Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Plaid's terms authorize collection of financial account credentials, transaction history, account balances, and identity information from consumers who connect their bank accounts through the Plaid Link interface on behalf of partner applications.
This analysis describes what Plaid's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the core data collection mechanism through which Plaid accesses sensitive nonpublic personal financial information, implicating GLBA, CCPA, and GDPR obligations for both Plaid and its developer partners.
Interpretive note: The full text of the data collection provision was not directly quoted in the truncated document provided; description is based on publicly known Plaid terms and the document context available.
Developers who use Plaid's services now face expanded accountability for all activities on their accounts and stricter rules around who can access end-user financial data. If developers allow employees, contractors, or other agents to access their accounts, they must ensure those users only access data for approved business purposes and in compliance with Plaid's terms; Plaid reserves the right to monitor this activity through session replay and activity monitoring. Developers should audit which team members have account access, document the business need and approved use case for each, and ensure all authorized users understand their obligations under Plaid's terms.
View change record →Plaid's updated terms shift its business model from primarily connecting your accounts to third-party apps toward also providing direct consumer services, including account monitoring and alerts through a new web-based platform called Plaid Web-App. The terms now specify that your Plaid Account can store your financial and identity information, and that Plaid can use this data to provide its own streamlined services (like alerts and notifications) in addition to facilitating third-party app connections. This is not a privacy reduction, but a clarification that Plaid is now a service provider in its own right, not just an intermediary. You may want to review what the Plaid Web-App monitoring service entails and what data it collects, since it is a new direct service from Plaid rather than a third-party app feature.
View change record →Plaid has reframed its service model to emphasize a direct relationship between you and Plaid, rather than positioning itself primarily as a bridge to third-party apps. This means Plaid now states it provides services directly to you when you request them. Additionally, Plaid has introduced a new account monitoring and alerts service available via a web application directly to consumers, separate from third-party app integrations. The terms clarify that your Plaid Account remains non-transactional and does not store funds or enable direct payments, but now explicitly mentions it helps third-party apps initiate payments to or from you. You may wish to review the new web-based monitoring service offering and understand what account data it accesses and how it uses that data.
View change record →Under this provision, when a consumer connects a bank account through a third-party app using Plaid, the agreement authorizes Plaid to collect financial credentials, transaction records, account balance data, and identity information as part of that connection process.
How other platforms handle this
The right to notice. You have the right to be notified which categories of Personal Data are being collected and the purposes for which the Personal Data is being used.
In certain circumstances, the right to data portability, which means that you can request that we provide certain Personal Data we hold about you in a machine-readable format
If you want to see what information we have collected about you, you can request a copy of your data in the Data & Privacy section of your User Settings. You should receive your data packet within 30 days.
Monitoring
Plaid has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
1) REGULATORY LANDSCAPE: This provision directly implicates the GLBA Privacy Rule and Safeguards Rule, which require financial institutions and their service providers to protect nonpublic personal financial information; the FTC Act, under which the FTC has authority over Plaid's data practices; and CCPA/CPRA for California residents who have rights to know what personal financial information is collected and for what purposes. GDPR and UK GDPR apply to EU and UK data subjects, requiring a lawful basis for processing financial data, which in this context is typically consent. 2) GOVERNANCE EXPOSURE: High. The collection of financial account credentials and transaction-level data represents a category of sensitive financial information subject to heightened regulatory scrutiny. Plaid's prior FTC consent order addressed concerns about credential collection and use; compliance teams should verify that current collection practices and disclosures align with both the consent order and applicable statutory frameworks. 3) JURISDICTION FLAGS: EU and UK users are subject to GDPR and UK GDPR requirements including explicit consent standards and data minimization obligations. California residents have CCPA/CPRA rights including the right to know categories of personal information collected. Illinois and other states with financial privacy statutes may impose additional restrictions on credential-based data collection. 4) CONTRACT AND VENDOR IMPLICATIONS: Developer partners integrating Plaid's Link interface should ensure their own privacy notices and terms of service adequately disclose Plaid's data collection practices, including the categories of financial data collected and Plaid's independent use rights, to satisfy GLBA service provider disclosure obligations and applicable state privacy law requirements. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should audit whether consent language presented through Plaid Link satisfies applicable statutory consent standards under GLBA, CCPA, and GDPR; data mapping documentation should reflect the full scope of financial data categories collected through Plaid and identify all downstream uses, including Plaid's independent product improvement and fraud prevention purposes.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes the core data collection mechanism through which Plaid accesses sensitive nonpublic personal financial information, implicating GLBA, CCPA, and GDPR obligations for both Plaid and its developer partners.
Under this provision, when a consumer connects a bank account through a third-party app using Plaid, the agreement authorizes Plaid to collect financial credentials, transaction records, account balance data, and identity information as part of that connection process.
ConductAtlas has identified this type of provision across 295 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Plaid.