Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
When a user connects an external financial account, SoFi may collect any and all information available in that account and use it for product marketing, sharing with affiliated companies, and eligibility targeting, subject to SoFi's Privacy Policies.
This analysis describes what SoFi's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that linking an external bank account, loan, or credit card to SoFi authorizes collection of all available account data and its use for marketing and cross-affiliate product targeting. The scope of permissible use extends to sharing with SoFi affiliated companies, and the data is processed through a mandatory Plaid intermediary with its own separate privacy policy.
The updated terms establish a time-limited referral promotion running through September 30, 2026, with new eligibility criteria for referrers. To qualify for the higher $75 bonus, referrers must maintain either $100 in combined Invest assets or an eligible direct deposit at the time the referred recipient enrolls. Referrers who do not meet these criteria will receive a lower $50 bonus. The terms also restrict bonuses to new Self-Directed Account openings only, excluding Automated Invest and IRA accounts from referral rewards. Referrals must be completed within the promotion period or they become ineligible. You should verify your account meets the stated asset or direct deposit requirements if you intend to participate in the referral program before the September 30 deadline.
View change record →The updated terms establish new restrictions on how referrers can promote SoFi products and create additional obligations for anyone participating in the referral program. Referrers must now obtain express consent before sending promotional text messages in Washington State, cannot use mass email or commercial advertising to solicit referrals, and must clearly disclose their financial relationship to SoFi in any promotion. The revised terms prohibit making claims about product outcomes, interest rates, or approval odds unless directed to official SoFi webpages, and establish a $10,000 annual cap on cumulative referral and welcome bonuses. Tax reporting obligations now apply, with SoFi reporting bonuses as miscellaneous income to the IRS on Form 1099-MISC. You can review the specific promotional campaign rules for each referral link and ensure compliance with state and platform-specific disclosure requirements before promoting.
View change record →The updated terms establish a Privacy Preference Center that provides granular cookie controls rather than requiring blanket acceptance of all tracking technologies. Previously, SoFi stated that users who did not make a selection agreed to all tracking uses; the revised terms now require users to affirmatively allow functional cookies and other tracking categories. The updated language explicitly describes that functional cookies enable enhanced site functionality and personalization, and that blocking certain cookies may impact site experience. You can now toggle cookie categories on or off individually rather than accepting or declining all tracking as a single choice.
View change record →Under this clause, users who connect an external financial account authorize SoFi to collect all available account information, including transaction history, balances, and payment records, and to use that information to serve targeted product offers and share it with affiliated SoFi entities. The agreement also requires users to agree to Plaid's Privacy Policy as a condition of connecting any external account.
Cross-platform context
See how other platforms handle Connected Account Data Collection and Marketing Use and similar clauses.
Compare across platforms →Monitoring
SoFi has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"If you connect an external account to SoFi, SoFi may obtain any and all information from the Connected Accounts. The specific information SoFi obtains may vary by institution and account type. You should assume SoFi will obtain from the account any information that is available to you. Use of Connected Information. If you elect to connect an account through any SoFi service, SoFi may use the information from the connected account for any purpose permitted by SoFi's Privacy Policies, including use of the information to identify products and services that may be of interest to you, sharing information with affiliated companies to offer products and services to you, and identifying if you would be likely to be eligible for certain products and services.Excerpt from SoFi's Terms of Service
1. REGULATORY LANDSCAPE: This provision interacts with the GLBA, which governs financial institutions' collection and use of nonpublic personal information, and with CFPB rulemaking under Section 1033 of the Dodd-Frank Act regarding consumer financial data rights and third-party data access. The FTC Act applies to data practices involving external account information. California residents may have additional rights under the CCPA regarding the use of linked financial account data for targeted advertising purposes. 2. GOVERNANCE EXPOSURE: High. The authorization to collect all available external account information and use it for marketing and affiliated company sharing is broad in scope. CFPB Section 1033 rulemaking may impose additional requirements on how third-party data aggregators like Plaid and platforms like SoFi access and use consumer financial account data, and compliance teams should monitor developing regulatory guidance in this area. 3. JURISDICTION FLAGS: California residents may have CCPA rights to opt out of the use of their linked financial account data for targeted advertising. The mandatory Plaid intermediary requirement, which subjects users to Plaid's separate privacy policy, creates a data flow that compliance teams should map for GLBA and CCPA purposes. EU and UK residents are not the stated target audience for this service based on the document's US-resident-only scope, but any data processed by Plaid in those jurisdictions may engage GDPR requirements. 4. CONTRACT AND VENDOR IMPLICATIONS: The mandatory Plaid integration creates a vendor dependency that should be assessed in data processing agreements and third-party risk management programs. SoFi's description of acting as user's agent to access external accounts should be evaluated against Open Banking regulatory frameworks and bank-level terms of service for the connected external institutions. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should map the data flows from connected external accounts through Plaid to SoFi and its affiliates, assess whether the GLBA Privacy Notice adequately covers the scope of this data use, evaluate CCPA opt-out rights for California users regarding targeted advertising based on linked account data, and monitor CFPB Section 1033 implementation for implications on this data access model.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision establishes that linking an external bank account, loan, or credit card to SoFi authorizes collection of all available account data and its use for marketing and cross-affiliate product targeting. The scope of permissible use extends to sharing with SoFi affiliated companies, and the data is processed through a mandatory Plaid intermediary with its own separate privacy policy.
Under this clause, users who connect an external financial account authorize SoFi to collect all available account information, including transaction history, balances, and payment records, and to use that information to serve targeted product offers and share it with affiliated SoFi entities. The agreement also requires users to agree to Plaid's Privacy Policy as a condition of connecting any external …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by SoFi.