Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
When you connect a bank account through Plaid, you are giving Plaid permission to use your login credentials to access your account and keep that data on file to power the apps you use.
This analysis describes what Plaid's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This clause authorizes Plaid to hold your actual bank login credentials and transaction history, not just a token, which creates ongoing data exposure beyond any single session.
Interpretive note: The document provided was heavily truncated and consisted primarily of CSS code; the excerpt above reflects Plaid's publicly known terms but could not be directly verified against the full document text provided.
Developers who use Plaid's services now face expanded accountability for all activities on their accounts and stricter rules around who can access end-user financial data. If developers allow employees, contractors, or other agents to access their accounts, they must ensure those users only access data for approved business purposes and in compliance with Plaid's terms; Plaid reserves the right to monitor this activity through session replay and activity monitoring. Developers should audit which team members have account access, document the business need and approved use case for each, and ensure all authorized users understand their obligations under Plaid's terms.
View change record →Plaid's updated terms shift its business model from primarily connecting your accounts to third-party apps toward also providing direct consumer services, including account monitoring and alerts through a new web-based platform called Plaid Web-App. The terms now specify that your Plaid Account can store your financial and identity information, and that Plaid can use this data to provide its own streamlined services (like alerts and notifications) in addition to facilitating third-party app connections. This is not a privacy reduction, but a clarification that Plaid is now a service provider in its own right, not just an intermediary. You may want to review what the Plaid Web-App monitoring service entails and what data it collects, since it is a new direct service from Plaid rather than a third-party app feature.
View change record →Plaid has reframed its service model to emphasize a direct relationship between you and Plaid, rather than positioning itself primarily as a bridge to third-party apps. This means Plaid now states it provides services directly to you when you request them. Additionally, Plaid has introduced a new account monitoring and alerts service available via a web application directly to consumers, separate from third-party app integrations. The terms clarify that your Plaid Account remains non-transactional and does not store funds or enable direct payments, but now explicitly mentions it helps third-party apps initiate payments to or from you. You may wish to review the new web-based monitoring service offering and understand what account data it accesses and how it uses that data.
View change record →This provision means Plaid may retain your banking credentials and detailed financial transaction data after you finish connecting an app, creating a persistent data relationship that continues unless you actively revoke it through Plaid's consumer portal.
How other platforms handle this
authorize ZipRecruiter to connect your account to the account of a "Connected Site" (e.g., Google, LinkedIn, Monster, Facebook or Twitter), we may be able to access information you have provided to the Connected Site...
If you rate an Output in response to an Input—for example, by using the thumbs up/thumbs down icon—we may store the entire related conversation as part of your Feedback.
telemetry information collected includes: (i) microservice settings, (ii) usage data and (iii) hardware environment.
Monitoring
Plaid has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"By using the Plaid Services, you authorize Plaid to access financial accounts and information using the credentials you provide. Plaid stores your credentials and account data to provide, maintain, and improve the Plaid Services and to deliver services to the developer applications you have authorized.Excerpt from Plaid's Terms of Use (Legal Index)
(1) REGULATORY LANDSCAPE: This provision implicates the Gramm-Leach-Bliley Act Safeguards Rule, which requires entities that qualify as financial institutions to protect customer financial information; the CFPB's proposed Section 1033 rules on consumer financial data access; and the FTC Act Section 5, which governs unfair or deceptive practices in data handling representations. GDPR and UK GDPR impose lawful basis requirements for credential processing that may require evaluation beyond consent alone given the sensitivity of financial credentials. (2) GOVERNANCE EXPOSURE: High. The authorization to store financial credentials creates significant security and regulatory exposure because credential compromise events may trigger breach notification obligations under state laws, GLBA, and potentially GDPR Article 33. The scope of authorization covers not just account access tokens but actual login credentials in at least some implementation contexts, which is operationally distinct from token-based open banking approaches increasingly favored by regulators. (3) JURISDICTION FLAGS: EU and UK users face heightened exposure because GDPR data minimization and storage limitation principles may conflict with broad credential retention assertions; California residents have CCPA and CPRA deletion rights that apply to this data category; Illinois users should note that financial credential data intersecting with biometric authentication may engage BIPA in edge cases. (4) CONTRACT AND VENDOR IMPLICATIONS: Developer clients integrating Plaid inherit responsibility for the data flows their applications initiate; procurement teams should assess whether developer agreements with Plaid adequately allocate liability for credential exposure and whether GDPR data processing agreements are in place for EU deployments. Standard commercial practice increasingly favors tokenized access over credential storage, and this provision's assertion of credential storage rights may face scrutiny from financial institution partners. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should audit whether end-user consent flows adequately disclose credential storage scope and duration; data mapping exercises should account for credential data as a distinct sensitive category; incident response plans should address the specific regulatory notification timelines triggered by financial credential exposure events across applicable jurisdictions.
Regulatory citations, enforcement risk, and due diligence action items.
Netflix updated its Privacy Statement on April 18, 2026, disclosing voice recording collection and expanded household ad profiling for the first time.
Google's Privacy Policy covers Search, Gmail, YouTube, Maps, and every site running Google Analytics. Here is what it actually authorizes.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This clause authorizes Plaid to hold your actual bank login credentials and transaction history, not just a token, which creates ongoing data exposure beyond any single session.
This provision means Plaid may retain your banking credentials and detailed financial transaction data after you finish connecting an app, creating a persistent data relationship that continues unless you actively revoke it through Plaid's consumer portal.
ConductAtlas has identified this type of provision across 304 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Plaid.