Kraken Privacy Policy Review

Under the published Watchdog methodology this policy scores 30/100 (Grade D). The policy appears to permit broad sharing within the Kraken group and with selected third parties, and it permits extended retention of compliance records after you leave, which is what pulls the score down. On the other side, it grants standard GDPR-style rights (access, erasure, portability) and, in its biometrics policy, states it does not sell biometric data. Automated methodology assessment, opinion based on the published policy as of 2026-06-27; verify the current policy.

“Kraken may share your personal data within the Kraken company group and with carefully selected third parties.”Global Privacy Notice, Section 7: Disclosure of your personal data (last updated June 17, 2026) · kraken.com/legal/privacy

The policy describes sharing rather than selling. The Global Privacy Notice states personal data may be shared within the Kraken group and with selected third parties, with operational categories that expressly include artificial intelligence, and that the third-party AI providers do not use your conversations or profile data to train their own models. For U.S. users, the separate U.S. Privacy Notice acknowledges sharing identifiers with analytics providers, advertising partners, and ad networks for analytics and advertising, while stating Kraken does not sell your personal information. The separate Biometrics Policy adds that Kraken does not sell, lease, trade, or otherwise profit from biometric data. The practical caution is that sharing for analytics and advertising still happens; whether any of it is a sale under California law is a legal question the notice does not resolve. Automated methodology assessment, opinion based on the published policy as of 2026-06-27; verify the current policy.

“These providers act only on our instructions and do not use your conversations or profile data for their own purposes, including to train their own artificial intelligence models.”Global Privacy Notice, Section 7: Disclosure of your personal data (last updated June 17, 2026) · kraken.com/legal/privacy

“In the past 12 months, we may have shared identifiers with third party analytics providers, advertising partners, and ad networks for analytics and advertising purposes. For referral programme administration, including commission calculation and payment, we may have shared limited pseudonymised referral performance information with referrers. Kraken does not sell your personal information.”U.S. Privacy Notice (analytics/advertising and no-sale, last updated June 17, 2026) · kraken.com/legal/privacy/us-notice

“Kraken does not sell, lease, trade, or otherwise profit from Biometric Data.”Biometrics Policy: Biometric Data Disclosures (last updated February 3, 2026) · kraken.com/legal/biometrics-policy

The policy appears to permit keeping certain data well after the relationship ends. It states anti-money-laundering laws may require Kraken to retain client due-diligence records and transaction records for a period such as five years after the business relationship ends, and that data may be kept even longer where it cannot be deleted for legal, regulatory, or technical reasons. In practical terms, closing or losing your account does not appear to trigger immediate deletion of compliance-related records. Automated methodology assessment, opinion based on the published policy as of 2026-06-27; verify the current policy.

“Additionally, we are subject to certain anti-money laundering laws which may require us to retain the following for a period (e.g., 5 years) after our business relationship with you has ended: A copy of the records we used in order to comply with our client due diligence obligations; Supporting evidence and records of transactions with you, and your relationship with us.”Global Privacy Notice, Section 11: Data retention (last updated June 17, 2026) · kraken.com/legal/privacy

The policy states you can ask Kraken to delete, remove, block, or anonymise your personal data in certain circumstances, with requests submitted through its contact form, but that erasure is subject to the retention limits Kraken is required to comply with. On proof of erasure, the policy text does not state a specific written confirmation mechanism, and it notes on-chain attestations cannot be modified or deleted once published. A formal CCPA or GDPR access and erasure request, in writing, is the practical way to force a documented response about what is deleted and what is retained. Automated methodology assessment, opinion based on the published policy as of 2026-06-27; verify the current policy.

“You can ask us to delete, remove, block or anonymise your personal data in certain circumstances. Such requests may be subject to any retention limits we are required to comply with in accordance with applicable laws and regulations.”Global Privacy Notice, Section 13: Your rights regarding your personal data (Erasure, last updated June 17, 2026) · kraken.com/legal/privacy

Using Kraken inherently involves handing over sensitive identity and financial data: the policy states it collects verification documents that may be processed using technologies that extract biometric data, plus bank, card, and source-of-funds information. The mitigating language is that the biometrics policy commits to destroying biometric data when its purpose is satisfied or within three years of your last interaction, whichever is first, and states biometric data is not sold. Whether that is acceptable is a personal risk decision; the data is collected and shared with vendors to provide the service. Automated methodology assessment, opinion based on the published policy as of 2026-06-27; verify the current policy.

