The policy asserts that personal information collected in connection with financial services such as brokerage accounts is governed by GLBA rather than state privacy laws including the CCPA, which may result in Robinhood declining to honor data subject requests for access, deletion, or correction of that data.
This analysis describes what Robinhood's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the legal framework under which Robinhood may decline to process CCPA and other state privacy law data subject requests for users whose data is characterized as GLBA-covered. The scope and boundaries of GLBA preemption over state privacy law is a matter of ongoing regulatory interpretation, and the practical application of this framing varies depending on the specific data category, state, and user relationship.
Interpretive note: The scope of GLBA preemption over state privacy law data subject rights is subject to ongoing regulatory and judicial interpretation, and application varies by state and data category.
The updated privacy policy reorganizes how Robinhood discloses its handling of financial information, now grouping GLBA-regulated disclosures by individual service entity with updated reference links rather than listing all entities in a single section. The policy also removed coverage of Robinhood Social, meaning privacy practices for that social media product are no longer described in this statement. The revised policy clarifies that it applies when you are logged into services or interact through online customer service channels, and directs users to a separate Robinhood Markets US Online Privacy Statement for information about non-financial data collection practices.
View change record →Expanded from CCPA-only exemption to broader state privacy law exemptions with nuanced explanation that exemption applies conditionally based on relationship type (personal financial services vs. other services).
View full change record →Under this provision, users whose Robinhood relationship is limited to financial services may find that requests to access, delete, or correct their personal information are declined on the basis that the data is governed by GLBA rather than state privacy law. The agreement acknowledges that users of non-financial products such as Robinhood Social retain applicable state privacy rights for information collected through those products.
Cross-platform context
See how other platforms handle GLBA Preemption of State Privacy Rights and similar clauses.
Compare across platforms →"In some cases, some or all of your information may be exempt from certain state privacy laws, such as the California Consumer Privacy Act (CCPA), because it is governed by federal financial privacy laws like the Gramm-Leach-Bliley Act (GLBA). For example, if your relationship with us is limited to personal financial services (such as maintaining a brokerage account), the personal information we collect about you is generally covered by GLBA rather than state privacy laws. However, if you use other services, such as Robinhood Social, some of your information may be subject to applicable state privacy laws. As a result, in some cases, we may have no obligation to accept any Data Subject Requests ("DSRs"), and in other cases, we may have no obligation to honor a particular DSR, because of the nature of the personal information that is collected or maintained.Excerpt from Robinhood's Privacy Policy
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes the legal framework under which Robinhood may decline to process CCPA and other state privacy law data subject requests for users whose data is characterized as GLBA-covered. The scope and boundaries of GLBA preemption over state privacy law is a matter of ongoing regulatory interpretation, and the practical application of this framing varies depending on the specific …
Under this provision, users whose Robinhood relationship is limited to financial services may find that requests to access, delete, or correct their personal information are declined on the basis that the data is governed by GLBA rather than state privacy law. The agreement acknowledges that users of non-financial products such as Robinhood Social retain applicable state privacy rights for information …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Robinhood.