What are the institutional and regulatory implications of this document?

1) REGULATORY LANDSCAPE: This document engages the Gramm-Leach-Bliley Act (GLBA) and its Privacy Rule and Safeguards Rule, which govern how financial institutions and their service providers handle nonpublic personal financial information; the FTC Act, under which the FTC has enforcement authority over Plaid's data practices as a non-bank financial services entity; CCPA/CPRA for California residents, including rights to know, delete, and opt out of sale or sharing; GDPR and UK GDPR for EU and U…

How does Plaid's Plaid Terms of Use (Legal Index) affect users?

The agreement establishes that Plaid collects financial account credentials, transaction history, account balances, and identity data on behalf of partner applications and retains rights to use that data for its own product improvement and fraud prevention purposes beyond the scope of any individual app connection. Under these terms, consumers who disconnect an app through a partner interface may not have their data deleted from Plaid's systems unless they separately exercise deletion rights th…

How often is Plaid's Plaid Terms of Use (Legal Index) updated?

ConductAtlas monitors this document daily and captures every version with cryptographic hashing and timestamp verification. Update frequency varies — see the change timeline on this page for complete version history.

Can I get alerted when Plaid updates this document?

Yes. Monitor subscribers ($19/month) can add Plaid to their watchlist and receive same-day email alerts whenever this document or any other Plaid document changes.

CA-D-000170

Plaid Terms of Use (Legal Index)

Plaid

Last change detected May 5, 2026 Terms of service

SHA-256: 80aca1f109f1d1080f2… 5 versions captured 5 changes documented

Create free account

Track 3 platforms and get the weekly governance digest. No credit card required.

View original document at Plaid ↗

This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology

142 Total

48 High severity

84 Medium severity

10 Low severity

Summary

Plaid's legal page governs how Plaid collects and uses financial account data, including transaction history, account balances, and identity information, when consumers connect their bank accounts to third-party apps using Plaid's technology. The terms authorize Plaid to retain financial data for its own purposes, including product improvement and fraud prevention, even after a consumer disconnects an app, subject to described retention limits accessible through the Plaid consumer portal. Consumers can visit the Plaid consumer portal at my.plaid.com to view connected applications, revoke access to their financial data, and request deletion of their stored information.

Technical / Legal Breakdown

This document is Plaid's legal and privacy policy hub, governing consumer and developer use of Plaid's financial data connectivity infrastructure, with stated legal basis rooted in user consent obtained through the Plaid Link interface and contractual agreements with app developers (referred to as 'partners'). The terms authorize Plaid to collect financial account credentials, transaction history, account balances, identity information, and device data from end users on behalf of partner applications, and establish that Plaid acts as a data processor/service provider on behalf of partners as well as independently in certain contexts. Notable provisions include Plaid's dual-role data handling structure, where the company asserts rights to retain and use financial data both as a service provider to developers and for its own product improvement and fraud prevention purposes, which may create compliance complexity under financial privacy frameworks; the document also references a consumer portal allowing users to manage or revoke data connections. The document engages CCPA/CPRA for California residents, GLBA for financial data handling, GDPR and UK GDPR for EU and UK users respectively, and relevant FTC Act consumer protection standards; applicability of specific provisions to individual users depends substantially on jurisdiction and the specific partner application through which Plaid is accessed. Material compliance considerations include the adequacy of consent mechanisms under GLBA's privacy notice requirements, the scope of data retention following revocation of access, and the sufficiency of the Plaid portal as a consumer rights mechanism under applicable state privacy laws.

Institutional Analysis

Institutional analysis available with Compliance

Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Compliance.

Get Compliance

5 important changes detected

5 versions captured · Last updated: May 2026

May 5, 2026

low

What changed Plaid added a language selector to the beginning of their Terms of Use on May 5, 2026. The document now displays a notice that users are viewing English-European Union content, with an option to switch to English-US content. This is a navigational and regional localization update with no changes to the actual terms or user obligations.

Why this matters This change is a technical and navigational update with no material impact on consumer rights, data handling, or obligations. Plaid has added a language selector allowing users to view either the EU or US version of its Terms of Use. The underlying terms themselves remain unchanged.

View full change record →

April 21, 2026

medium

What changed Plaid updated its Developer Policy on April 21, 2026, making substantial changes to how developers must manage accounts and user data access. The policy now explicitly requires developers to be responsible for all activities on their accounts, and if they allow employees or contractors to access accounts, they must ensure those users only access data for approved purposes. The policy also added a new section on session replay and activity monitoring, and clarified that violations can result in suspension of access to both the platform and end-user financial data.

Why this matters Developers who use Plaid's services now face expanded accountability for all activities on their accounts and stricter rules around who can access end-user financial data. If developers allow employees, contractors, or other agents to access their accounts, they must ensure those users only access data for approved business purposes and in compliance with Plaid's terms; Plaid reserves the right to monitor this activity through session replay and activity monitoring. Developers should audit which team members have account access, document the business need and approved use case for each, and ensure all authorized users understand their obligations under Plaid's terms.

View full change record →

April 19, 2026 medium

Plaid updated its terms on April 19, 2026 to clarify that it now offers a direct consumer account and monitoring service, not just connection services for third-party apps. The updated …

View change record →

April 16, 2026 medium

Plaid restructured how it describes its core service and introduced a new direct-to-consumer monitoring feature. The updated terms now emphasize that Plaid connects your financial accounts to Plaid itself (rather …

View change record →

March 19, 2026 low

Plaid's terms were substantially reorganized on March 19, 2026. The updated language reframes the Plaid Account as enabling faster onboarding and use of third-party apps, rather than as a standalone …

View change record →

Featured — High severity

Biometric Policy: images never used to develop or improve Plaid services Compare →

This is a categorical prohibition—using the word 'never'—that covers not just Plaid but also its service providers, and extends to derived biometric data such as facial geometry scans, limiting how sensitive biometric data may be exploited.

