Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The terms reference a consumer portal at my.plaid.com through which consumers can view connected applications, revoke data access permissions, and submit requests for deletion of their stored financial data.
This analysis describes what Plaid's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the primary operational mechanism through which consumers can exercise data rights, including revocation of financial account access and deletion requests, under both Plaid's stated terms and applicable regulatory frameworks including CCPA and GDPR.
Interpretive note: Specific deletion timelines and the full scope of rights exercisable through the portal were not directly quotable from the truncated document text provided.
Developers who use Plaid's services now face expanded accountability for all activities on their accounts and stricter rules around who can access end-user financial data. If developers allow employees, contractors, or other agents to access their accounts, they must ensure those users only access data for approved business purposes and in compliance with Plaid's terms; Plaid reserves the right to monitor this activity through session replay and activity monitoring. Developers should audit which team members have account access, document the business need and approved use case for each, and ensure all authorized users understand their obligations under Plaid's terms.
View change record →Plaid's updated terms shift its business model from primarily connecting your accounts to third-party apps toward also providing direct consumer services, including account monitoring and alerts through a new web-based platform called Plaid Web-App. The terms now specify that your Plaid Account can store your financial and identity information, and that Plaid can use this data to provide its own streamlined services (like alerts and notifications) in addition to facilitating third-party app connections. This is not a privacy reduction, but a clarification that Plaid is now a service provider in its own right, not just an intermediary. You may want to review what the Plaid Web-App monitoring service entails and what data it collects, since it is a new direct service from Plaid rather than a third-party app feature.
View change record →Plaid has reframed its service model to emphasize a direct relationship between you and Plaid, rather than positioning itself primarily as a bridge to third-party apps. This means Plaid now states it provides services directly to you when you request them. Additionally, Plaid has introduced a new account monitoring and alerts service available via a web application directly to consumers, separate from third-party app integrations. The terms clarify that your Plaid Account remains non-transactional and does not store funds or enable direct payments, but now explicitly mentions it helps third-party apps initiate payments to or from you. You may wish to review the new web-based monitoring service offering and understand what account data it accesses and how it uses that data.
View change record →The agreement provides a dedicated consumer portal at my.plaid.com where consumers can identify all applications connected to their financial accounts through Plaid, disconnect those applications, and request deletion of stored financial data; use of this portal is the designated mechanism for exercising data subject rights.
How other platforms handle this
If you would like to access/download, delete, your data, please submit your request through our automated, self-service system.
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
to request that your data be transferred to a third party (data portability)
Monitoring
Plaid has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
1) REGULATORY LANDSCAPE: This provision engages CCPA/CPRA consumer rights to know, delete, and opt out of data sharing; GDPR Articles establishing data subject rights including the right to erasure and the right to restrict processing; and GLBA's requirement that consumers have access to information about how their nonpublic personal financial information is used. The CFPB's rulemaking on consumer financial data rights under Section 1033 of the Dodd-Frank Act is also relevant, as it may establish additional affirmative access and portability obligations. 2) GOVERNANCE EXPOSURE: Medium. The existence of a consumer portal satisfies baseline transparency obligations, but the terms reviewed do not specify binding deletion completion timelines in publicly visible policy text, which may require evaluation against CCPA's 45-day response requirement and GDPR's one-month response requirement. The adequacy of the portal as a complete data subject rights mechanism depends on whether it covers all processing activities including Plaid's independent uses. 3) JURISDICTION FLAGS: California residents have statutory rights under CCPA/CPRA with defined response timelines and appeal rights. EU and UK data subjects have GDPR rights with mandatory response timelines and the right to complain to supervisory authorities. The portal mechanism's adequacy as a GDPR-compliant data subject rights interface requires verification. 4) CONTRACT AND VENDOR IMPLICATIONS: Developer partners should confirm that their data processing agreements with Plaid address how consumer deletion requests submitted through the Plaid portal affect data held by the partner, and whether partners receive notification of consumer revocation events to ensure coordinated data lifecycle management. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should verify that the portal's deletion workflow satisfies applicable response timeframes under CCPA (45 days, extendable to 90) and GDPR (one month, extendable to three); evaluate whether partial deletion scenarios (e.g., retention for fraud prevention) are adequately disclosed; and confirm that the portal is accessible to all user populations including those without active Plaid accounts.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes the primary operational mechanism through which consumers can exercise data rights, including revocation of financial account access and deletion requests, under both Plaid's stated terms and applicable regulatory frameworks including CCPA and GDPR.
The agreement provides a dedicated consumer portal at my.plaid.com where consumers can identify all applications connected to their financial accounts through Plaid, disconnect those applications, and request deletion of stored financial data; use of this portal is the designated mechanism for exercising data subject rights.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Plaid.