Your personal data may be transferred to the United States or other countries where privacy laws are less protective than where you live. MetaMask says it uses standard contractual clauses as a safeguard where legally required.
This analysis describes what MetaMask's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
For EU and UK users, data transferred to the US must be protected by appropriate legal mechanisms; while SCCs are an accepted GDPR transfer tool, their adequacy in practice depends on the specific supplementary measures implemented alongside them.
Interpretive note: The specific SCC modules used and whether supplementary measures have been implemented are not disclosed in the policy text, creating uncertainty about the adequacy of transfer protections in practice.
EU and UK users' personal data, including IP addresses and wallet addresses, may be transferred to the United States and stored there, subject to US law, with GDPR-required protections theoretically in place through standard contractual clauses.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"Consensys operates globally and may transfer your personal information to countries outside of your own, including to the United States, where data protection laws may differ from those in your country. Where required, we use appropriate safeguards such as standard contractual clauses to protect your personal information during such transfers.Excerpt from MetaMask's Privacy Policy
REGULATORY LANDSCAPE: GDPR Chapter V governs international transfers and requires either an adequacy decision, standard contractual clauses, or other approved mechanisms.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
For EU and UK users, data transferred to the US must be protected by appropriate legal mechanisms; while SCCs are an accepted GDPR transfer tool, their adequacy in practice depends on the specific supplementary measures implemented alongside them.
EU and UK users' personal data, including IP addresses and wallet addresses, may be transferred to the United States and stored there, subject to US law, with GDPR-required protections theoretically in place through standard contractual clauses.
ConductAtlas has identified this type of provision across 289 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by MetaMask.