PayPal

You are agreeing to a long-term data retention policy that keeps your details active in their systems for at least ten years after you leave.

“Personal Information used for the ongoing relationship between you and PayPal is stored for the duration of the relationship plus a period of 10 years or such period as mandated by any applicable local law once our relationship comes to an end”

What that means: Your data remains accessible to PayPal and its partners for ten years or more even after you have stopped using their service.

PayPal retains personal information for a fixed decade after account closure, plus any additional time required by laws like bankruptcy or anti-money laundering rules.

You are agreeing to provide biometric data, such as face scans and voice prints, to verify your identity for account access and transactions.

“Biometric data: Such as voice identification, photo identification, or face scans, which we may collect when you consent in the user experience to authenticate you for certain actions related to your account...”

What that means: You allow PayPal to store sensitive biological markers linked to your identity, which carries high security risks if breached.

The document explicitly lists the collection of facial scans, voice ID, and photo identification for authentication purposes like password recovery and crypto transfers.

You are agreeing to the broader scope of the PayPal corporate group, which includes separate brands like Venmo and Honey operating under their own rules.

“Excluded Services, including Venmo and PayPal Honey... Examples include Venmo, Honey Science LLC, Chargehound LLC, Paidy Inc., Swift Financial LLC, and Bill Me Later, Inc.”

What that means: Interacting with sister brands like Venmo or Honey may involve different privacy rules while still being part of the wider PayPal data network.

The document names multiple affiliated brands like Venmo and Honey that operate under separate terms but are listed as sources of data or excluded services within the broader corporate ecosystem.

You are agreeing to accept future changes to the privacy terms just by continuing to visit the site or use the service.

“If the revised version requires notice in accordance with applicable law, we will provide you with 30 days' prior notice by posting notice of the change... otherwise the revised Privacy Statement will be effective as of the published effective date.”

What that means: You may lose privacy protections or gain new data-sharing permissions without receiving a direct warning before the change takes effect.

The company can change the privacy terms at any time. While they offer thirty days' notice only when legally required, most changes become effective immediately upon publication on the website.

You are agreeing to share your personal information with third-party brokers and credit reporting agencies for risk and marketing purposes.

“We also disclose your Sensitive Personal Information as appropriate to carry out legitimate business activities... Please also see 'Sale' and 'Sharing' of Personal Information for additional information for individuals in the United States.”

What that means: Your personal habits and financial status can be shared with external brokers and credit agencies for business insights and debt collection.

While explicit selling is deferred to other sections, the statement confirms sharing with data brokers, CRAs, and partners for marketing and risk assessment, which constitutes a form of commercial data transfer.

You are agreeing to let PayPal ignore browser Do Not Track signals and continue collecting tracking data because they claim it is necessary for service function.

“Because many of our services won’t function without tracking data, we do not respond to DNT settings.”

What that means: Your standard browser privacy requests are ignored, forcing you to rely solely on PayPal's internal settings to manage cookies.

PayPal disables the browser's 'Do Not Track' signal entirely, stating that their services require tracking data to function properly.

You are agreeing that deleting your account will not remove all your data, as PayPal will retain copies for legal and security reasons.

“If you close your PayPal account(s) or profile, delete, or request that we delete Personal Information, we still need to keep some Personal Information... to comply with our promises... Detect and prevent malicious... activity; Comply with laws...”

What that means: Your data persists in backups and records long after you request deletion to satisfy legal and security requirements.

Deletion requests are heavily qualified by exceptions for fraud, legal obligations, and transaction history, meaning true data erasure is rarely complete.

You are agreeing to having your personal habits analyzed to create inferred profiles about your income, gender, and credit risk.

“Inferred data: Such as gender, income, browsing and purchasing habits, creditworthiness, fraud and risk assessment... which we may infer based on your transactions and interactions with our Services.”

What that means: PayPal creates a hidden profile of your financial health and personal habits that they use to make decisions about your service eligibility.

The company builds detailed profiles about users by inferring private traits like income and creditworthiness from their public behavior and transactions.