“Verification information, which includes information necessary to verify your identity such as a passport, driver's licence, selfie photos / videos, login credentials or Government-issued identity card, which may be processed using technologies that extract biometric data.”Global Privacy Notice, Section 5: Information we may collect about you (last updated June 17, 2026) · kraken.com/legal/privacy

Yes. The policy states it is reviewed regularly and that any personal data Kraken processes will be governed by the most recent version of the privacy notice, with the Last updated date changed accordingly. It commits to announcing material changes on its website but places the burden on you to review the notice from time to time, so there is no guarantee of individual advance notice for every change. Automated methodology assessment, opinion based on the published policy as of 2026-06-27; verify the current policy.

“Our privacy notice is reviewed regularly in light of new regulations, technologies, and any changes to our business operations. Any personal data we process will be governed by our most recent privacy notice. We will update the 'Last updated' date accordingly at the beginning of this privacy notice. Please review this privacy notice from time to time. We will announce any material changes to this privacy notice on our website.”Global Privacy Notice, Section 14: Changes to this privacy notice (last updated June 17, 2026) · kraken.com/legal/privacy

As a financial-services provider, Kraken frames part of the U.S. notice around the federal Gramm-Leach-Bliley Act (GLBA). The notice states federal law both requires disclosure of its data practices and gives consumers a limited right to restrict sharing. Read it closely: the right to limit is described as covering “some but not all disclosures.”

“Federal law gives consumers the right to limit some but not all disclosures. Federal law also requires us to tell you how we collect, disclose, and protect your personal information.”Kraken U.S. Privacy Notice (GLBA), last updated June 17, 2026 · kraken.com/legal/privacy/us-notice

California residents are pointed to a further, separate notice. The U.S. Privacy Notice states that California residents should consult a dedicated California Consumer Privacy Notice for additional information, meaning the CCPA/CPRA-specific terms live in yet another document, not in the global or U.S. notice alone.

“If you are a resident of California, please see our California Consumer Privacy Notice for additional relevant information.”Kraken U.S. Privacy Notice (California), last updated June 17, 2026 · kraken.com/legal/privacy/us-notice

The U.S. notice expressly identifies categories of “sensitive personal information” it has collected and disclosed in the prior 12 months, and separately states it limits use of that category to specified purposes. For U.S. users this is more granular than the global notice: it names government identifiers, message contents, biometric data, and account credentials.

“In the past 12 months, we've collected and disclosed the following categories of sensitive personal information, with the following categories of third parties: Government identifiers, The contents of a resident's mail, email, and text messages, Biometric Data, Account log-in or other credentials allowing access to an account.”Kraken U.S. Privacy Notice (sensitive personal information), last updated June 17, 2026 · kraken.com/legal/privacy/us-notice

“Kraken does not collect, use, or disclose sensitive personal information for purposes other than those specified in this Notice, to provide the Services, or as permitted under applicable law.”Kraken U.S. Privacy Notice (sensitive personal information), last updated June 17, 2026 · kraken.com/legal/privacy/us-notice

For U.S. users, the notice frames biometric collection as something you consent to in writing by using the service. The U.S. notice itself does not repeat the “does not sell” commitment; that no-sale assurance appears in Kraken's separate Biometrics Policy (last updated February 3, 2026), which is quoted in the FAQ above. Treat the no-sale language as living in the Biometrics Policy, not the U.S. notice.

“By using Kraken's services, accepting our privacy notice, and/or accepting our terms of service, you give your written consent to the collection, processing, usage, and storage of your Biometric Data.”Kraken U.S. Privacy Notice (biometric data), last updated June 17, 2026 · kraken.com/legal/privacy/us-notice

“Kraken does not sell, lease, trade, or otherwise profit from Biometric Data.”Kraken Biometrics Policy, last updated February 3, 2026 · kraken.com/legal/biometrics-policy

The U.S. notice states identity verification is carried out partly through outside service providers, grouped with artificial-intelligence services. In practical terms, your verification data is processed not only by Kraken but by selected vendors it engages for that purpose.

“We share personal data with service providers...including...identity verification and artificial intelligence services.”Kraken U.S. Privacy Notice (service providers), last updated June 17, 2026 · kraken.com/legal/privacy/us-notice

This is the framing U.S. users should read carefully. The notice acknowledges sharing identifiers with analytics providers, advertising partners, and ad networks for analytics and advertising purposes, and in the same breath states it does not sell personal information. Whether a given act of sharing is a “sale” under California law is a legal question the notice does not resolve for you, so the no-sale statement and the analytics/advertising sharing statement should be read together, not in isolation.

“In the past 12 months, we may have shared identifiers with third party analytics providers, advertising partners, and ad networks for analytics and advertising purposes. For referral programme administration, including commission calculation and payment, we may have shared limited pseudonymised referral performance information with referrers. Kraken does not sell your personal information.”Kraken U.S. Privacy Notice (analytics/advertising and no-sale), last updated June 17, 2026 · kraken.com/legal/privacy/us-notice