Do we need to disclose Plaid in our privacy policy?

Yes. Plaid processes sensitive financial data including bank account numbers, transaction history, and login credentials on your behalf, making it a third-party processor that must be clearly disclosed. Financial privacy laws including GLBA, CCPA, and state-specific regulations require transparency about how financial data is accessed and shared. Your privacy policy must explicitly name Plaid and explain what data it collects and why.

What specific information does Plaid collect from users?

Plaid collects bank account numbers and routing numbers, transaction history and account balances, the account holder's name and identity information, tokenized bank login credentials, income and employment verification data, and investment holdings. This data is collected only when users authorize access through Plaid's secure connection process and is used exclusively for the purpose you specify (such as account verification or income confirmation).

Does Plaid require a cookie consent banner?

No. Plaid does not use cookies in its core financial data linking functionality. However, your overall website may use cookies for other purposes, which would require appropriate consent management. Plaid's data collection operates through direct API connections rather than cookie-based tracking.

Where is my data processed, and who handles it?

Plaid Inc., a United States-based financial data processor, handles your data as a third-party service provider. Plaid is PCI-DSS compliant and subject to GLBA and state financial privacy laws. Your data is processed in the U.S. and shared with Plaid only upon your explicit consent. You can review Plaid's full privacy practices at https://plaid.com/legal/#privacy-policy.

Fintech

Privacy policy clauses for Plaid

Plaid is a financial data aggregator that connects to your bank accounts to verify account ownership, retrieve transaction history, and confirm income or employment. We use Plaid to securely access financial information you authorize us to access for account verification and underwriting purposes.

Scan my site free →Copy sample clause ↓

Free scan · No signup · Results in 60 seconds

What data Plaid collects

Your privacy policy must disclose each of the following data types when you use Plaid.

Bank account numbers and routing numbers

Transaction history and balances

Account holder name and identity

Bank login credentials (tokenized)

Income and employment verification

Investment holdings

When does Plaid trigger privacy obligations?

Data Flow Initiation

Plaid activates privacy obligations the moment you integrate its SDK or API into your application. Unlike analytics tools, Plaid immediately handles sensitive financial data: bank account numbers, routing numbers, transaction history, account holder identity, and tokenized login credentials. This is not cookie-based tracking—it is direct access to regulated financial information.

Privacy policy clauses for Plaid

What data Plaid collects

When does Plaid trigger privacy obligations?

Data Flow Initiation

Regulatory Triggers

Where data goes

Common compliance pitfalls

Pitfall 1: Treating Plaid as a "Service Provider Only"

Pitfall 2: Missing Consent for Transaction History and Income Verification

Pitfall 3: No DPA or Forgetting GDPR/State Obligations When Plaid Holds Data Abroad

Legal note

Sample privacy policy clause

What regulators look for

Priority Audit Areas

Frequently asked questions

Do we need to disclose Plaid in our privacy policy?

What specific information does Plaid collect from users?

Does Plaid require a cookie consent banner?

Where is my data processed, and who handles it?

Don't ship without Bandit.