PayPal
- The policy allows AI training; it does not describe an opt-out.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- The documents do not say who can read your content.
PayPal keeps financial data for years, trains AI on it, shares widely.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
- Uses your content for AI training with no opt-out
Collected
They collect IDs, money details, GPS, contacts, shopping history, device data, and sometimes face or voice.
Read the exact line
Privacy policy
“Personal identifiers: Such as name, business name, address, phone number, email, IP address, device information, information collected from cookies or other tracking technologies, government-issued identification”
Training
They use your data to move money, stop fraud, target ads, personalize shopping, and train AI.
Read the exact line
Privacy policy
“We may use Personal Information to train our artificial intelligence (AI) models that power our Services and help us deliver more secure, efficient, and personalized services.”
Sharing
Banks, merchants, credit bureaus, affiliates, ad platforms, and other users can get some of your data.
Read the exact line
Privacy policy
“We disclose your Personal Information with service providers and third parties, including those participating in the payment network, to help us provide Services, protect our customers from risk and fraud, market our products”
Kept
They keep account data for the relationship plus about 10 years; biometrics up to 3 years after close.
Read the exact line
Privacy policy
“Personal Information used for the ongoing relationship between you and PayPal is stored for the duration of the relationship plus a period of 10 years or such period as mandated by any applicable local law”
Controls
You can close your account, , and turn off some sharing in Data and Privacy settings.
Read the exact line
Privacy policy
“To opt-out of disclosures of Personal Information to Partners and Merchants for personalized shopping experiences, log into your PayPal account and edit your preferences in the Data and Privacy setting.”
Fine print
Services are as-is and you them.
No exact line could be verified.
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Limit sharing and personalized shopping
Log into PayPal → Data and Privacy settings
Request a copy or deletion of your data
Log in to your PayPal account or profile portal, or call 1-888-221-1161 (U.S.)
Cancel a recurring seller payment
Account settings or PayPal Help Center, or call (888) 221-1161, at least 3 business days before the next charge
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
PayPal can use your personal and payment data to train its AI. The policy does not give a simple off switch for that.
Read the exact line
Privacy policy
“We may use Personal Information to train our artificial intelligence (AI) models that power our Services and help us deliver more secure, efficient, and personalized services.”
For example, your checkout history could be used to train models that power recommendations or fraud tools.
If someone sues PayPal because of how you used the account, you may have to pay their legal bills.
Read the exact line
Terms of service
“You agree to and hold PayPal harmless from any claim or demand (including reasonable legal fees) made or incurred by any third party due to or arising out of your breach of this user agreement”
For example, if a buyer sues over a sale you made, PayPal can ask you to cover its lawyers.
Even after you leave, they can keep your data for about a decade, and longer if the law says so.
Read the exact line
Privacy policy
“Personal Information used for the ongoing relationship between you and PayPal is stored for the duration of the relationship plus a period of 10 years or such period as mandated by any applicable local law once our relationship comes to an end”
For example, closing your account today would not wipe transaction records until many years later.
They get a lasting, transferable right to use content you upload, not just to process a payment.
Read the exact line
Terms of service
“when you provide content to PayPal or post content using PayPal services, you grant PayPal (and parties that we work with) a non-exclusive, , , transferable, and worldwide license to use your content”
For example, a photo or description you add to a profile could be used to operate and promote PayPal.
Third parties help show interest-based ads and can track how you interact with those ads.
Read the exact line
Privacy policy
“For marketing purposes, we may use third parties to identify and display ads on our Services tailored to your interests and track interactions with these ads.”
For example, shopping on a merchant site that uses PayPal could feed ads you see later.
They also get data about you from credit bureaus, merchants, and data brokers, not only from you.
Read the exact line
Privacy policy
“Third parties, including service providers, Partners and Merchants, payment partners, such as payment networks and processors, credit reporting agencies and public and private credit databases ("CRAs"), government entities, data brokers, and financial institutions.”
For example, a credit file or broker list could be mixed with your PayPal activity.
If you agree in the app, they can take face or voice scans to prove it is you.
Read the exact line
Privacy policy
“Biometric data: Such as voice identification, photo identification, or face scans, which we may collect when you consent in the user experience to authenticate you for certain actions related to your account”
For example, unlocking a limited account might ask for a face scan that they keep for years after close.
They say they do not sell your data or share it for that specific kind of targeted ad under U.S. state privacy laws.
Read the exact line
Privacy policy
“PayPal does not “sell” Personal Information or “share” Personal Information for cross-context behavioral or targeted advertising that is subject to non-exempt practices under comprehensive privacy laws in the United States”
For example, they still share for payments and marketing, but claim -style “sale/share” does not apply.
but only if you mail a signed notice within 30 days of first agreeing.
