PayPal Privacy Statement

This is PayPal's privacy policy explaining what personal data they collect about you — including your financial records, transaction history, location, biometric data like face scans, inferred income and creditworthiness, and browsing habits — and how they use and share it. The most important thing to know is that PayPal shares your personal and financial data with a very wide range of parties including merchants, partners, credit bureaus, data brokers, fraud agencies, law enforcement, and other financial institutions, and also uses your transaction data to train its AI models. You can limit some data sharing and targeted advertising by reviewing your privacy settings at paypal.com/us/myaccount/privacy/profiles/search.

This document is PayPal's global Privacy Statement governing the collection, use, and disclosure of Personal Information for users of PayPal accounts, websites, and services (excluding Venmo, PayPal Honey, and other designated 'Excluded Services'), with legal bases including consent, contractual necessity, legitimate interests, and legal compliance under GDPR, CCPA, and equivalent frameworks. The statement creates significant obligations for PayPal to disclose data to an expansive range of third parties — including service providers, payment networks, credit reporting agencies, fraud prevention agencies, data brokers, Partners and Merchants, and law enforcement — and imposes on users a certification that they have obtained third-party consent before submitting contact information. Notable provisions include PayPal's explicit use of biometric data (face scans, voice identification) with user consent, the use of Personal Information to train AI models, automated decision-making affecting creditworthiness and fraud determinations, and the collection and inferral of sensitive data categories including income, creditworthiness, and purchasing habits from transaction history. The statement engages GDPR (Arts. 6, 9, 13, 22), UK GDPR, CCPA/CPRA (§1798.100 et seq.), COPPA, GLBA, BSA/AML, and KYC regulatory frameworks, and users in California, the EU, and UK have specific enumerated rights. Material compliance considerations include the breadth of data sharing with Partners and Merchants for targeted advertising and personalized recommendations, the use of automated decision-making without clearly disclosed opt-out mechanisms in all jurisdictions, and cross-border data transfers requiring appropriate safeguards under Chapter V of the GDPR.