PayPal collects your exact GPS location whenever you are logged into your financial account, and uses this data for both security and advertising purposes.
Change history
modifiedApr 18, 2026
Severity increased from 'medium' to 'high', and the ending excerpt changed from describing personalization benefits to explicitly stating that precise geolocation data is collected while users are logged into financial accounts.
PayPal tracks your precise physical location whenever you are logged into your account — not just for security, but also for personalized advertising — and this data is classified as sensitive personal information requiring opt-in under California law.
What you can do
⚠️ These actions may provide transparency or partial mitigation but may not fully address the underlying issue. Effectiveness varies by jurisdiction and individual circumstances.
Opt Out of Arbitration
Revoke PayPal's access to precise location data by going to your phone's settings, finding the PayPal app under Location permissions, and changing the setting to 'Never' or 'While Using'. Note PayPal may still use your address for approximate location.
Cross-platform context
See how other platforms handle Precise Geolocation Collection from Financial Account Users and similar clauses.
Precise geolocation is classified as sensitive personal information under CCPA/CPRA and GDPR, and its collection while you are logged into a financial account goes beyond what many users would expect from a payment service.
View original clause language
Send you locally relevant options and for security. If you agree to let us track your precise geolocation, we can customize our Services by personalizing language and content such as providing location-based options, functionality or offers, ads and search results. Even if you don't allow us to track your precise location, we may still use your address to send you location-based options recommended by businesses that are near your address. In addition, we will use precise geolocation to enhance the security of the Sites and Services. We collect precise geolocation data from Users while they are logged into their financial account.
1. REGULATORY FRAMEWORK: Precise geolocation is classified as sensitive personal information under CCPA/CPRA §1798.121 (requiring opt-in consent for collection), GDPR Art. 9 context (special category adjacent data with heightened risk), and Washington My Health MY Data Act. The FTC Act Section 5 applies to deceptive geolocation collection practices. Illinois and other state laws may impose additional restrictions on location data use for advertising.
2.
🔒
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
California's CPPA and state attorneys general in California and Washington have enforcement authority over unlawful precise geolocation data collection under CCPA/CPRA and the My Health MY Data Act.