Added July 10, 2026 Standard Seen across 277 platforms
Developer Policy: developer prohibited from selling or renting End User Data Compare →

This restriction bars a direct monetization pathway—selling or renting user data—and extends liability to indirect facilitation, meaning developers cannot circumvent the rule through intermediaries.

Added July 10, 2026 Standard Seen across 243 platforms
Developer Policy: export controls and sanctions compliance required Compare →

This imposes an ongoing, not merely initial, compliance obligation on developers across a broad set of trade and sanctions regimes, including the full scope of U.S.-applicable rules.

Added July 10, 2026 Standard Seen across 183 platforms
Developer Policy: violation may result in suspension or termination Compare →

The enforcement remedy covers both service access and access to End User Data, and is triggered by any Policy violation—there is no materiality threshold limiting when suspension or termination may be imposed.

Added July 10, 2026 Standard Seen across 275 platforms
End user grants Plaid authority to access financial institution Compare →

This establishes that Plaid is granted actual authority to act on the user's behalf with their financial institution, not merely a technical capability—an agency-like grant triggered by the act of providing login credentials.

Added July 10, 2026 Standard Seen across 260 platforms
End User Services Agreement US: liability cap at $100 or amount paid Compare →

Because most end users pay nothing to use the Platform, this cap effectively limits Plaid's aggregate liability to $100 regardless of the nature or magnitude of harm suffered.

Added July 10, 2026 Standard Seen across 286 platforms
End User Services Agreement US: Plaid may terminate for any reason Compare →

Plaid retains the unilateral power to end or suspend an end user's access without advance notice and without any obligation to state a reason, providing no procedural protection to the user.

Added July 10, 2026 Standard Seen across 258 platforms
End User Services Agreement US: Platform provided AS IS no warranties Compare →

Disclaiming all express and implied warranties removes Plaid's responsibility for defects, unavailability, or failures of the Platform, shifting the risk of use entirely to the end user, subject only to what law permits.

Added July 10, 2026 Standard Seen across 286 platforms
IDV Privacy Statement: Plaid never sells end user IDV personal information Compare →

This is a categorical and permanent prohibition—using the phrase 'not ever'—specifically scoped to Personal Information from the IDV Services, barring a direct commercial transfer of that data to third parties.

Added July 10, 2026 Standard Seen across 286 platforms
Plaid auto-deletes data when developer removes connection Compare →

The deletion commitment is qualified in two important ways: it is described as what Plaid's systems are 'designed to' do rather than an absolute guarantee, and it is explicitly subject to unspecified exceptions that permit retention.

Added July 10, 2026 Standard Seen across 271 platforms
Plaid collects financial account data from institutions Compare →

The enumerated data includes highly sensitive financial identifiers—such as account numbers, routing numbers, IBAN, and BIC—that can enable financial transactions and identity verification.

Added July 10, 2026 Standard Seen across 298 platforms
Plaid shares data with app developers as directed Compare →

The sharing with the developer is conditional on the developer's direction, meaning the developer controls the scope of data Plaid shares with them; sharing with financial institutions is tied to the user's own connection choices.

Added July 10, 2026 Standard Seen across 286 platforms

Complete Provision Index

Every distinct legal provision identified in this document. Featured provisions appear above with analysis.

142 provisions

12 featured

24 clause types

48 high severity

liability_limitation 19

data_sharing 16

privacy_rights 15

acceptable_use 12

contract_terms 9

data_collection 8

data_retention 6

legal_jurisdiction 6

policy_changes 6

account_control 5

data_usage 5

enforcement_actions 5

payment_fees 5

other 4

indemnification 3

intellectual_property 3

platform_discretion 3

refunds 3

ai_automated 2

export_sanctions 2

restricted_content 2

arbitration 1

End User Services Agreement US: multi-step dispute resolution before litigation medium

developer_api 1

Developer Policy: developer must share end user data back to Plaid on request medium

disclosure_requirements 1

Developer Policy: anonymized End User Data use must be disclosed to end users medium

Monitoring

Plaid has updated this document before.

Monitor includes same-day alerts, structured change summaries, and monitoring for up to 25 platforms.

Get Monitor Or create a free account →

Compliance Governance Intelligence

Need provision-level monitoring and regulatory mapping?

Compliance includes governance timelines, compliance memos, audit-ready analysis, and full provision tracking.

Get Compliance

Cross-platform context

See how other platforms handle All Audience Privacy Statement: biometric data stored maximum three years for Illinois and Texas and similar clauses.

Compare across platforms →

Mapped Governance Frameworks

CFAA

United States Federal

View official text ↗

Archival ProvenanceSource & Archival Record

Last Captured May 5, 2026 08:20 UTC

Capture Method Automated scheduled archival capture

Document ID CA-D-000170

Version ID CA-V-002163

Source URL https://plaid.com/legal/

Wayback Machine View external archival references →

SHA-256 80aca1f109f1d1080f2ccc878a968987c248e11f14b345297cdc77b24b841e49

✓ Snapshot stored ✓ Text extracted ✓ Change verified ✓ Hash verified

Plaid Terms of Use (Legal Index)

May 5, 2026

April 21, 2026

Complete Provision Index

Mapped Governance Frameworks

Monitor governance changes across the platforms you rely on.