Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Federal law requires Stash to provide a separate Privacy Notice about how it collects and shares your nonpublic personal financial information; this notice is linked in the policy and covers additional rights and limitations not fully described in the main privacy policy.
This analysis describes what Stash's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The GLBA Privacy Notice contains legally required disclosures about financial data sharing with nonaffiliated third parties and your right to opt out of certain sharing arrangements that are separate from and additional to the rights described in the main privacy policy.
You should read Stash's separate GLBA Privacy Notice (linked in the policy) in addition to this privacy policy, as it contains federally required disclosures about financial data sharing and may include opt-out rights for sharing your financial information with unaffiliated companies.
How other platforms handle this
When you use them, we'll validate your request by verifying your identity (for example, by confirming that you're signed in to your Google Account).
Client will not... (ii) interfere with any independent efforts by Plaid to provide End User notice or obtain End User consent
Not be Discriminated Against by us for exercising your privacy rights.
Monitoring
Stash has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"In addition to the information provided in this Privacy Policy, Stash is required by federal law to provide consumers with information regarding our collection and sharing of nonpublic personal information. Please see our Privacy Notice for more information.Excerpt from Stash's Privacy Policy
REGULATORY LANDSCAPE: The Gramm-Leach-Bliley Act requires financial institutions to provide annual privacy notices to customers describing their information sharing practices and to provide an opt-out right for sharing nonpublic personal information with nonaffiliated third parties in certain circumstances. The FTC and federal banking regulators (including the SEC for registered investment advisers and FINRA for broker-dealers) have authority over GLBA Privacy Notice compliance. The notice must be provided at account opening and annually thereafter. GOVERNANCE EXPOSURE: Medium. The existence of a separate GLBA Privacy Notice means that Stash's complete data sharing disclosure framework spans two documents, which increases the risk that consumers will not read both and may not understand the full scope of sharing. Compliance teams must ensure the GLBA Notice is current, accurately reflects actual sharing practices, and is delivered to customers at the required intervals. JURISDICTION FLAGS: GLBA applies to all US-based financial institutions and is a federal requirement with no state-level variation in its core obligations, though state law may impose additional or stricter requirements on top of GLBA minimums. Stash's multi-affiliate structure (investment adviser, broker-dealer, banking, insurance) means GLBA obligations may apply across multiple regulated entities and must be coordinated. CONTRACT AND VENDOR IMPLICATIONS: Sharing arrangements with nonaffiliated third parties that are described in the GLBA Privacy Notice must be consistent with the opt-out rights provided to consumers. If consumers have exercised opt-out rights under the GLBA Notice, those elections must be honored in vendor data sharing arrangements. Coordination between the privacy policy and the GLBA Notice is necessary to avoid inconsistent disclosures. COMPLIANCE CONSIDERATIONS: Legal teams should verify that the GLBA Privacy Notice linked in the policy is current and that annual delivery to existing customers is operationally implemented. The Notice should be reviewed alongside the privacy policy to identify any inconsistencies in disclosed sharing practices. Opt-out mechanisms described in the GLBA Notice should be tested for operational completeness.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
The GLBA Privacy Notice contains legally required disclosures about financial data sharing with nonaffiliated third parties and your right to opt out of certain sharing arrangements that are separate from and additional to the rights described in the main privacy policy.
You should read Stash's separate GLBA Privacy Notice (linked in the policy) in addition to this privacy policy, as it contains federally required disclosures about financial data sharing and may include opt-out rights for sharing your financial information with unaffiliated companies.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Stash.