Bank of America
- The policy allows AI training; it does not describe an opt-out.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- Staff may review your content; the policy does not describe an opt-out.
Online banking with behavioral ads, Erica voice recordings, and broad limits.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
- Uses your content for AI training with no opt-out
Collected
Personal info from sites and apps, plus activity used for ads; Erica records your voice.
Read the exact line
Privacy policy
“How we collect personal information when you visit, use or interact with us online, and through our ads displayed through online services operated by us or non-affiliated third parties.”
Training
They use it to run banking, ads, and events, and they improve Erica with your recordings.
Read the exact line
Privacy policy
“How we may use or share personal information collected to deliver products and services to you and for advertising or event management purposes.”
Sharing
Affiliates, ad companies, and vendors (including Erica’s voice provider) can see information.
Read the exact line
Privacy policy
“Bank of America works with third-party providers who are contractually obligated to comply with our policies to protect information.”
Kept
Erica voice audio is kept 90 days; they do not say how long other data is kept.
Read the exact line
Terms of service
“Your voice interactions are saved for 90 days so they can be analyzed to help refine Erica’s listening skills.”
Controls
You can opt out of interest-based ads and control some marketing and Erica settings.
Read the exact line
Privacy policy
“To learn more about ad choices, or to opt out of interest-based advertising with non-affiliated third-party sites, visit YourAdChoices.com/control”
Fine print
They can cut offline access anytime, and you may have to pay their legal bills.
No exact line could be verified.
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Opt out of interest-based ads
YourAdChoices.com/control or the Network Advertising Initiative Opt-Out Tool
Control marketing and data sharing
Privacy Notices and Choices: Control how we share your data and market to you
Turn off some Erica functions
Mobile app Profile & Settings
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
If something goes wrong because of how you used online banking, you may have to pay their lawyers and losses.
Read the exact line
Terms of service
“You agree to , us, our Vendors, including our or their owners, directors, officers, agents from and against all claims, losses, expenses, damages and costs”
For example, if a dispute over a Zelle payment leads to a lawsuit against the bank, they can ask you to cover their costs.
They can turn off online and mobile banking whenever they want, even without telling you first.
Read the exact line
Terms of service
“We may terminate your participation in any or all of your Services at any time and for any reason, including (i) inactivity”
For example, they could shut off the app after inactivity and you would have to use branches or phone banking instead.
Talking to the in-app assistant means your voice is recorded and written down.
Read the exact line
Terms of service
“Once you initiate an interaction with Erica, we will record and transcribe these interactions.”
For example, asking Erica for your balance in a quiet room still creates a recording they keep.
Another company stores your Erica chats to check quality and transcribe them.
Read the exact line
Terms of service
“Bank of America uses a third-party service provider to provide voice responses, which keeps a record of your conversations for quality assurance”
For example, a vendor could listen to or read a recording of you asking about a late payment.
Your Erica talks can be used to make the assistant better, without a clear off switch for that use.
Read the exact line
Terms of service
“we may use Erica recordings and interactions to improve the service, or use data to provide a more personalized experience”
For example, a misheard transfer request could be used to train how Erica hears similar words.
They track online activity so they can show ads based on what you do on the web.
Read the exact line
Privacy policy
“Relationship-based ads and online behavioral advertising help us do that.”
For example, visiting a mortgage page could lead to Bank of America ads on other websites.
They do not promise the app will always work or be error-free.
Read the exact line
Terms of service
“THE SERVICES ARE PROVIDED ON AN “AS IS” AND “AS AVAILABLE” BASIS.”
For example, if a bill pay fails because the site is down, they may say they owed you .
You can turn off some tracking ads using industry opt-out sites.
Read the exact line
Privacy policy
“To learn more about ad choices, or to opt out of interest-based advertising with non-affiliated third-party sites, visit YourAdChoices.com/control”
For example, you can visit YourAdChoices and opt out so fewer interest-based Bank of America ads follow you.
Some Erica features can be turned off in the app settings.
Read the exact line
Terms of service
“You may enable or disable certain Erica functions at any time in the "Profile & Settings" section.”
For example, you can go to Profile & Settings and switch off voice-assisted bill pay.
If they change the rules and you keep using the app, they treat that as you agreeing.
Read the exact line
Terms of service
“You agree that by continuing to use the Services after the date that changes are posted to our website, such changes will be effective for transactions made after that date”
For example, a new fee posted on the site could apply the next time you log in even if you never opened an email.
Words to know
Legal words from the lines above, in plain English.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- opt out
- Something is on by default and stays on until you find the setting and turn it off. For example, your chats may be used for training unless you go into settings and switch it off.
- targeted advertising
- Ads chosen for you based on what you have done across other apps and websites, not just this one. For example, you look at shoes in one app and see shoe ads in a totally different app the next day.
- indemnify
- You promise to pay the company's legal costs and losses if your use of the service gets it sued. For example, if you post a song you do not own and the label sues the app, you owe the app's lawyer bills.
- service providers
- Outside companies that handle your data on the app's instructions, such as a cloud host or an email sender. For example, the company that stores the app's files in the cloud sees your data but only does what the app tells it.
- as is
- You get the service in whatever state it is in, with no promise that it works or will keep working. For example, if the app deletes your photos by mistake, it is not promising to fix that or pay you back.
How we got here · grade F · score 27/100 · 15 of 15 policy answers backed by a verified quote · 4 not stated
What does the app collect beyond what it needs to work?
They collect personal information from sites, apps, and ads, including online activity used for behavioral advertising, not only account content.
Does it record your voice, face or body, and what happens to that?
Erica records and transcribes your voice, a vendor keeps the conversations, audio is stored 90 days, and recordings are used to improve the service.
Are your chats and uploads used to train AI models, and is that off by default?
They say Erica is not generative AI, but they use recordings and interactions to improve the service and do not describe an opt-out for that.
Can employees or contractors read your conversations, and when?
A third-party voice vendor keeps conversation records for quality assurance and transcription; no opt-out for that review is described.
Are you profiled or tracked for advertising?
They use online behavioral advertising on non-affiliated sites and participate in DAA/NAI opt-outs.
Do they sell or share your data, and can you opt out?
They share for marketing and ads and offer choices to control sharing and marketing, plus Deals sharing of anonymized transactions.
What rights do they take over what you type and what the AI makes?
Not stated in the documents.
How long do they keep your data after you delete it, and can you delete it in the app?
Not stated in the documents.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Erica uses your banking relationship to give insights; some functions can be disabled, but there is no full memory viewer described.
Do they commit to basic security, and have they leaked data?
They say they run assessments and follow privacy standards, and they point to a Security Center, without naming audits or a VDP.
Is there a real age gate, and are teens protected?
Not stated in the documents.
Will they tell you when the rules change, and is the policy specific?
The privacy notice is dated June 2025 and they only update the date; the terms say continued use after posting means you accept.
Can they close your account without warning, and can you get your data out first?
They may end online services at any time for any reason and are not obliged to notify you first.
If something goes wrong, who pays?
Services are as-is, damages can be capped at $100 where allowed, and you must indemnify them for use of the services.
Do subscriptions renew on their own, and can you get a refund?
Not stated in the documents.
The privacy policy is 1,358 words at a college level (Flesch reading ease 49.4); the terms are 22,534 words at a college level.
