California residents have specific legal rights under state law to know what financial data Plaid has collected, to delete it, and to opt out of having it sold or shared with others.
This analysis describes what Plaid's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
CCPA and CPRA provide California residents with more specific and enforceable privacy rights than federal law currently requires, including an explicit opt-out of data sale or sharing that can limit Plaid's use of your financial data for commercial purposes.
Interpretive note: Verbatim CCPA/CPRA provision language was not available in the truncated document; this characterization reflects Plaid's publicly documented California rights disclosures.
End consumers may see their financial data accessed by a broader range of people under developer accounts, but Plaid now requires developers to formally designate and manage these 'Authorized Users' and take responsibility for their conduct. The introduction of session replay and activity monitoring means developer interactions with your financial data may be recorded for audit or security purposes. The policy does not specify what data is covered by monitoring or how long recordings are retained, which creates operational uncertainty for developers handling sensitive consumer financial information.
View change record →Plaid's updated terms establish a new direct relationship with you through the Plaid Account and introduce a monitoring service that operates through a web app. The terms now authorize Plaid to share financial information needed for third-party apps to initiate payments to or from you, which is a broader statement of data-sharing scope than the previous language. This means Plaid's role shifts from primarily facilitating connections to third-party apps toward directly providing account services, including monitoring. The effective date is April 14, 2026, though the change was detected on April 19, 2026. Review your Plaid Account settings to understand what data Plaid holds and how the monitoring service works.
View change record →The updated terms clarify that Plaid may request and collect phone numbers, email addresses, and other contact information when you connect financial accounts or verify your identity through a Plaid-connected application. The terms no longer describe a separate Plaid Monitoring Service or Plaid Web-App. The Plaid Account is now framed primarily as a tool to accelerate onboarding and use of third-party applications rather than as a standalone service for monitoring and alerts. The updated language authorizes Plaid to store identity verification data within your Plaid Account if you choose to do so.
View change record →California residents can opt out of the sale or sharing of their personal information, including financial transaction data, which limits Plaid's ability to use that data for cross-context behavioral advertising or to sell it to third parties.
How other platforms handle this
If you are a California resident, you may have the right to: Know what personal information we collect, use, disclose, sell, or share. Correct inaccurate personal information. Delete your personal information. Opt out of the sale or sharing of your personal information. Limit the use and disclosure ...
If you are a California resident, you have the right to: Know what personal information is being collected about you; Know whether your personal information is sold or disclosed and to whom; Say no to the sale of personal information; Access your personal information; Request deletion of your person...
If you are a California resident, you have the right to know what personal information we collect, use, and disclose about you; the right to request deletion of your personal information; the right to opt out of the sale or sharing of your personal information; the right to correct inaccurate person...
Monitoring
Plaid has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"If you are a California resident, you have certain rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the right to know what personal information we collect, the right to delete your personal information, the right to opt-out of the sale or sharing of your personal information, and the right to non-discrimination for exercising your privacy rights.— Excerpt from Plaid's Plaid End User Privacy Policy
REGULATORY LANDSCAPE: CCPA and CPRA are enforced by the California Privacy Protection Agency (CPPA) and the California Attorney General. CPRA introduced significant enhancements including rights over sensitive personal information (which includes financial account data and credentials), the right to correct, and limits on data retention. The intersection of CPRA's sensitive data protections with Plaid's credential and transaction data collection is a high-priority compliance area. GOVERNANCE EXPOSURE: High for California operations. Plaid's data model, which involves collecting sensitive financial information through third-party application flows, engages CPRA's consent and use limitation requirements for sensitive personal information. The requirement to provide a clear and conspicuous opt-out of sale and sharing must be implemented in Plaid's consumer-facing interfaces and honored across Plaid's internal data flows and developer partner relationships. JURISDICTION FLAGS: California creates the primary US state-level exposure. Other states with comprehensive privacy laws (Virginia, Colorado, Connecticut, Texas, Florida and others) have similar but not identical rights frameworks, and compliance teams should assess Plaid's compliance with each applicable state law as the state privacy law landscape continues to evolve. Illinois BIPA is not directly implicated by financial transaction data but may be relevant if Plaid uses biometric authentication in any product flows. CONTRACT AND VENDOR IMPLICATIONS: Developer partners operating as businesses under CCPA must ensure that their use of Plaid's API is consistent with consumer opt-out rights. If a consumer has opted out of sale or sharing with Plaid, that signal must be honored in the developer partner's data flows. Service provider agreements between Plaid and developer partners should include CPRA-compliant contractual terms. COMPLIANCE CONSIDERATIONS: Compliance teams should audit the implementation of California rights requests through my.plaid.com, verify that opt-out of sale or sharing signals (including Global Privacy Control where required) are honored, and assess whether Plaid's data retention practices for California residents comply with CPRA's storage limitation principle. The CPPA has issued enforcement guidance on sensitive personal information that should be reviewed against Plaid's credential handling practices.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
CCPA and CPRA provide California residents with more specific and enforceable privacy rights than federal law currently requires, including an explicit opt-out of data sale or sharing that can limit Plaid's use of your financial data for commercial purposes.
California residents can opt out of the sale or sharing of their personal information, including financial transaction data, which limits Plaid's ability to use that data for cross-context behavioral advertising or to sell it to third parties.
ConductAtlas has identified this type of provision across 12 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Plaid.