Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The terms prohibit disclosure of user personal information except in six defined circumstances, the last of which (Section 4.6) permits disclosure whenever Webull unilaterally determines it to be necessary, without specifying the nature or category of such necessity.
This analysis describes what Webull's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Section 4.6 creates an open-ended disclosure authorization that is not bounded by a legal basis, regulatory requirement, or defined category of necessity. This provision may require evaluation under the CCPA's requirements for disclosing personal information and GDPR's lawful basis requirements for data processing and transfer.
Interpretive note: The practical scope of Section 4.6 depends on how Webull defines 'necessary' in practice and whether applicable state or international privacy laws constrain its application; the Privacy Policy may provide additional specificity not present in this document.
Under this clause, Webull may disclose a user's personal information, including information collected during registration and platform use, in any circumstance Webull determines to be necessary, in addition to the five enumerated categories. The Webull Privacy Policy is referenced for additional detail but this Terms of Service document does not further define the scope of Section 4.6.
Cross-platform context
See how other platforms handle Discretionary User Data Disclosure and similar clauses.
Compare across platforms →Monitoring
Webull has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Webull promises not to disclose any personal or other information provided to Webull in confidence, including information provided during the account registration process or collected by Webull while the user was using the Products, except for the following situations: 4.1 disclosure is required by relevant laws and regulations; 4.2 disclosure is required by a third-party to complete a transaction initiated by the user; 4.3 situations related to the protection of Webull's intellectual property rights or other important rights; 4.4 the username or password is illegally used as a result of hacking or negligence by the user; 4.5 emergency situations in which public privacy and security are at risk; and 4.6 other situations in which Webull determines such disclosure is necessary.Excerpt from Webull's Customer Agreement
1) REGULATORY LANDSCAPE: This provision implicates the California Consumer Privacy Act (CCPA) and its amendment under the CPRA, which require specific disclosure of the categories of personal information shared and the purposes for sharing. GDPR Article 6 requires a defined lawful basis for processing and disclosure; a unilateral necessity determination may not satisfy this standard. The FTC Act's prohibition on unfair or deceptive practices may also engage with a disclosure provision that does not specify the category of necessity. The SEC and FINRA may have expectations regarding the confidentiality of customer financial data held by registered broker-dealers. 2) GOVERNANCE EXPOSURE: High. The open-ended nature of Section 4.6 creates compliance exposure under multiple privacy frameworks because it does not define the circumstances constituting necessity, does not require a legal basis, and does not provide user notice or consent prior to disclosure under this category. 3) JURISDICTION FLAGS: California residents have heightened exposure under CCPA/CPRA. EU and EEA users have heightened exposure under GDPR. The provision does not specify geographic carve-outs or differentiate by user jurisdiction. 4) CONTRACT AND VENDOR IMPLICATIONS: Institutional clients and business users should assess whether this disclosure provision is compatible with their own data governance obligations, particularly where Webull holds personally identifiable financial or trading data subject to independent regulatory requirements. 5) COMPLIANCE CONSIDERATIONS: A data mapping exercise should identify all categories of personal information collected during registration and platform use that could be subject to Section 4.6 disclosure. Consent mechanism audits should assess whether existing disclosures satisfy CCPA and GDPR requirements for the open-ended disclosure category. The Privacy Policy should be reviewed in conjunction with this provision to assess whether it provides the specificity required by applicable law.
Section 4.6 creates an open-ended disclosure authorization that is not bounded by a legal basis, regulatory requirement, or defined category of necessity. This provision may require evaluation under the CCPA's requirements for disclosing personal information and GDPR's lawful basis requirements for data processing and transfer.
Under this clause, Webull may disclose a user's personal information, including information collected during registration and platform use, in any circumstance Webull determines to be necessary, in addition to the five enumerated categories. The Webull Privacy Policy is referenced for additional detail but this Terms of Service document does not further define the scope of Section 4.6.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Webull.