Back to Home
Paypal Privacy Summary
Finance
Global online payments platform for sending, receiving, and managing payments, supporting merchants, wallets, and related financial services.
This summary was generated using AI and may contain errors or omissions. Learn about our methodology. Always refer to the original privacy policy for legal purposes.
Quick Summary
- What They Collect: Financial identifiers, identity documents, biometrics, device and location data, imported contacts, and inferred profiles (concise).
- How They Use & Share It: To operate payments, prevent fraud, personalize offers, train AI, and share with affiliates, service providers, advertisers, CRAs, and authorities.
- Your Rights: Opt-out of marketing, edit Data & Privacy settings, withdraw consent where applicable, close your account, and exercise rights related to automated decisions.
Why You Should Care About Paypal's Privacy Practices
- PayPal collects highly sensitive financial and biometric data (SSN, bank routing numbers, face/voice IDs) which increases identity theft risk.
- Your data is used for profiling, automated decisions, and AI training, which can affect credit, access to services, and personalization.
- Data is shared broadly — advertisers, CRAs, service providers, and government authorities — expanding exposure and re-use.
- Retention is long (relationship plus ten years; biometrics up to three years), so deleted accounts may still have retained data.
Why High Exposure?
- Policy collects extensive sensitive financial and biometric data, including SSN, tax IDs, bank routing numbers and biometrics.
- Broad sharing with many categories of third parties, including advertising platforms, CRAs, service providers, and government authorities.
- Indefinite or long retention: data kept for the relationship plus ten years, and biometrics up to three years after account closure.
- Explicit profiling, automated decision making, and use of Personal Information to train AI models increase risk of opaque outcomes and personalization.
Privacy Highlights
What They Collect
- Account information (name, business name, address, phone, email)
- Profile information (username, profile picture, gender, personal description)
- User-provided payment information (credit/debit card numbers, CVV, bank account and routing numbers, IBAN)
- Seller/financial data (tax ID, Social Security number, account balances, payment history)
- Transaction and commercial information (purchase history, payout amount, payor information)
How They Share Data
- Business affiliates and subsidiaries (PayPal corporate group and listed PayPal family companies)
- Service providers (fraud prevention, hosting, payments, customer support, technology vendors)
- Analytics and measurement partners
- Advertising partners / advertising platforms
Data Retention
Personal information is retained for as long as needed for the relationship plus a period of 10 years (or longer if legally required); biometric data retained no more than 3 years after account closure, with additional retention for legal, audit, litigation, or compliance reasons.
Your Rights
- Withdraw consent (for purposes that required consent) (see Data and Privacy settings)
- Opt-out of marketing (unsubscribe links, reply STOP to texts)
- Cookie preferences / edit tracking and personalization settings
- Limit certain sharing (Data & Privacy settings; call options provided)
Detailed Analysis
Concerning Practices
- Uses personal information to train AI models and provides Agentic AI tools (policy states training AI on Personal Information)
- Automated decision making and profiling used for risk, fraud, creditworthiness, and product suitability decisions
- Shares data with advertising platforms and third parties for targeted/personalized advertising and partner marketing
- International transfers of Personal Information to countries with different data protection rules, relying on contractual safeguards
- Long retention periods: personal information retained for relationship duration plus 10 years (biometric data up to 3 years after account close)
- Collection of data about non-users via imported contacts (contact uploads) and linking non-account transactions to accounts
- Disclosure to government authorities, fraud prevention agencies, and sharing for legal or compliance purposes (FATCA/CRS notices)
- Sensitive financial and identity data collection (SSN, tax ID, biometrics) increases risk if exposed or misused
Personal Data Types
Account information (name, business name, address, phone, email)Profile information (username, profile picture, gender, personal description)User-provided payment information (credit/debit card numbers, CVV, bank account and routing numbers, IBAN)Seller/financial data (tax ID, Social Security number, account balances, payment history)Transaction and commercial information (purchase history, payout amount, payor information)User content and files (audio call recordings, uploaded images/identifiers)Biometric data (voice identification, photo/face scans) Imported contact information (contacts' names, emails, phone numbers)Device and technical information (IP address, device type, browser, device IDs, OS, language, screen resolution)Geolocation information (IP-based location and precise GPS when consented)Service usage and website usage data (features used, shopping history, pages visited, response times, errors)Log and event data (time/date of use, download errors, interaction logs)Inferred / derived data (gender, income, browsing and purchasing habits, creditworthiness, fraud and risk scores)Sensitive personal information (government-issued IDs, biometric data, financial account numbers)Characteristics of protected classifications (age/date of birth, nationality, disability, citizenship, military status)
Tracking Methods
CookiesPixel tagsWeb beaconsWidgetsCookies or other tracking technologies (as a group definition in the policy)
Third Parties
Business affiliates and subsidiaries (PayPal corporate group and listed PayPal family companies)Service providers (fraud prevention, hosting, payments, customer support, technology vendors)Analytics and measurement partnersAdvertising partners / advertising platformsThird-party app/integration developers (Apple App Store, Google Play Store, social networking sites)Government authorities and law enforcementAcquirers or successors in sale or merger scenarios (buyers in business transfers)Credit Reporting Agencies (CRAs), payment networks and processors, data brokers, financial institutions
User Controls
Withdraw consent (for purposes that required consent) (see Data and Privacy settings)Opt-out of marketing (unsubscribe links, reply STOP to texts)Cookie preferences / edit tracking and personalization settingsLimit certain sharing (Data & Privacy settings; call options provided)Close or delete account / stop using services (option to close account if you disagree with changes)Exercise rights related to Automated Decision Making (as described in 'Your Data Protection Rights')Edit account notification preferences (email, text, push)
Frequently Asked Questions About Paypal
Legal Disclaimer
This analysis is provided for informational purposes only and should not be used as legal advice. Privacy Exposure ratings and summaries are AI-generated assessments based on publicly available privacy policies — they are not statements of fact and may contain errors. Learn how ratings are determined. Consult with legal professionals for matters requiring legal guidance.