Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The document states that Marqeta and its third-party service providers may log session-level behavioral data including clicks, page visits, text entered, and time spent on pages, and that this data may be disclosed to third parties for Marqeta's business purposes including marketing and security.
This analysis describes what Marqeta's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The explicit reference to logging text entered during sessions is operationally distinct relative to commonly observed tracking disclosures and may encompass form field content entered before submission. The document authorizes disclosure of session-level data to third parties for business purposes, which in combination with the CCPA sale and sharing provision means this data category may be subject to opt-out rights.
Interpretive note: The document does not specify whether text entry logging encompasses data entered into sensitive form fields prior to form submission; the operational scope of this practice cannot be fully determined from the document language alone.
Under this provision, session-level behavioral data including clicks, text entered into form fields, page visits, and dwell time is collected by Marqeta and its third-party service providers and may be disclosed to third parties for marketing and other business purposes; California residents and residents of applicable U.S. states can opt out of the sharing of internet and network information via the mechanisms described in the respective supplemental notices.
Cross-platform context
See how other platforms handle Session Monitoring and Behavioral Tracking and similar clauses.
Compare across platforms →Monitoring
Marqeta has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We and our third-party service providers may monitor visits to our Services and sessions of users; this monitoring may log the details of your visits to our Services and information generated in the course of using our Services, such as clicks, page visits, text entered, how long you spent on a page, and other details of your visits to or actions on our Services. We use these technologies to collect and retain usage data for the purposes described in this Notice, including for marketing and security purposes and to improve your experience with our Services. We may also disclose any of the data collected by these technologies to third parties for our business purposes.Excerpt from Marqeta's Privacy Policy
1. REGULATORY LANDSCAPE: This provision engages GDPR requirements for lawful basis for processing session-level behavioral data, which may require consent where cookies or similar tracking technologies are used to collect such data in the EEA or UK. The CCPA's internet and network information category encompasses the types of session data described. The FTC's guidance on session replay and behavioral tracking technologies is also relevant, as is the California Privacy Protection Agency's enforcement posture on session replay tools. 2. GOVERNANCE EXPOSURE: Medium. The specific disclosure that text entered during sessions may be logged is an operationally significant detail that extends beyond standard page view or click tracking disclosures. Whether this encompasses text entered into sensitive form fields, such as contact forms or account creation fields, is not addressed in the document. Compliance teams should assess whether the scope of session data collection is reflected in cookie notices and consent mechanisms. 3. JURISDICTION FLAGS: In the EEA and UK, session recording technologies that collect behavioral data typically require consent under GDPR and the applicable e-Privacy framework. California's CCPA categorizes this data as internet and network information, and the document explicitly includes this category in the CCPA sale and sharing disclosure. Illinois BIPA is not directly implicated by text entry logging but may warrant consideration if biometric data were collected as part of session monitoring. 4. CONTRACT AND VENDOR IMPLICATIONS: Third-party service providers conducting session monitoring on Marqeta's behalf must be bound by data processing agreements that address the scope of data collected, permissible use, retention, and disclosure. The document's statement that session data may be disclosed to third parties for business purposes requires that such disclosures be addressed in vendor contracts and, where applicable, in CCPA sale and sharing opt-out mechanisms. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should confirm that the session monitoring tools used by Marqeta and its service providers are disclosed in the Cookies and Related Technologies Notice and that consent mechanisms for EEA and UK users encompass session recording. The scope of text entry logging should be assessed to determine whether it captures data entered into fields containing personal or sensitive information, and whether additional disclosures or consent mechanisms are warranted.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The explicit reference to logging text entered during sessions is operationally distinct relative to commonly observed tracking disclosures and may encompass form field content entered before submission. The document authorizes disclosure of session-level data to third parties for business purposes, which in combination with the CCPA sale and sharing provision means this data category may be subject to opt-out rights.
Under this provision, session-level behavioral data including clicks, text entered into form fields, page visits, and dwell time is collected by Marqeta and its third-party service providers and may be disclosed to third parties for marketing and other business purposes; California residents and residents of applicable U.S. states can opt out of the sharing of internet and network information via …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Marqeta.