Coinbase
- The documents do not say whether your data trains AI.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- The documents do not say who can read your content.
Coinbase collects ID, biometrics, money and device data, shares it for ads and compliance.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
They collect ID photos, biometrics, bank and tax details, transactions, device data, and partner data.
Read the exact line
Privacy policy
“Electronic Identification (“ EIDV”) Information Biometric information generated based on photos or videos you provide in order for us to verify your identity”
Training
They use your data to run the service, meet legal rules, send marketing, and target ads on other sites.
Read the exact line
Privacy policy
“We receive information such as your name and contact information from our marketing partners, including in some instances what marketing content you viewed or the actions you take on and off our Sites and Apps, to better understand your preferences and customize the ads that you see.”
Sharing
Coinbase companies, ID vendors, advertisers like Meta, and other providers can get your information.
Read the exact line
Privacy policy
“This involves disclosing to our third-party service providers conversion data, including IP address, with advertisers such as Meta to create custom audience lists and AppLovin.”
Kept
They keep data for legal and security needs, including biometrics for as long as money rules require.
Read the exact line
Privacy policy
“We retain biometric information (as part of our retention of Supplemental Identification Information) for the period required for financial regulatory compliance or otherwise as required by applicable law.”
Controls
You can request access or deletion in the Dashboard or by contacting them.
Read the exact line
Privacy policy
“We offer privacy tools for you to request access to or deletion of information we hold about you. You can use these tools by visiting your Dashboard.”
Fine print
they can close Commerce accounts with no notice.
No exact line could be verified.
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Request access or deletion
Log in and open your Dashboard, or use the Support Portal or dpo@coinbase.com
Turn off marketing emails
Account settings, Support Portal, or dpo@coinbase.com
Cancel a Commerce account
Follow account closure instructions on the Coinbase Commerce website
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
They send data about you, including your IP address, to ad companies so they can show Coinbase ads to people like you.
Read the exact line
Privacy policy
“This involves disclosing to our third-party service providers conversion data, including IP address, with advertisers such as Meta to create custom audience lists and AppLovin.”
For example, after you open an account, you might see Coinbase ads on Facebook because Meta matched your IP or conversion data.
For Coinbase Commerce, they can shut you off instantly without telling you first.
Read the exact line
Terms of service
“We may terminate or suspend your access to and use of the Services with immediate effect, at our sole discretion for any reason, at any time and without notice to you.”
For example, your merchant payments page could stop working overnight with no email.
If someone sues them over how you used Commerce, you may have to pay their legal bills.
Read the exact line
Terms of service
“You will and CBTL and its officers, directors, employees and agents from and against any claims, disputes, demands, liabilities, damages, losses, and costs and expenses, including, without limitation, reasonable legal and accounting fees”
For example, if a customer sues over a crypto payment you took, you might have to cover Coinbase’s lawyers.
If Commerce goes wrong, they say they will not pay you more than $100 in many cases.
Read the exact line
Terms of service
“IN NO EVENT SHALL CBTL’ TO YOU FOR ALL DAMAGES (OTHER THAN AS MAY BE REQUIRED BY APPLICABLE LAW IN CASES INVOLVING PERSONAL INJURY) EXCEED THE AMOUNT OF ONE HUNDRED U.S. DOLLARS ($USD100.00)”
For example, if a bug costs you far more than $100, the terms still cap what they say they owe at $100.
They turn your selfie or ID video into biometric data to check who you are, and vendors process it.
Read the exact line
Privacy policy
“Electronic Identification (“ EIDV”) Information Biometric information generated based on photos or videos you provide in order for us to verify your identity”
For example, a face scan from your ID video can be stored and sent to an identity-check company.
If you invite friends, they collect those people’s phone numbers or emails.
Read the exact line
Privacy policy
“Referral Information: Your contacts’ phone or email addresses if you choose to invite friends to Coinbase.”
For example, picking contacts to invite can send their emails to Coinbase.
Face or ID biometrics are kept for as long as money rules say, not just until you finish signup.
Read the exact line
Privacy policy
“We retain biometric information (as part of our retention of Supplemental Identification Information) for the period required for financial regulatory compliance or otherwise as required by applicable law.”
For example, closing the app does not mean your ID selfie is deleted right away.
They get a broad license to use what you upload, but they say it is only to run the service.
