Cash App Privacy Notice Review 2026 | Privacy Score 30/100 (Grade D)

📄 Notice Information

Privacy Notice URL cash.app/legal/us/en-us/privacy

Effective Date (as shown) June 8, 2026

Parent Company Block, Inc. (formerly Square)

Advertising language Commerce media, effective on or after Feb 9, 2026

⚠ Data Sensitivity: Tier 2 (Highly Sensitive)

A payment app processes financial data, transaction history, bank account information, and government identity data, and the published Privacy Notice also lists a biometric and facial-scan category. This data profile warrants heightened attention under the methodology. Automated assessment, as of June 28, 2026.

Privacy Score Breakdown

How Cash App's published Privacy Notice rates across the methodology's data-rights categories. Automated assessment, as of June 28, 2026.

📊 Data Collection Scope 25/100

The notice lists identity, financial, transaction, device and location, biometric, customer-support, and third-party-source categories. Broad and sensitive by nature for a financial app.

🧬 Sensitive & Biometric Data 25/100

The notice lists a biometric category: photographs, facial scan, and biometric information extracted from such images for verification purposes. Biometric data is among the most sensitive categories.

🎯 Sharing & Advertising 28/100

Commerce-media language, effective on or after February 9, 2026, contemplates using and sharing activity data in connection with the commerce media network. Confirm opt-out scope in the current notice.

⚙ User Control & Retention 35/100

State privacy laws (for example the CCPA) give residents access, deletion, and opt-out rights. A financial app may be required to retain certain records for legal and AML reasons, so total erasure is not always available.

👁 Transparency 45/100

The notice is published and itemizes categories and a dated advertising change, which is reasonably specific. The opacity is on the downstream use and the exact opt-out scope.

Compare With Other Processors

⚖ What the notice says vs the risk read

Two different things, kept separate on purpose. The left box is what Cash App's published Privacy Notice says, quoted verbatim with a category reference and the effective date. The right box is the Terms.Law opinion about what that means for a user. The quote carries the weight; the opinion is clearly labeled as opinion.

📜 What the notice says

Cash App Privacy Notice, verbatim (Effective June 8, 2026)

Biometric and facial-scan data.
“Photographs, facial scan and biometric information extracted from such images for verification purposes.”Cash App Privacy Notice, Categories of personal information collected (Effective June 8, 2026)
Identity data.
“Your name, email address, zip or postal code, phone number, Cashtag, signature, and authentication ...”Cash App Privacy Notice, Categories of personal information collected
Financial and transaction data.
“Bank account and payment card numbers you add to your Cash App account, as well as your Cash App Card ...” and “When and where the transactions occur, the names of the transacting parties, a description of the transactions ...”Cash App Privacy Notice, Categories of personal information collected
Customer-support recordings.
“Information (including call recordings and transcripts) provided to our customer support ...”Cash App Privacy Notice, Categories of personal information collected
Commerce media: use and share activity data (Feb 9, 2026).
“Starting on or after February 9, 2026: In connection with our commerce media network, we may use data about your activity ...” and “Starting on or after February 9, 2026: In connection with our commerce media network, we may share your information such as ...”Cash App Privacy Notice, Commerce media / personalized advertising

🧾 The Terms.Law risk read

Opinion, not a statement of fact

The biometric and facial-scan category is the point I would flag first. Biometric data is among the most sensitive categories, because, unlike a password, you cannot change your face, and several states regulate it specifically. The stated purpose is verification; the user-side concern is retention and deletion.
The data profile overall is broad and sensitive by nature for a financial app: identity, financial, transaction, device and location, biometric, and customer-support data. That is expected for a money app, but it raises the stakes of any breach or misuse.
The commerce-media language, effective on or after February 9, 2026, is, as I read it, an expansion of how activity data can be used and shared for advertising. Whether you can limit that depends on the current notice text and your state privacy rights.
If you are a California resident under the CCPA, or an EU or UK resident under the GDPR, you generally have access, deletion, and opt-out rights, including for biometric data, though a financial app may lawfully retain some records for AML and legal reasons.
The strongest practical step is a clear, dated written data access and deletion request that asks for confirmation of what is kept; that creates a record and a response deadline, unlike an in-app tap alone.

⚖

This column is opinion under a published methodology, calibrated to the quoted notice text. It is not a prediction about any specific account and not a finding of wrongdoing.

⚠ What I Check First

Automated assessment, as of June 28, 2026. Each card is an opinion drawn from Cash App's published Privacy Notice, with the operative text quoted. The quote carries the weight. Verify the current sources before relying on this. None of this is a finding that Cash App acted unlawfully in any specific case.

Biometric and facial-scan data category

High Sensitivity

The notice lists a biometric category for verification: photographs, facial scan, and biometric information extracted from those images. Biometric data is among the most sensitive categories because you cannot change your face, and several states regulate it specifically.

