PayPal
- The policy allows AI training; it does not describe an opt-out.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- The documents do not say who can read your content.
PayPal collects a lot of financial and tracking data, may train AI on it, keeps it for years.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
- Uses your content for AI training with no opt-out
Collected
They collect payments, IDs, device data, browsing, contacts, inferences, and sometimes GPS, voice, or face scans.
Read the exact line
Privacy policy
“Personal identifiers: Such as name, business name, address, phone number, email, IP address, device information, information collected from cookies or other tracking technologies, government-issued identification, signature, and other information necessary to establish an account or profile.”
Training
They use your data to run payments, stop fraud, personalize ads, and train AI models.
Read the exact line
Privacy policy
“We may use Personal Information to train our artificial intelligence (AI) models that power our Services and help us deliver more secure, efficient, and personalized services.”
Sharing
Service providers, partners, merchants, credit bureaus, other users, and advertisers can get some of your data.
Read the exact line
Privacy policy
“We disclose your Personal Information with service providers and third parties, including those participating in the payment network, to help us provide Services, protect our customers from risk and fraud, market our products, and comply with legal obligations.”
Kept
They often keep account data for the relationship plus 10 years, and biometrics up to 3 years after close.
Read the exact line
Privacy policy
“Personal Information used for the ongoing relationship between you and PayPal is stored for the duration of the relationship plus a period of 10 years or such period as mandated by any applicable local law once our relationship comes to an end”
Controls
You can close the account, , and turn off some partner sharing in Data and Privacy settings.
Read the exact line
Privacy policy
“To opt-out of disclosures of Personal Information to Partners and Merchants for personalized shopping experiences, log into your PayPal account and edit your preferences in the Data and Privacy setting.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Limit partner and affiliate sharing
Log into PayPal and edit preferences in Data and Privacy settings, or call 1-888-221-1161
or close the account
Log in and use account or profile settings, or call U.S. customer service at 1-888-221-1161
Turn off optional marketing messages
Unsubscribe link in emails, reply STOP to texts, or change notification settings in the account
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
They can use your personal information, including how you use PayPal, to train their AI. The policy does not describe a way to turn that off.
Read the exact line
Privacy policy
“We may use Personal Information to train our artificial intelligence (AI) models that power our Services and help us deliver more secure, efficient, and personalized services.”
For example, your payment history and support chats could be used to teach their AI systems.
If someone sues them because of how you used PayPal, you may have to pay their legal bills.
Read the exact line
Terms of service
“You agree to and hold PayPal harmless from any claim or demand (including reasonable legal fees) made or incurred by any third party due to or arising out of your breach of this user agreement, your improper use of the PayPal services”
For example, if a buyer sues PayPal over a sale you made that broke the rules, you could be asked to cover PayPal’s lawyer costs.
Even after you leave, they can keep a lot of your data for about ten more years, and sometimes longer if the law allows.
Read the exact line
Privacy policy
“Personal Information used for the ongoing relationship between you and PayPal is stored for the duration of the relationship plus a period of 10 years or such period as mandated by any applicable local law once our relationship comes to an end”
For example, closing your account today would not wipe your transaction history for a decade.
They get a lasting right to use content you upload, and they can pass that right to others. They do not pay you.
Read the exact line
Terms of service
“when you provide content to PayPal or post content using PayPal services, you grant PayPal (and parties that we work with) a non-exclusive, , , transferable, and worldwide license to use your content”
For example, a photo or description you put on your PayPal profile could be used to run or promote their services even after you leave.
They and partners track you with cookies to show ads based on your interests, not only the page you are on.
Read the exact line
Privacy policy
“We and our partners use Cookies to grant you access to our Sites, Services, applications and tools, recognize you as a user, customize your online experiences and online content, including to serve you interest-based advertising”
For example, shopping on a merchant site that uses PayPal could later affect ads you see elsewhere.
They also get information about you from credit bureaus, data brokers, and other companies, not only from you.
Read the exact line
Privacy policy
“Third parties, including service providers, Partners and Merchants, payment partners, such as payment networks and processors, credit reporting agencies and public and private credit databases ("CRAs"), government entities, data brokers, and financial institutions.”
For example, a data broker or credit file could add extra details to what PayPal already knows from your payments.
If you use face or voice checks, that data can stay linked to you for up to three years after you close the account.
Read the exact line
Privacy policy
“We retain biometric data for as long as needed or permitted given the purpose for which it was collected and no more than 3 years after your account closes, unless otherwise required by applicable law.”
For example, a face scan used to unlock a transfer could still be stored years after you leave PayPal.
For U.S. state privacy laws, they say they do not sell your data or share it for that kind of targeted ads. Other sharing still happens.
Read the exact line
Privacy policy
“PayPal does not “sell” Personal Information or “share” Personal Information for cross-context behavioral or targeted advertising that is subject to non-exempt practices under comprehensive privacy laws in the United States”
For example, they still share data with merchants to complete a purchase even if they say they do not “sell” it.