Read the exact line
Terms of service
“The opt-out notice must be postmarked no later than 30 days after the date you accept this user agreement for the first time.”
For example, if you signed up last year and never mailed the form.
They describe basic security like encryption, firewalls, and locked data centers.
Read the exact line
Privacy policy
“The security measures include firewalls, data encryption, physical access controls to our data centers, and information access authorization controls.”
For example, card numbers are supposed to be encrypted and not freely accessible to every employee.
PayPal is for adults 18 and over. They say they will delete data if they learn a child signed up.
Read the exact line
Privacy policy
“The Sites and Services are not directed to children under the age of 18. We do not knowingly collect information, including Personal Information, from children under the age of 18”
For example, a 16-year-old should not open an account; if they did, you can ask PayPal to delete it.
Words to know
Legal words from the lines above, in plain English.
- cookies
- Small files a website saves on your device so it can recognise you and remember what you did. For example, a cookie keeps you logged in and can also tell an ad company which sites you visited.
- tracking pixels
- Tiny invisible images or bits of code in a page, app or email that report back when and where you opened it. For example, a pixel in a marketing email tells the sender the moment you read it.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- service providers
- Outside companies that handle your data on the app's instructions, such as a cloud host or an email sender. For example, the company that stores the app's files in the cloud sees your data but only does what the app tells it.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- opt out
- Something is on by default and stays on until you find the setting and turn it off. For example, your chats may be used for training unless you go into settings and switch it off.
- indemnify
- You promise to pay the company's legal costs and losses if your use of the service gets it sued. For example, if you post a song you do not own and the label sues the app, you owe the app's lawyer bills.
- irrevocable
- Cannot be taken back or cancelled once given, even if you change your mind or delete your account. For example, an irrevocable licence to your photos means you cannot withdraw it later.
- royalty-free
- The company can use your content without ever paying you for it. For example, your photo can appear in the app's ads and you get nothing.
- worldwide license
- You let the company use your content anywhere on earth, usually for free and for as long as it likes. For example, a video you post can be shown in ads in any country without asking you again.
- data broker
- A company that buys, collects and resells information about people, usually without ever meeting them. For example, your phone number and shopping habits can be sold as part of a list to a company you never heard of.
- biometric
- Measurements of your body that identify you, like your face, fingerprint or voice. For example, a selfie used to unlock the app or a voice recording matched to you.
How we got here · grade D · score 34/100 · 15 of 15 policy answers backed by a verified quote · 1 not stated
What does the app collect beyond what it needs to work?
They collect far more than account and payment basics, including GPS, imported contacts, cookies, browsing, inferred habits, and data from brokers and credit bureaus.
Does it record your voice, face or body, and what happens to that?
Face, photo, and voice scans may be collected with consent to verify you, and biometric data can be kept up to 3 years after the account closes.
Are your chats and uploads used to train AI models, and is that off by default?
They say they may use personal information to train AI models. The documents do not describe a way to turn that off.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
They use cookies and third parties for interest-based ads and do not honor Do Not Track.
Do they sell or share your data, and can you opt out?
They share with affiliates, merchants, and marketers. U.S. users can limit some sharing in Data and Privacy settings. They say they do not CCPA-sell for cross-context ads.
What rights do they take over what you type and what the AI makes?
You keep ownership, but you grant an irrevocable, transferable, worldwide license so PayPal and partners can use your content.
How long do they keep your data after you delete it, and can you delete it in the app?
You can request deletion or close the account, but they keep relationship data about 10 years after, and some data longer for law or disputes.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
They infer gender, income, habits, and preferences and say Agentic AI tools learn from your interactions. Full view/edit/off controls for that profile are not described.
Do they commit to basic security, and have they leaked data?
They describe firewalls, encryption, physical data-center controls, and access limits. No independent audit is named here.
Is there a real age gate, and are teens protected?
You must be 18 (or the age of majority). They say the service is not for children under 18 and they do not knowingly collect from them.
Will they tell you when the rules change, and is the policy specific?
Both documents are dated. Privacy changes that need notice get 30 days on the Policy Updates page; personal-account terms get at least 21 days.
Can they close your account without warning, and can you get your data out first?
They can close or limit accounts, including immediately for restricted activity, and say they will give notice and let you withdraw unrestricted funds. A general data-export path is not spelled out in the terms.
If something goes wrong, who pays?
Services are as-is, liability is limited to actual direct damages, and you must indemnify PayPal for many third-party claims.
Do subscriptions renew on their own, and can you get a refund?
Seller automatic/recurring payments can charge you on a schedule. Varying amounts should get at least 10 days’ notice, and personal accounts can cancel 3 business days ahead.
The privacy policy is 17,321 words at a college graduate level (Flesch reading ease 30.2); the terms are 27,637 words at a college level.
