Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy asserts that personal information collected in connection with financial services such as brokerage accounts is governed by GLBA rather than state privacy laws including the CCPA, which may result in Robinhood declining to honor data subject requests for access, deletion, or correction of that data.
This analysis describes what Robinhood's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the legal framework under which Robinhood may decline to process CCPA and other state privacy law data subject requests for users whose data is characterized as GLBA-covered. The scope and boundaries of GLBA preemption over state privacy law is a matter of ongoing regulatory interpretation, and the practical application of this framing varies depending on the specific data category, state, and user relationship.
Interpretive note: The scope of GLBA preemption over state privacy law data subject rights is subject to ongoing regulatory and judicial interpretation, and application varies by state and data category.
The updated privacy policy reorganizes how Robinhood discloses its handling of financial information, now grouping GLBA-regulated disclosures by individual service entity with updated reference links rather than listing all entities in a single section. The policy also removed coverage of Robinhood Social, meaning privacy practices for that social media product are no longer described in this statement. The revised policy clarifies that it applies when you are logged into services or interact through online customer service channels, and directs users to a separate Robinhood Markets US Online Privacy Statement for information about non-financial data collection practices.
View change record →Under this provision, users whose Robinhood relationship is limited to financial services may find that requests to access, delete, or correct their personal information are declined on the basis that the data is governed by GLBA rather than state privacy law. The agreement acknowledges that users of non-financial products such as Robinhood Social retain applicable state privacy rights for information collected through those products.
Cross-platform context
See how other platforms handle GLBA Preemption of State Privacy Rights and similar clauses.
Compare across platforms →Monitoring
Robinhood has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"In some cases, some or all of your information may be exempt from certain state privacy laws, such as the California Consumer Privacy Act (CCPA), because it is governed by federal financial privacy laws like the Gramm-Leach-Bliley Act (GLBA). For example, if your relationship with us is limited to personal financial services (such as maintaining a brokerage account), the personal information we collect about you is generally covered by GLBA rather than state privacy laws. However, if you use other services, such as Robinhood Social, some of your information may be subject to applicable state privacy laws. As a result, in some cases, we may have no obligation to accept any Data Subject Requests ("DSRs"), and in other cases, we may have no obligation to honor a particular DSR, because of the nature of the personal information that is collected or maintained.Excerpt from Robinhood's Privacy Policy
1. REGULATORY LANDSCAPE: This provision engages the GLBA (enforced by the FTC and federal financial regulators including the SEC, CFTC, and FINRA depending on the affiliate), the CCPA (enforced by the California Privacy Protection Agency and California AG), and analogous state privacy statutes in Virginia, Colorado, Texas, and other states. The GLBA preemption claim is legally supportable for data directly related to financial services, but its application to data at the boundaries of financial and non-financial product use is subject to regulatory interpretation and may not fully resolve in Robinhood's favor in all circumstances. 2. GOVERNANCE EXPOSURE: Medium. The document's assertion that Robinhood may have no obligation to honor any data subject request for GLBA-covered data is facially consistent with established GLBA-CCPA preemption doctrine for core financial data, but creates compliance exposure for data that straddles financial and non-financial product use, particularly where the California Privacy Protection Agency has issued or may issue guidance narrowing the preemption scope. 3. JURISDICTION FLAGS: California creates the highest exposure given CPPA rulemaking authority and active enforcement. Colorado, Virginia, and Texas privacy laws include similar financial institution exemptions that may apply differently depending on how each state defines the exemption scope. Users with both financial and Social product relationships create data classification complexity. 4. CONTRACT AND VENDOR IMPLICATIONS: The dual-regime framework (GLBA for financial data, state law for Social data) requires that data processing agreements with vendors clearly distinguish which data categories are processed under which legal framework, and that access, deletion, and correction workflows are designed to handle mixed-relationship users. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should document the data classification methodology used to distinguish GLBA-covered from state-law-covered data for each user relationship type, establish a process for evaluating data subject requests against the applicable legal framework, and monitor California Privacy Protection Agency rulemaking for any narrowing of the financial institution exemption scope.
This provision establishes the legal framework under which Robinhood may decline to process CCPA and other state privacy law data subject requests for users whose data is characterized as GLBA-covered. The scope and boundaries of GLBA preemption over state privacy law is a matter of ongoing regulatory interpretation, and the practical application of this framing varies depending on the specific …
Under this provision, users whose Robinhood relationship is limited to financial services may find that requests to access, delete, or correct their personal information are declined on the basis that the data is governed by GLBA rather than state privacy law. The agreement acknowledges that users of non-financial products such as Robinhood Social retain applicable state privacy rights for information …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Robinhood.