Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Under the Gramm-Leach-Bliley Act, PayPal discloses it shares financial personal information with affiliates for creditworthiness purposes, with affiliates for marketing, and with nonaffiliates for marketing, and provides an opt-out mechanism for these three categories. Sharing for everyday business purposes, PayPal's own marketing, and joint marketing with financial companies cannot be limited.
This analysis describes what PayPal's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the GLBA-required financial privacy notice, identifying which sharing practices are subject to opt-out and which are not. The 30-day window before sharing begins for new customers is a standard GLBA provision, and the opt-out is available by phone or through account settings.
⚠ PayPal will share financial personal information with affiliates for creditworthiness and marketing purposes and with nonaffiliates for marketing as described in the notice, 30 days after notice delivery for new customers, unless the user opts out
Cross-platform context
See how other platforms handle GLBA Financial Privacy Notice and Sharing Opt-Out and similar clauses.
Compare across platforms →Monitoring
PayPal has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"For our affiliates' everyday business purposes – information about your creditworthiness Yes Yes For our affiliates to market to you Yes Yes For our nonaffiliates to market to you Yes Yes To limit our sharing: You may limit certain sharing by logging into your PayPal Account and editing your preferences in the Data and Privacy setting. Call 1-888-221-1161 to limit all sharing where permitted. Please note: If you are a new customer, we can begin sharing your information 30 days from the date we sent this notice.Excerpt from PayPal's Privacy Statement
(1) REGULATORY LANDSCAPE: This provision is required by the Gramm-Leach-Bliley Act and its implementing regulations, enforced by the FTC for non-bank financial institutions such as PayPal. The notice format and content requirements are prescribed by the FTC's Privacy of Consumer Financial Information Rule (Regulation P equivalent). The CFPB has authority over certain financial privacy practices affecting consumers of consumer financial products. (2) GOVERNANCE EXPOSURE: Medium. The GLBA notice is a standard required disclosure, and PayPal's structure follows the model form requirements. The provision that sharing for everyday business purposes and joint marketing cannot be limited is consistent with GLBA requirements and is not a policy choice by PayPal. (3) JURISDICTION FLAGS: California, Vermont, and North Dakota impose stricter state financial privacy requirements, and the policy references supplemental state notices for these jurisdictions. California-addressed accounts are subject to additional sharing restrictions under California law. Vermont-addressed accounts are subject to restrictions on creditworthiness sharing with affiliates and nonaffiliate marketing sharing. (4) CONTRACT AND VENDOR IMPLICATIONS: The identification of Bill Me Later, Inc. as an affiliate and the reference to joint marketing partners as financial companies and banks are relevant for entities assessing their relationship with PayPal's corporate group for data governance purposes. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should confirm that the opt-out mechanism referenced in the GLBA notice (Data and Privacy settings and the 1-888-221-1161 phone line) is currently operational and that new customer 30-day notice delivery procedures are documented. State supplemental notices for California, Vermont, and North Dakota should be reviewed for consistency with the main GLBA notice.
This provision establishes the GLBA-required financial privacy notice, identifying which sharing practices are subject to opt-out and which are not. The 30-day window before sharing begins for new customers is a standard GLBA provision, and the opt-out is available by phone or through account settings.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by PayPal.