Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Visa publishes a separate U.S. Social Security Number Policy and Sensitive Personal Information Statement governing its handling of Social Security numbers and other sensitive personal information categories for U.S. users.
This analysis describes what Visa's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The existence of a dedicated policy for Social Security numbers and sensitive personal information indicates that Visa collects and processes these data categories for at least some U.S. users, which triggers heightened obligations under multiple U.S. state privacy laws and the FTC's Safeguards Rule.
Interpretive note: The specific circumstances under which Visa collects Social Security numbers, the purposes for which they are used, and the retention and disposal practices are not described in this landing page and require review of the separate U.S. SSN Policy.
Under this provision, U.S. users whose Social Security numbers or other sensitive personal information are collected by Visa are subject to a separate policy statement governing those data categories; the specific handling practices, retention periods, and access controls for these categories are addressed in that separate document rather than in the Global Privacy Notice.
Cross-platform context
See how other platforms handle U.S. Social Security Number and Sensitive Personal Information Statement and similar clauses.
Compare across platforms →Monitoring
Visa has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"U.S. - Social Security Number Policy and Sensitive Personal Information StatementExcerpt from Visa's Privacy Notice
(1) REGULATORY LANDSCAPE: Social Security number collection and use is governed by the FTC's Standards for Safeguarding Customer Information and by state-specific Social Security number protection statutes in jurisdictions including California, New York, and Illinois. Sensitive personal information categories are also subject to heightened treatment under the CPRA for California residents and under multiple other state privacy laws. (2) GOVERNANCE EXPOSURE: High. Social Security numbers are among the most regulated personal data categories in the U.S. due to identity theft risk; improper collection, retention, or disclosure creates significant regulatory and litigation exposure. (3) JURISDICTION FLAGS: California's CPRA establishes a specific category of sensitive personal information with additional use and disclosure restrictions; New York, Illinois, and Texas also have relevant state-level protections. Financial services entities are additionally subject to the Gramm-Leach-Bliley Act's Safeguards Rule for customer financial information. (4) CONTRACT AND VENDOR IMPLICATIONS: Organizations receiving Visa data that includes Social Security numbers should confirm that data processing agreements address the specific handling requirements in the U.S. SSN Policy and that downstream vendors are contractually bound to equivalent protections. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should review the U.S. SSN Policy for consistency with applicable state Social Security number statutes, confirm that collection is limited to circumstances where legally required or operationally necessary, and verify that retention and disposal practices satisfy applicable requirements.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The existence of a dedicated policy for Social Security numbers and sensitive personal information indicates that Visa collects and processes these data categories for at least some U.S. users, which triggers heightened obligations under multiple U.S. state privacy laws and the FTC's Safeguards Rule.
Under this provision, U.S. users whose Social Security numbers or other sensitive personal information are collected by Visa are subject to a separate policy statement governing those data categories; the specific handling practices, retention periods, and access controls for these categories are addressed in that separate document rather than in the Global Privacy Notice.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Visa.