Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The terms include disclosures directed at California residents describing their rights under CCPA and CPRA, including the right to know what personal financial information is collected, the right to request deletion, the right to opt out of sale or sharing, and the right to non-discrimination for exercising these rights.
This analysis describes what Plaid's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the specific statutory privacy rights available to California residents under CCPA/CPRA in the context of Plaid's financial data collection and use activities, including the designated mechanisms for exercising those rights.
Interpretive note: The exact CCPA/CPRA disclosure language was not directly quotable from the truncated document; description is based on document context and Plaid's publicly known California privacy disclosures.
Developers who use Plaid's services now face expanded accountability for all activities on their accounts and stricter rules around who can access end-user financial data. If developers allow employees, contractors, or other agents to access their accounts, they must ensure those users only access data for approved business purposes and in compliance with Plaid's terms; Plaid reserves the right to monitor this activity through session replay and activity monitoring. Developers should audit which team members have account access, document the business need and approved use case for each, and ensure all authorized users understand their obligations under Plaid's terms.
View change record →Plaid's updated terms shift its business model from primarily connecting your accounts to third-party apps toward also providing direct consumer services, including account monitoring and alerts through a new web-based platform called Plaid Web-App. The terms now specify that your Plaid Account can store your financial and identity information, and that Plaid can use this data to provide its own streamlined services (like alerts and notifications) in addition to facilitating third-party app connections. This is not a privacy reduction, but a clarification that Plaid is now a service provider in its own right, not just an intermediary. You may want to review what the Plaid Web-App monitoring service entails and what data it collects, since it is a new direct service from Plaid rather than a third-party app feature.
View change record →Plaid has reframed its service model to emphasize a direct relationship between you and Plaid, rather than positioning itself primarily as a bridge to third-party apps. This means Plaid now states it provides services directly to you when you request them. Additionally, Plaid has introduced a new account monitoring and alerts service available via a web application directly to consumers, separate from third-party app integrations. The terms clarify that your Plaid Account remains non-transactional and does not store funds or enable direct payments, but now explicitly mentions it helps third-party apps initiate payments to or from you. You may wish to review the new web-based monitoring service offering and understand what account data it accesses and how it uses that data.
View change record →Under this provision, California residents have statutory rights to request disclosure of the categories and specific pieces of financial data Plaid has collected about them, to request deletion, and to opt out of any sale or sharing of their personal information, with a designated submission path through the Plaid portal or privacy contact.
How other platforms handle this
When you use them, we'll validate your request by verifying your identity (for example, by confirming that you're signed in to your Google Account).
Not be Discriminated Against by us for exercising your privacy rights.
You may contact our privacy team with any requests of disclosure, correction, or deletion of your personal information. You may also request suspension of use or suspension of sharing of your personal information with certain third parties.
Monitoring
Plaid has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
1) REGULATORY LANDSCAPE: This provision directly engages CCPA as amended by CPRA, enforced by the California Privacy Protection Agency (CPPA) and the California Attorney General. Applicable provisions include the right to know, right to delete, right to correct, right to opt out of sale or sharing, and right to limit use of sensitive personal information. Financial data and account information may qualify as sensitive personal information under CPRA, triggering heightened obligations. 2) GOVERNANCE EXPOSURE: Medium. Compliance with CCPA/CPRA for a financial data aggregator of Plaid's scale requires accurate data mapping, verified request processing workflows, and documented retention justifications for all data categories. The CPPA has indicated active enforcement interest in financial data processors. 3) JURISDICTION FLAGS: This provision applies specifically to California residents. Businesses operating in California that integrate Plaid should ensure their own CCPA/CPRA disclosures reference Plaid's data collection and use practices where Plaid is not acting solely as a service provider. 4) CONTRACT AND VENDOR IMPLICATIONS: Developer partners should confirm that their CCPA service provider agreements with Plaid satisfy CPRA's updated contractual requirements for service providers and contractors, including provisions restricting Plaid's independent use of consumer data to purposes consistent with the service provider exemption. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should verify that Plaid's privacy notice for California residents includes all required CCPA/CPRA disclosures; that sensitive personal information use limitation rights are honored; and that opt-out mechanisms are functional and accessible. Response timeline compliance (45-day standard, 90-day maximum with notice) should be audited.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes the specific statutory privacy rights available to California residents under CCPA/CPRA in the context of Plaid's financial data collection and use activities, including the designated mechanisms for exercising those rights.
Under this provision, California residents have statutory rights to request disclosure of the categories and specific pieces of financial data Plaid has collected about them, to request deletion, and to opt out of any sale or sharing of their personal information, with a designated submission path through the Plaid portal or privacy contact.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Plaid.