PayPal

You are agreeing to extensive data retention that keeps your information on file for up to 10 years or more after your relationship with PayPal ends.

“Personal Information used for the ongoing relationship between you and PayPal is stored for the duration of the relationship plus a period of 10 years or such period as mandated by any applicable local law once our relationship comes to an end, unless we need to keep it longer to the extent permitted by applicable law”

What that means: Your personal and financial history remains on file for over a decade even if you close your account.

PayPal keeps your data for at least 10 years after your account closes, and potentially longer for legal or risk management reasons. This creates a long tail of retention that exceeds typical user expectations for a payment service.

You are agreeing to let PayPal share your inferred shopping preferences and behaviors with third-party merchants to customize future offers.

“We may disclose Personal Information... to Partners and Merchants to enable their use of our Services to facilitate your transactions... Personal Information we disclose includes, for example, products, sizes, preferences, and styles we think you'll like.”

What that means: Merchants and partners see your specific shopping patterns and preferences, enabling targeted advertising and profiling beyond just processing your payment.

PayPal shares your inferred preferences, shopping habits, and product choices with merchants. This allows third parties to build detailed profiles of your interests based on your PayPal activity across various sites.

You are agreeing to the collection and storage of sensitive biometric data like face scans and voice prints for account authentication.

“Biometric data: Such as voice identification, photo identification, or face scans, which we may collect when you consent in the user experience to authenticate you for certain actions related to your account.”

What that means: Your unique biological features (face/voice) are stored and processed by PayPal for login and transaction verification.

The document explicitly lists face scans, photo identification, and voice identification as collected data types. These are sensitive biometric identifiers that carry higher privacy risks than standard passwords.

You are agreeing to let PayPal track your precise physical location via GPS whenever you log into your financial account.

“We collect precise geolocation data from Users while they are logged into their financial account. We may collect... Global Position System (GPS)... and IP-based geolocation data.”

What that means: Your precise physical movements and location are tracked whenever you access your financial account, creating a detailed map of your whereabouts.

PayPal collects precise GPS location data specifically when users are logged into financial accounts. This goes beyond general usage tracking to pinpoint exact physical locations.

You are agreeing to let PayPal share your personal information with partners and merchants for personalized shopping experiences unless you actively opt out in your settings.

“Unless we are required by law to obtain your consent, we disclose Personal Information collected from you after November 27, 2024... for personalized shopping experiences in the United States... To opt-out of disclosures of Personal Information to Partners and Merchants for personalized shopping experiences, log into your PayPal account and edit your preferences in the Data and Privacy setting.”

What that means: Your purchase history and preferences are shared with merchants who may use this information for marketing or sell it further, unless you manually opt out.

While technically labeled as 'disclosure,' sharing data for 'personalized shopping experiences' with partners and merchants fits the definition of selling or sharing data for commercial purposes. The default is opt-in/disclosure unless you actively change settings.

You are agreeing to allow PayPal to modify its privacy practices at any time, with limited or no prior notice depending on your location.

“We may revise this Privacy Statement from time to time... If the revised version requires notice in accordance with applicable law, we will provide you with 30 days' prior notice... otherwise the revised Privacy Statement will be effective as of the published effective date.”

What that means: You might not know your privacy rights have changed until you read the updated document, which could happen without direct notification.

The company can change its privacy terms unilaterally. While some jurisdictions get 30 days' notice, others receive no specific warning, and changes become effective immediately upon publishing.

You are agreeing that your ability to use certain PayPal features depends on allowing cookies, effectively forcing consent for tracking to access full service.

“Certain aspects and features of our Services and Sites are only available through the use of Cookies, so if you choose to disable or decline Cookies through your device or browser settings, your use of the Sites and Services may be limited or not possible.”

What that means: If you try to block tracking cookies, you might lose access to key parts of the PayPal app or website.

The document states that declining cookies may limit or prevent the use of services. This pressures users into accepting tracking technologies because essential functions reportedly require them.

You are agreeing to bear full responsibility for securing your passwords and for any privacy breaches occurring through third-party accounts you link to PayPal.

“While we are dedicated to securing our systems and Services, you are responsible for securing and maintaining the privacy of your password(s) and account or profile registration information... We are not responsible for protecting any Personal Information that we share with a third-party based on a linked account connection that you have authorized.”

What that means: If a linked account is compromised or you misuse your password, PayPal denies responsibility for the resulting loss of privacy or data exposure.

PayPal shifts the responsibility for security failures related to linked accounts and password protection entirely onto the user. They disclaim liability for data shared with third parties due to user-authorized links.