Governance document

CA-D-000169

Plaid End User Privacy Policy [SPA-QUARANTINE: needs human capture]

Plaid

Last change detected April 21, 2026 Privacy policy

SHA-256: 0a8d827572962cc5012… 4 versions captured 4 changes documented

Follow Plaid →

Get the weekly research letter

Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.

View original document at Plaid ↗

This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology

8 Total

3 High severity

3 Medium severity

2 Low severity

Get alerted the next time Plaid changes these terms. Follow Plaid →

Summary

This document describes how Plaid collects, uses, and shares your personal and financial data when you connect accounts through apps built on Plaid's platform. Plaid may use your data to build and train AI systems, and it shares your data with the app developer you are using and as that developer directs. Your data is deleted when the developer removes your connection—not when you request it—though certain exceptions allow Plaid to keep it even after that.

Analysis

This document establishes Plaid's data collection, use, sharing, and retention practices for end users of applications built on Plaid's platform. It authorizes Plaid to collect and process biometric facial geometry data for identity verification and to use end user data broadly to develop, train, test, and deploy AI systems, while imposing an absolute prohibition—covering both Plaid and its service providers—on using identity document information, photographs, video images, or derived facial geometry to enhance or develop services. Data deletion is triggered by developer action rather than user action and is subject to unspecified exceptions permitting retention; residents of Illinois or Texas are subject to a specific three-year retention cap on facial geometry data. Developers are bound by obligations including prohibitions on selling or renting end user data, export-sanctions compliance certifications covering affiliated entities, and liability to suspension or termination of access upon any policy violation.

What this means for you

As an end user, your personal and financial data is shared with the developer of the app you are using, and that developer directs further sharing, without this document specifying additional user consent for developer-directed sharing. Plaid may use your data to develop and train AI systems. If you live in Illinois or Texas, your facial geometry data is retained for no longer than three years. Because deletion is triggered by a developer removing your connection—not by a user request—users who want their data removed may need to contact the developer of the app through which they connected their accounts.

Institutional Analysis

Institutional analysis available with Insight

Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.

Monitor your companies for $4.99/mo → Follow Plaid → Start free Get the weekly digest, free

4 important changes detected

4 versions captured · Last updated: April 2026

April 21, 2026

high

What changed Plaid updated its Developer Policy on April 21, 2026, making significant changes to how developers must manage account access and handle end user data. The policy now explicitly requires developers to designate 'Authorized Users' and maintain sole responsibility for their access to accounts and end user data. The updated terms also introduce new monitoring capabilities, clarify enforcement mechanisms, and expand the scope of what constitutes a policy violation.

Why this matters End consumers may see their financial data accessed by a broader range of people under developer accounts, but Plaid now requires developers to formally designate and manage these 'Authorized Users' and take responsibility for their conduct. The introduction of session replay and activity monitoring means developer interactions with your financial data may be recorded for audit or security purposes. The policy does not specify what data is covered by monitoring or how long recordings are retained, which creates operational uncertainty for developers handling sensitive consumer financial information.

View full change record →

April 19, 2026

medium

What changed Plaid restructured its account terms to clarify the role of the Plaid Account and introduced a new Plaid Monitoring Service. The updated language shifts focus from helping you connect to third-party apps more quickly to emphasizing Plaid's direct provision of streamlined services and account monitoring. The terms now explicitly state that a Plaid Account enables Plaid to share information that third-party apps need to initiate payments to or from you, expanding the stated functional scope of the account beyond connection management.

Why this matters Plaid's updated terms establish a new direct relationship with you through the Plaid Account and introduce a monitoring service that operates through a web app. The terms now authorize Plaid to share financial information needed for third-party apps to initiate payments to or from you, which is a broader statement of data-sharing scope than the previous language. This means Plaid's role shifts from primarily facilitating connections to third-party apps toward directly providing account services, including monitoring. The effective date is April 14, 2026, though the change was detected on April 19, 2026. Review your Plaid Account settings to understand what data Plaid holds and how the monitoring service works.

View full change record →

April 16, 2026 low

Plaid restructured its account terms to emphasize a new direct-to-consumer Plaid Web-App monitoring service alongside its core financial account connection functionality. The updated language clarifies that a Plaid Account now …

View change record →

April 3, 2026 medium

Plaid's privacy policy was substantially revised on April 3, 2026, with 46 sentences added, 76 removed, and 149 modified. The updated terms shift focus from describing a 'Plaid Account' primarily …

View change record →

Featured, High severity

Credential-Based Account Access and Agency Authorization

The policy states that when users provide login credentials (username, password, account and routing numbers, security tokens) to connect their financial accounts, they grant Plaid explicit permission and authority to act on their behalf to access and transmit data to and from their financial institution. This authorization extends to collecting security questions, answers, and one-time passwords as needed.

Added July 9, 2026 Unique
AI Development and Training Using Financial Data

The policy authorizes Plaid to use collected data including transaction histories, financial data, and app-connection data to develop, train, test, and deploy AI systems, and to develop insights shared with financial institutions and app developers. The policy does not specify whether this use is subject to a separate opt-out mechanism.

Added July 9, 2026 Unique
Biometric Data Collection and Retention

The policy discloses that Plaid may collect photographs, videos, and facial geometry scans for identity verification purposes, and that this data may constitute biometric data in certain jurisdictions. For Illinois and Texas residents specifically, the policy states facial geometry data will be stored for no longer than three years unless otherwise required by law.

Added July 9, 2026 Unique

Featured, Medium severity

Data Deletion Exceptions Upon Developer Disconnection

The policy states that Plaid's systems are designed to automatically delete personal data when a developer disconnects a user's app connection, but identifies six enumerated exceptions under which data may be retained, including active connections with other developers, fraud prevention purposes, legal retention requirements, and aggregated or de-identified data.

Added July 9, 2026 Unique
Data Sharing with Developers and Third Parties

The policy authorizes sharing user data with app developers and as directed by developers, financial institutions, service providers, partners, agents, contractors, professional advisors, fraud prevention services, identity verification services, cloud storage providers, Plaid affiliates, and governmental authorities when legally required. For US users, the policy states that sharing with non-affiliated third parties is limited to what is permitted under GLBA's Regulation P (12 C.F.R. §§ 1016.13, 1016.14, and 1016.15).

Added July 9, 2026 Unique
International Data Transfers

The policy states that Plaid transfers data from the EEA and UK to the United States and stores data in AWS regions in the United States, relying on adequacy decisions, standard contractual clauses, or other approved mechanisms for these transfers. Plaid states it conducts transfer impact assessments and implements supplementary measures prior to EEA or UK transfers.

Added July 9, 2026 Unique

Featured, Low severity

User Data Rights and Access Controls

The policy states that Plaid will honor data access, rectification, erasure, restriction, objection, consent withdrawal, and portability rights for all users regardless of location, subject to limitations and exceptions provided by law. Users can submit requests through Plaid's online form or by contacting privacy@plaid.com.

Added July 9, 2026 Unique
Plaid Portal User Control Mechanism

The policy describes Plaid Portal (available at my.plaid.com) as a centralized dashboard for US users to view financial account connections made through Plaid, review the types of data shared with each app, terminate specific app connections, and request deletion of associated data. Access requires phone number and email verification.

Added July 9, 2026 Unique