You are supposed to be 18 or older. They say they will delete data if they learn someone under 18 signed up.
Read the exact line
Privacy policy
“The Sites and Services are not directed to children under the age of 18. We do not knowingly collect information, including Personal Information, from children under the age of 18”
For example, a 17-year-old should not open an account; if they did, you can ask PayPal to delete it.
They say they use things like firewalls, encryption, and locked data centers to protect your information.
Read the exact line
Privacy policy
“We maintain technical, physical, and administrative security measures designed to provide reasonable protection for your Personal Information against loss, misuse, interference, unauthorized access, disclosure, and alteration.”
For example, they claim payment details are stored with encryption and limited staff access, though no independent audit is described here.
Words to know
Legal words from the lines above, in plain English.
- cookies
- Small files a website saves on your device so it can recognise you and remember what you did. For example, a cookie keeps you logged in and can also tell an ad company which sites you visited.
- tracking pixels
- Tiny invisible images or bits of code in a page, app or email that report back when and where you opened it. For example, a pixel in a marketing email tells the sender the moment you read it.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- service providers
- Outside companies that handle your data on the app's instructions, such as a cloud host or an email sender. For example, the company that stores the app's files in the cloud sees your data but only does what the app tells it.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- opt out
- Something is on by default and stays on until you find the setting and turn it off. For example, your chats may be used for training unless you go into settings and switch it off.
- indemnify
- You promise to pay the company's legal costs and losses if your use of the service gets it sued. For example, if you post a song you do not own and the label sues the app, you owe the app's lawyer bills.
- irrevocable
- Cannot be taken back or cancelled once given, even if you change your mind or delete your account. For example, an irrevocable licence to your photos means you cannot withdraw it later.
- royalty-free
- The company can use your content without ever paying you for it. For example, your photo can appear in the app's ads and you get nothing.
- worldwide license
- You let the company use your content anywhere on earth, usually for free and for as long as it likes. For example, a video you post can be shown in ads in any country without asking you again.
- targeted advertising
- Ads chosen for you based on what you have done across other apps and websites, not just this one. For example, you look at shoes in one app and see shoe ads in a totally different app the next day.
- data broker
- A company that buys, collects and resells information about people, usually without ever meeting them. For example, your phone number and shopping habits can be sold as part of a list to a company you never heard of.
How we got here · grade D · score 35/100 · 16 of 16 policy answers backed by a verified quote · 2 not stated
What does the app collect beyond what it needs to work?
They collect far more than account and payment details, including cookies, browsing, imported contacts, inferred habits, partner shopping data, and sometimes precise location.
Does it record your voice, face or body, and what happens to that?
They may collect voice, photo, or face scans with your consent to verify you, and they can keep that biometric data up to three years after the account closes.
Are your chats and uploads used to train AI models, and is that off by default?
They say they may use personal information to train AI models that power the service. The policy does not describe a way to turn that training off.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
They and partners use cookies for interest-based ads, and they disclose data to advertising platforms. They do not honor Do Not Track.
Do they sell or share your data, and can you opt out?
They say they do not sell data under U.S. state ad-sharing rules, but they share with affiliates, merchants, and others for marketing, and you can limit some of that in Data and Privacy settings.
What rights do they take over what you type and what the AI makes?
They do not claim they own your content, but you give them an irrevocable, transferable, worldwide license to use it to run and promote the service.
How long do they keep your data after you delete it, and can you delete it in the app?
You can request deletion or close the account, but they still keep relationship data for about 10 years after, and biometrics up to 3 years after close.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
They infer habits, preferences, and creditworthiness and remember payment and shopping preferences. The policy does not describe a full memory editor you can turn off.
Do they commit to basic security, and have they leaked data?
They describe firewalls, encryption, physical access controls, and staff access limits. They do not describe an independent audit in these documents.
Is there a real age gate, and are teens protected?
You must be 18 (or the age of majority) to open a U.S. account. They say the service is not for children under 18, with no extra age-check described.
Can you sue or join a class action if things go wrong?
Arbitration, but you can opt out within a window
Will they tell you when the rules change, and is the policy specific?
Both documents are dated. Privacy changes that need notice get 30 days on the Policy Updates page; personal-account terms changes that reduce rights get at least 21 days.
Can they close your account without warning, and can you get your data out first?
They can suspend or close the account in their discretion and say they will give notice and let you withdraw unrestricted funds. These documents do not describe a full data-export tool before closure.
If something goes wrong, who pays?
The service is offered as-is, their payout is limited to actual direct damages, and you must cover their legal costs if your use causes a third-party claim.
Do subscriptions renew on their own, and can you get a refund?
Not stated in the documents.
The privacy policy is 17,321 words at a college graduate level (Flesch reading ease 30.2); the terms are 27,637 words at a college level.
