equivalent Medallia opt-out in the text provided.
Cross-platform context
See how other platforms handle Session Replay Technology Deployment and similar clauses.
Compare across platforms →"We may use session-replay technologies, such as those provided by FullStory and Medallia, that employ software code to record users' interactions with the Services in a manner that allows us to watch video replays of those user sessions. The replays include users' clicks, mobile app touches, mouse movements, scrolls and keystrokes/key touches during those sessions. These replays help us diagnose usability problems and identify areas for improvement. You can learn more about FullStory at https://www.fullstory.com/legal/privacy-policy and you can opt-out of session recording by FullStory at https://www.fullstory.com/optout/Excerpt from Intuit's Privacy Statement
(1) REGULATORY LANDSCAPE: This provision engages state electronic communications interception statutes, most notably California's Invasion of Privacy Act (CIPA), which has been the subject of class action litigation involving session replay tools on financial and …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision discloses the deployment of third-party session-replay tools that capture keystroke-level user interaction data on financial and tax preparation platforms, where users routinely enter sensitive personal and financial information. Legal teams should evaluate this practice under state electronic communications interception statutes, including California's CIPA and similar laws in other states, as well as GDPR transparency and consent requirements for …
Under this provision, Intuit's services record detailed interaction data including keystrokes and mouse movements using third-party session-replay vendors FullStory and Medallia. The agreement provides an opt-out mechanism for FullStory recording but does not specify an equivalent Medallia opt-out in the text provided.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Intuit.