PayPal states it may generate inferred data about you, including your gender, estimated income, creditworthiness, and shopping preferences, derived from your transactions and browsing activity on PayPal and partner sites.
This analysis describes what PayPal's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision discloses that PayPal may derive sensitive attributes, including income and creditworthiness estimates, from transaction behavior without requiring separate consent for each inferred attribute, and that these inferences may be used in product recommendations and risk assessments.
Interpretive note: Whether inferred creditworthiness in this context triggers FCRA obligations depends on how the inferences are used in credit-related decisions, which is not fully specified in the reviewed document text.
PayPal may infer your income level and creditworthiness from your transaction history and use these inferences in risk analysis and product personalization; under CCPA/CPRA, inferences that create a consumer profile may be subject to deletion and opt-out rights, which California residents can exercise through PayPal's privacy settings.
How other platforms handle this
We collect your personal data when you use our Services, create a new eBay account, provide us with information via a web form, add or update information in your eBay account, participate in online community discussions or otherwise interact with us.
At Ledger, earning and maintaining our users' trust is a top priority. That's why we are deeply committed not only to protecting your privacy and securing your personal data, but also to being fully transparent about how we handle it.
If we collect health information from these integrations (such as heart rate), we will not sell or use it for advertising or other similar purposes; we do not disclose it to third parties without your prior consent; and we will only use it for the specific purposes described in this Policy.
Monitoring
PayPal has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Inferred data: Such as gender, income, browsing and purchasing habits, creditworthiness, fraud and risk assessment, your preferences and shopping behavior, which we may infer based on your transactions and interactions with our Services, ads and offers or with our Partners and Merchants.— Excerpt from PayPal's PayPal Privacy Statement
REGULATORY LANDSCAPE: This provision engages CCPA/CPRA, which defines inferences drawn from personal information to create a consumer profile as personal information subject to disclosure, deletion, and opt-out rights. The California Privacy Protection Agency and California Attorney General are the relevant enforcement authorities. Under GDPR, profiling involving special category inferences (such as inferred financial circumstances affecting creditworthiness) requires a documented lawful basis and, in some national implementations, explicit consent. The FTC has also addressed the use of inferred data in consumer financial contexts under its unfair or deceptive practices authority. GOVERNANCE EXPOSURE: High. The explicit disclosure that inferred categories include gender, income, and creditworthiness places these inferences within the scope of sensitive or special category data in several jurisdictions. Using inferred creditworthiness in product suitability or risk assessments may also implicate the Equal Credit Opportunity Act and Fair Credit Reporting Act in the United States if these inferences influence credit-related decisions. JURISDICTION FLAGS: California (CCPA/CPRA), EU/EEA and UK (GDPR profiling and special category data provisions), and US federal (ECOA and FCRA where inferred creditworthiness informs credit decisions) create heightened exposure. Illinois BIPA is not directly implicated by this provision, but the combination of biometric data and inferred attributes may create aggregated sensitivity concerns. CONTRACT AND VENDOR IMPLICATIONS: If inferred data is shared with Partners and Merchants for product recommendations as described elsewhere in the document, vendor and partner agreements should specify the categories of inferences that may be shared and the purposes for which they may be used. Procurement teams should verify that partner agreements prohibit use of inferred data for purposes not disclosed in this statement. COMPLIANCE CONSIDERATIONS: Compliance teams should (1) assess whether the lawful basis for generating and processing inferred special category attributes such as income and creditworthiness is adequately documented under GDPR; (2) confirm that CCPA/CPRA disclosures cover inferred data as a category of personal information collected; (3) evaluate whether inferred creditworthiness used in product suitability decisions triggers FCRA obligations; and (4) audit whether user-facing rights to access, correct, or delete inferred data profiles are implemented and accessible.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision discloses that PayPal may derive sensitive attributes, including income and creditworthiness estimates, from transaction behavior without requiring separate consent for each inferred attribute, and that these inferences may be used in product recommendations and risk assessments.
PayPal may infer your income level and creditworthiness from your transaction history and use these inferences in risk analysis and product personalization; under CCPA/CPRA, inferences that create a consumer profile may be subject to deletion and opt-out rights, which California residents can exercise through PayPal's privacy settings.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by PayPal.