Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
When users access Intuit products through a business account such as QuickBooks, the business owner or administrator controls access rights, can make decisions about the user's personal information including payroll details, and can require location tracking for functions like time-keeping, with Intuit acting as a separate independent data controller from the employer.
This analysis describes what Intuit's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that employees or contractors accessing Intuit's platform through a business account are subject to administrator controls over their personal information, including the ability to require location tracking. The document states Intuit is not responsible for the privacy or security practices of the business, and users should review the business's own policies separately.
The updated terms establish new procedures for handling personal data complaints related to international data transfers under the EU-U.S., UK Extension, and Swiss-U.S. Data Privacy Frameworks. Users from these jurisdictions now have access to defined complaint and dispute resolution mechanisms, including referral to TRUSTe as an alternative dispute provider at no cost, and binding arbitration under certain conditions. Additionally, the policy now requires that before personal data is used for a materially new purpose or shared with external parties not covered as processors, Mailchimp will offer users the opportunity to opt out through appropriate means or collect opt-in consent.
View change record →The updated privacy statement removes detailed disclosures about how Intuit uses cookies, pixels, and tracking technologies to deliver targeted advertising. Previously, the policy explicitly stated that Intuit and advertising partners may disclose information like IP addresses and device identifiers to show more relevant ads, and that users could opt-out through 'Customize Settings'. The revised statement now references only a separate Cookies Policy without reproducing this information inline. Users seeking specifics on cookie consent options and advertising data sharing must consult the linked Cookies Policy document.
View change record →The updated privacy policy removes prior explicit disclosures about third-party advertising cookies and opt-out mechanisms that were previously available to users. Specifically, the policy no longer states that users can decline third-party advertising cookies through a 'Customize Settings' option, nor does it describe how advertising partners may receive limited personal information like IP addresses and device identifiers for ad targeting. The footer now contains only a general reference to cookie management without the prior transparency on advertising partner data sharing. You can review Intuit's full Cookies Policy for current information on how cookies and advertising technologies are used.
View change record →Under this provision, employees or contractors using Intuit products through an employer-administered business account may have their payroll details, access rights, and location data controlled by the business administrator rather than by individual account settings. Intuit states it acts as an independent data controller separate from the employer, and is not responsible for the employer's privacy or security practices.
Cross-platform context
See how other platforms handle Business Account Administrator Controls and similar clauses.
Compare across platforms →Monitoring
Intuit has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"If you are granted access to a business account (for example, in QuickBooks), the business owner or a designated administrator may control and administer details of your account, for example, by deciding your access rights; making decisions about your personal information (such as details about your payroll); or requiring you to take certain actions (for example, use location tracking to clock in for a shift). If the owner or designated administrator changes your access rights, then you may lose access to the information the business controls.Excerpt from Intuit's Privacy Statement
(1) REGULATORY LANDSCAPE: This provision engages GDPR and UK GDPR requirements regarding joint controller arrangements and the allocation of controller responsibilities, as Intuit asserts it acts as an independent data controller separate from the employer even when processing employee data through business accounts. Employment data privacy laws in EU member states and the UK impose additional requirements for processing employee personal information including payroll and location data. The CCPA and CPRA provisions governing employee data are also relevant for California-based employees. (2) GOVERNANCE EXPOSURE: Medium. The independent controller framing means Intuit asserts it is not responsible for the employer's privacy practices regarding data processed in business accounts, but employees may not clearly understand that two separate data controllers govern their information. Location tracking requirements imposed by employers through the Intuit platform raise employment privacy compliance questions under applicable state and national laws. (3) JURISDICTION FLAGS: EU member states with employment-specific data protection requirements, the UK, and California (where CPRA establishes specific employee data rights) create heightened exposure for this provision. Location tracking of employees via mobile devices engages state-specific employee monitoring laws in several US states. (4) CONTRACT AND VENDOR IMPLICATIONS: Employers using QuickBooks or other Intuit business products that access employee personal information should review their own privacy notices and employee data processing agreements to confirm consistency with how Intuit processes that data. The independent controller framing means employers cannot rely on Intuit's privacy statement to cover their own data processing obligations toward employees. (5) COMPLIANCE CONSIDERATIONS: HR and legal teams at businesses using Intuit's platform should audit whether employee notices adequately disclose the role of Intuit as an independent data controller processing employee payroll, location, and access data. For EU employers, a data protection impact assessment may be required for location tracking features. Employers should confirm that location tracking is enabled only with appropriate employee consent or legal basis under applicable employment law.
This provision establishes that employees or contractors accessing Intuit's platform through a business account are subject to administrator controls over their personal information, including the ability to require location tracking. The document states Intuit is not responsible for the privacy or security practices of the business, and users should review the business's own policies separately.
Under this provision, employees or contractors using Intuit products through an employer-administered business account may have their payroll details, access rights, and location data controlled by the business administrator rather than by individual account settings. Intuit states it acts as an independent data controller separate from the employer, and is not responsible for the employer's privacy or security practices.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Intuit.