Read the exact line
Terms of service
“you grant us a worldwide, non-exclusive, , , and transferable license to use, copy, distribute, create derivative works of, display, and perform the User Content that you upload, submit, store, send, or receive through our Services.”
For example, invoices or files you upload can be copied and shown as needed to operate Commerce.
You must be 18. They say they will close underage accounts if they find them.
Read the exact line
Privacy policy
“The Sites and Services are not directed to persons under the age of 18, and we do not knowingly request or collect any information about persons under the age of 18.”
For example, a 17-year-old who signs up can have the account closed and data deleted.
You can ask to see or delete data through an in-account dashboard, though law may still require keeping some of it.
Read the exact line
Privacy policy
“We offer privacy tools for you to request access to or deletion of information we hold about you. You can use these tools by visiting your Dashboard.”
For example, you can open the Dashboard and request a copy or deletion of your file.
Words to know
Legal words from the lines above, in plain English.
- biometric
- Measurements of your body that identify you, like your face, fingerprint or voice. For example, a selfie used to unlock the app or a voice recording matched to you.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- service providers
- Outside companies that handle your data on the app's instructions, such as a cloud host or an email sender. For example, the company that stores the app's files in the cloud sees your data but only does what the app tells it.
- retention
- How long a company keeps your data before deleting it. For example, a policy might keep your messages for 30 days after you delete them, or for as long as it likes.
- data subject rights
- The legal rights you have over your data, such as seeing it, fixing it, deleting it or moving it. For example, you can email the company and ask for a copy of everything it holds about you.
- indemnify
- You promise to pay the company's legal costs and losses if your use of the service gets it sued. For example, if you post a song you do not own and the label sues the app, you owe the app's lawyer bills.
- limitation of liability
- A cap on what the company will ever pay you if something goes wrong, often only what you paid in the last year. For example, if a leak of your data costs you thousands, the most you may get back is a month's subscription fee.
- worldwide license
- You let the company use your content anywhere on earth, usually for free and for as long as it likes. For example, a video you post can be shown in ads in any country without asking you again.
- royalty-free
- The company can use your content without ever paying you for it. For example, your photo can appear in the app's ads and you get nothing.
- sublicensable
- The company can pass its rights over your content on to other companies without asking you. For example, an app can let an advertiser or a partner reuse your video under the licence you gave.
How we got here · grade F · score 30/100 · 16 of 16 policy answers backed by a verified quote · 4 not stated
What does the app collect beyond what it needs to work?
They collect far more than a login: government IDs, photos and videos, biometrics, bank and tax numbers, employment, spouse tax IDs, contacts you invite, device data, and data from ads and public lists.
Does it record your voice, face or body, and what happens to that?
They create biometric data from photos or videos you give for ID checks and share it with electronic ID vendors. They keep it for regulatory periods.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
They get data from marketing partners and send conversion data and IP addresses to advertisers such as Meta and AppLovin to target ads.
Do they sell or share your data, and can you opt out?
They share with affiliates, ID vendors, marketers, and advertisers. You can object to some marketing and use the Privacy Rights Dashboard; the policy does not clearly say they never sell data.
What rights do they take over what you type and what the AI makes?
The Commerce terms say they do not claim ownership of your content, but you grant a worldwide sublicensable license only to operate and provide the services.
How long do they keep your data after you delete it, and can you delete it in the app?
You can request deletion in the Privacy Rights Dashboard, but they keep data for legal, AML, and security needs, including biometrics for regulatory periods.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
They say they use reasonable technical and organizational safeguards and require providers to do the same. No independent audit is described in these pages.
Is there a real age gate, and are teens protected?
You must be 18. They say the service is not for under-18s and they will close suspected underage accounts. There is no extra age-check described.
Can you sue or join a class action if things go wrong?
Mandatory arbitration and a class-action waiver, no opt-out
Will they tell you when the rules change, and is the policy specific?
The privacy policy is dated and they say they will give reasonable notice of material changes. How long they keep each type of data is still general.
Can they close your account without warning, and can you get your data out first?
The Commerce terms say they can suspend or end access immediately for any reason without notice. You can cancel on the Commerce site.
If something goes wrong, who pays?
Commerce is provided as is, liability is often capped at $100, and you must cover their legal costs if claims arise from your use.
Do subscriptions renew on their own, and can you get a refund?
Not stated in the documents.
The privacy policy is 8,195 words at a professional or legal expert level (Flesch reading ease 25.1); the terms are 6,676 words at a college graduate level.
