Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that if a user does not actively select a preference in the cookie consent banner, they are treated as having agreed to SoFi's use of cookies, pixels, and tracking technologies, including sharing of that data with social media, advertising, and analytics partners.
This analysis describes what SoFi's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a default-acceptance mechanism under which inaction by the user constitutes consent to optional tracking and data sharing. The operational significance depends on whether this mechanism satisfies the consent standards required under applicable state privacy laws, including CCPA, which may distinguish between opt-in and opt-out consent frameworks for certain categories of data use.
Interpretive note: Whether this default-acceptance mechanism constitutes valid consent under CCPA/CPRA or other applicable state privacy laws depends on regulatory interpretation and enforcement guidance that has not been conclusively settled.
The updated terms restructure how SoFi discloses and collects consent for tracking technologies. Previously, SoFi stated that non-selection of preferences constituted acceptance of tracking. The updated version creates distinct cookie categories (Functional, Performance, Targeting, Strictly Necessary) and establishes a Privacy Preference Center allowing you to individually toggle Performance and Targeting cookies on or off. Strictly Necessary Cookies remain non-optional and cannot be disabled, as the updated terms state these are necessary for website functionality. You can manage individual cookie category preferences through the Privacy Preference Center interface before or after initial site visit.
View change record →The updated Privacy Notice explicitly discloses that SoFi collects user information through cookies, pixels, and other tracking technologies and shares this data with social media, advertising, and analytics partners. Previously, the policy described these practices in more general language. Under the revised terms, continued use of SoFi's website constitutes acceptance of these tracking and data-sharing practices unless the user actively makes selections in the Privacy Preference Center. You can use the preference center to opt out of optional tracking technologies, though strictly necessary cookies cannot be disabled.
View change record →The updated privacy notice explicitly discloses that SoFi uses pixels and tracking technologies to collect information about your actions and preferences, and shares this data with social media, advertising, and analytics partners. The revised consent interface distinguishes between strictly necessary cookies (which cannot be disabled) and optional cookies for performance and targeting purposes (which require affirmative consent). The terms state that if you do not make a selection, you agree to use of these technologies; you can opt out by toggling the button that appears to the right of each optional cookie category.
View change record →Under this clause, users who visit SoFi's website without interacting with the cookie consent banner are treated as having consented to the collection of browsing and interaction data and its sharing with advertising, social media, and analytics partners. The agreement establishes an opt-out mechanism through the Privacy Preference Center for users who wish to decline optional cookies after the fact.
Cross-platform context
See how other platforms handle Default Consent for Optional Tracking Technologies and similar clauses.
Compare across platforms →Monitoring
SoFi has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"We use pixels and other tracking technologies to collect your information and actions to enhance site navigation, personalize content, analyze site usage, and assist in marketing efforts. We share this information with social media, advertising, and analytics partners. If you do not make a selection, you agree to our use of these technologies.Excerpt from SoFi's Privacy Notice
1) REGULATORY LANDSCAPE: This provision engages the California Consumer Privacy Act and its amendments under CPRA, which govern whether default-acceptance mechanisms constitute valid consent for data sharing and cross-context behavioral advertising. The FTC's guidance on dark patterns in privacy consent interfaces is also relevant. California's Attorney General and the California Privacy Protection Agency hold primary enforcement authority. Where users are located in states with opt-in consent requirements for certain data processing activities, this default-acceptance construct may require further evaluation. 2) GOVERNANCE EXPOSURE: Medium. The default-acceptance framing is common in U.S. commercial web practice but faces increasing regulatory scrutiny, particularly in California, where CPRA amendments and CPPA rulemaking have addressed the adequacy of consent mechanisms. The provision does not specify the categories of data collected by each cookie type beyond general descriptions, which may create gaps in disclosure adequacy assessments. 3) JURISDICTION FLAGS: California residents are the primary heightened-exposure population given CCPA/CPRA applicability. Users in states with enacted comprehensive privacy laws (Virginia, Colorado, Connecticut, Texas, and others) may have additional consent and opt-out rights that this mechanism does not explicitly address. EU/EEA users are not addressed in this document, though the document appears scoped to U.S. users. 4) CONTRACT AND VENDOR IMPLICATIONS: Data sharing with social media, advertising, and analytics partners under this mechanism creates downstream vendor contract review obligations. Compliance teams should confirm that data processing agreements with these partners define the permissible scope of use consistent with SoFi's disclosed purposes and applicable state privacy law restrictions on secondary use of shared data. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should audit the technical implementation of the default-acceptance mechanism to confirm it is operationally consistent with the policy's stated framework, including whether opt-out selections are honored across sessions and devices. The cookie categories disclosed (performance, targeting, strictly necessary) should be mapped to specific vendors and data flows to ensure disclosure accuracy and to support data mapping obligations under applicable state privacy laws.
This provision establishes a default-acceptance mechanism under which inaction by the user constitutes consent to optional tracking and data sharing. The operational significance depends on whether this mechanism satisfies the consent standards required under applicable state privacy laws, including CCPA, which may distinguish between opt-in and opt-out consent frameworks for certain categories of data use.
Under this clause, users who visit SoFi's website without interacting with the cookie consent banner are treated as having consented to the collection of browsing and interaction data and its sharing with advertising, social media, and analytics partners. The agreement establishes an opt-out mechanism through the Privacy Preference Center for users who wish to decline optional cookies after the fact.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by SoFi.