Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Intuit deploys session-replay technologies from FullStory and Medallia that record user interactions including clicks, keystrokes, mouse movements, and scrolls during sessions on Intuit's services. Users can opt out of FullStory recording at a provided URL; a comparable Medallia opt-out link is not specified in the document text provided.
This analysis describes what Intuit's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision discloses the deployment of third-party session-replay tools that capture keystroke-level user interaction data on financial and tax preparation platforms, where users routinely enter sensitive personal and financial information. Legal teams should evaluate this practice under state electronic communications interception statutes, including California's CIPA and similar laws in other states, as well as GDPR transparency and consent requirements for EU users.
The updated terms establish new procedures for handling personal data complaints related to international data transfers under the EU-U.S., UK Extension, and Swiss-U.S. Data Privacy Frameworks. Users from these jurisdictions now have access to defined complaint and dispute resolution mechanisms, including referral to TRUSTe as an alternative dispute provider at no cost, and binding arbitration under certain conditions. Additionally, the policy now requires that before personal data is used for a materially new purpose or shared with external parties not covered as processors, Mailchimp will offer users the opportunity to opt out through appropriate means or collect opt-in consent.
View change record →Under this provision, Intuit's services record detailed interaction data including keystrokes and mouse movements using third-party session-replay vendors FullStory and Medallia. The agreement provides an opt-out mechanism for FullStory recording but does not specify an equivalent Medallia opt-out in the text provided.
Cross-platform context
See how other platforms handle Session Replay Technology Deployment and similar clauses.
Compare across platforms →Monitoring
Intuit has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We may use session-replay technologies, such as those provided by FullStory and Medallia, that employ software code to record users' interactions with the Services in a manner that allows us to watch video replays of those user sessions. The replays include users' clicks, mobile app touches, mouse movements, scrolls and keystrokes/key touches during those sessions. These replays help us diagnose usability problems and identify areas for improvement. You can learn more about FullStory at https://www.fullstory.com/legal/privacy-policy and you can opt-out of session recording by FullStory at https://www.fullstory.com/optout/Excerpt from Intuit's Privacy Statement
(1) REGULATORY LANDSCAPE: This provision engages state electronic communications interception statutes, most notably California's Invasion of Privacy Act (CIPA), which has been the subject of class action litigation involving session replay tools on financial and e-commerce platforms. It also implicates GDPR Articles 5, 6, and 13 for EU and UK users, requiring a valid lawful basis for session recording and adequate transparency. The FTC Act's prohibition on unfair or deceptive practices is relevant to the extent recording occurs without adequate consumer notice. Relevant enforcement authorities include State AGs, EU supervisory authorities, the UK ICO, and potentially private plaintiffs under state wiretapping statutes. (2) GOVERNANCE EXPOSURE: High. The deployment of session-replay tools on platforms where users enter tax return data, Social Security numbers, financial account credentials, and payroll information creates significant legal exposure under state wiretapping and electronic communications laws. Active litigation in California and other states regarding session replay on financial platforms represents a material risk area, though the document's explicit disclosure may be relevant to notice-based defenses. (3) JURISDICTION FLAGS: California (CIPA), Illinois, Pennsylvania, Maryland, and other all-party consent states create heightened exposure for session replay recording. EU and UK users face GDPR lawful basis and transparency requirements. The absence of a specified Medallia opt-out mechanism in the document text may create additional exposure in jurisdictions requiring affirmative consent or accessible opt-out procedures. (4) CONTRACT AND VENDOR IMPLICATIONS: Data processing agreements with FullStory and Medallia should be reviewed to confirm that keystroke and interaction data is not used by those vendors for their own purposes beyond providing services to Intuit, and that those agreements satisfy GDPR Article 28 and CCPA service provider requirements. The scope of data captured by session replay tools on pages where sensitive financial information is entered should be confirmed against contractual data minimization commitments. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should audit whether session replay captures are masked or excluded on pages where users enter sensitive financial identifiers such as Social Security numbers, bank account numbers, or tax identification numbers. Consent mechanisms for EU and UK users should be reviewed to confirm session replay is covered by an adequate lawful basis. The absence of a Medallia opt-out URL in the document warrants clarification to ensure parity of opt-out mechanisms across deployed session replay vendors.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision discloses the deployment of third-party session-replay tools that capture keystroke-level user interaction data on financial and tax preparation platforms, where users routinely enter sensitive personal and financial information. Legal teams should evaluate this practice under state electronic communications interception statutes, including California's CIPA and similar laws in other states, as well as GDPR transparency and consent requirements for …
Under this provision, Intuit's services record detailed interaction data including keystrokes and mouse movements using third-party session-replay vendors FullStory and Medallia. The agreement provides an opt-out mechanism for FullStory recording but does not specify an equivalent Medallia opt-out in the text provided.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Intuit.