Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The terms indicate that Plaid may retain consumer financial data after a consumer disconnects an application, subject to described retention limits, and that consumers must separately exercise deletion rights through the Plaid consumer portal to request removal of retained data.
This analysis describes what Plaid's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that disconnecting an application through a partner interface does not automatically result in deletion of financial data from Plaid's systems, and that consumers must take an additional affirmative step through the Plaid portal to request data deletion.
Interpretive note: Specific retention periods and the precise conditions under which data is retained post-disconnection were not directly quotable from the truncated document; description reflects publicly known Plaid data practices and document context.
Developers who use Plaid's services now face expanded accountability for all activities on their accounts and stricter rules around who can access end-user financial data. If developers allow employees, contractors, or other agents to access their accounts, they must ensure those users only access data for approved business purposes and in compliance with Plaid's terms; Plaid reserves the right to monitor this activity through session replay and activity monitoring. Developers should audit which team members have account access, document the business need and approved use case for each, and ensure all authorized users understand their obligations under Plaid's terms.
View change record →Plaid's updated terms shift its business model from primarily connecting your accounts to third-party apps toward also providing direct consumer services, including account monitoring and alerts through a new web-based platform called Plaid Web-App. The terms now specify that your Plaid Account can store your financial and identity information, and that Plaid can use this data to provide its own streamlined services (like alerts and notifications) in addition to facilitating third-party app connections. This is not a privacy reduction, but a clarification that Plaid is now a service provider in its own right, not just an intermediary. You may want to review what the Plaid Web-App monitoring service entails and what data it collects, since it is a new direct service from Plaid rather than a third-party app feature.
View change record →Plaid has reframed its service model to emphasize a direct relationship between you and Plaid, rather than positioning itself primarily as a bridge to third-party apps. This means Plaid now states it provides services directly to you when you request them. Additionally, Plaid has introduced a new account monitoring and alerts service available via a web application directly to consumers, separate from third-party app integrations. The terms clarify that your Plaid Account remains non-transactional and does not store funds or enable direct payments, but now explicitly mentions it helps third-party apps initiate payments to or from you. You may wish to review the new web-based monitoring service offering and understand what account data it accesses and how it uses that data.
View change record →Under this provision, financial account data including transaction history and identity information collected through a Plaid-powered app connection may remain in Plaid's systems after the consumer disconnects the app, unless the consumer separately submits a deletion request at my.plaid.com.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
Monitoring
Plaid has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
1) REGULATORY LANDSCAPE: Post-disconnection data retention engages CCPA/CPRA data minimization and deletion rights, which require businesses to delete personal information upon verified consumer request within 45 days; GDPR's storage limitation principle, which requires personal data not be kept longer than necessary for the stated purpose; and GLBA's data retention and disposal requirements. The CFPB's emerging Section 1033 rulemaking may also address data retention obligations following consumer revocation of data access authorization. 2) GOVERNANCE EXPOSURE: Medium. Retaining financial data after app disconnection without automatic deletion creates regulatory exposure if retention is not adequately justified by a stated lawful purpose and is not disclosed clearly to consumers at the time of disconnection. The absence of automatic deletion upon app disconnection may not align with consumer expectations or certain regulatory minimization principles. 3) JURISDICTION FLAGS: California residents have CPRA rights to request deletion with a 45-day response requirement. EU and UK users have GDPR rights to erasure where data is no longer necessary for its original purpose. States with enacted comprehensive privacy legislation imposing data minimization requirements create additional jurisdiction-specific exposure. 4) CONTRACT AND VENDOR IMPLICATIONS: Developer partners should assess whether their user-facing product flows adequately disclose to consumers that disconnecting an app within the partner application does not delete data held by Plaid, and whether this disclosure is sufficient to satisfy joint GLBA privacy notice obligations. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should evaluate whether post-disconnection retention is supported by a documented lawful purpose for each data category retained; retention schedules should be reviewed against CCPA/CPRA and GDPR storage limitation requirements; and consumer-facing disclosure language should be assessed for clarity regarding the distinction between app disconnection and data deletion.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes that disconnecting an application through a partner interface does not automatically result in deletion of financial data from Plaid's systems, and that consumers must take an additional affirmative step through the Plaid portal to request data deletion.
Under this provision, financial account data including transaction history and identity information collected through a Plaid-powered app connection may remain in Plaid's systems after the consumer disconnects the app, unless the consumer separately submits a deletion request at my.plaid.com.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Plaid.