“Photographs, facial scan and biometric information extracted from such images for verification purposes.” Cash App Privacy Notice, Categories of personal information (Effective June 8, 2026) · cash.app/legal/privacy

Commerce-media advertising on activity data (Feb 9, 2026)

High Risk

The notice contains language that, starting on or after February 9, 2026, lets the company use and share information in connection with its commerce media network. As I read it, this is an advertising network built on user activity data; confirm the opt-out scope in the current notice.

“Starting on or after February 9, 2026: In connection with our commerce media network, we may use data about your activity ...” and “... we may share your information such as ...” Cash App Privacy Notice, Commerce media / personalized advertising · cash.app/legal/privacy

Broad financial and transaction data

High Risk

The notice lists bank account and payment card numbers, the Cash App Card, and transaction detail including when and where transactions occur, the names of the transacting parties, and a description of the transactions. Sensitive by nature for a money app.

“Bank account and payment card numbers you add to your Cash App account, as well as your Cash App Card ...” and “When and where the transactions occur, the names of the transacting parties, a description of the transactions ...” Cash App Privacy Notice, Categories of personal information · cash.app/legal/privacy

Customer-support call recordings and transcripts

Read Closely

The notice lists information provided to customer support, including call recordings and transcripts. Worth knowing if you discuss sensitive matters with support.

“Information (including call recordings and transcripts) provided to our customer support ...” Cash App Privacy Notice, Categories of personal information · cash.app/legal/privacy

Device and location data

Medium Risk

The notice lists device location data including IP address and the location of your network provider. Standard for an app, but it adds to the overall profile alongside the financial and biometric data.

“The location of your device, including your IP address and location of your network provider ...” Cash App Privacy Notice, Categories of personal information · cash.app/legal/privacy

Third-party-source data

Medium Risk

The notice lists information from third-party verification services, including identity-verification agencies and app stores. Data about you can flow in from outside the app, not only from your own entries.

“Information from third-party verification services (e.g., identity verification agencies, app stores, and companies which provide ...).” Cash App Privacy Notice, Categories of personal information · cash.app/legal/privacy

⚖ Regulatory context (separate from the privacy score)

This box is NOT part of the Privacy Notice score above. It summarizes official enforcement actions against Block, Inc. / Cash App from January 2025, attributed to the official source, and presents the company's response alongside. These actions concern Cash App specifically; the other processors reviewed on this site are not the subject of these particular actions. This is factual reporting of official findings and a sourced company statement, not an independent finding by Terms.Law.

CFPB consent order, January 16, 2025

$175M total $120M consumer redress $55M civil penalty

The Consumer Financial Protection Bureau ordered the operator of Cash App to pay $175 million: up to $120 million in refunds and other redress to consumers and a $55 million civil penalty into the CFPB's victims relief fund. The CFPB found violations of the Consumer Financial Protection Act and the Electronic Fund Transfer Act, and the order requires Block to establish 24-hour live-person customer service and to fully investigate unauthorized transactions and provide timely refunds where appropriate.

“[Block's fraud-dispute] investigations were woefully incomplete,” and the company “directed users, who had suffered financial losses as a result of fraud, to ask their bank to attempt to reverse transactions, which Block would subsequently deny.” (CFPB)

Source: CFPB press release and the enforcement-action page (January 16, 2025).

State-regulator multistate settlement (BSA/AML), January 2025

$80M penalty 48 state regulators

Coordinated by the Conference of State Bank Supervisors, 48 state financial regulators announced that Block agreed to pay an $80 million penalty over Bank Secrecy Act and anti-money-laundering compliance gaps. Block agreed to hire an independent consultant to review its BSA/AML program and report to the states, with time to correct any deficiencies found.

The finding concerned BSA/AML compliance gaps, “creating the potential that its services could be used to support money laundering, terrorism financing, or other illegal activities.” (CSBS)

Source: Conference of State Bank Supervisors (January 2025). The CFPB ($175M) and CSBS ($80M) actions together were reported at roughly $255 million combined.

💬 Company response (Block, as reported)

Block neither admitted nor denied wrongdoing as part of the settlements. As reported by trade press, the company stated:

“While we strongly disagree with the CFPB's mischaracterizations, we made the decision to settle this matter in the interest of putting it behind us and focusing on what's best for our customers and our business.” And: “As Cash App has grown, we've significantly increased our investment in compliance and risk management, while serving millions of customers with critical, affordable financial services.” (Block, as reported)

Source (company statement, as reported): Banking Dive. Reported via reputable trade press quoting Block, not lifted from a primary Block filing.

ℹ

Why this is separate: the score above measures the published Privacy Notice. This module reports what regulators officially found and what the company said in response. Keeping them apart protects accuracy and fairness: every adverse statement here is a regulator's official finding or a sourced company quote. The January 2025 actions concerned fraud-dispute handling and BSA/AML compliance, not the data categories scored above.

🔎 Go Deeper

The practical detail behind the score: what biometric data means for you, how to delete your data and get proof, how state privacy rights apply, and how Cash App compares to Square and Stripe. Each block is collapsed; open what is relevant to you.

🧬 Why the biometric and facial-scan category matters

The published Privacy Notice lists a biometric category described as photographs, facial scan, and biometric information extracted from such images for verification purposes. A few reasons this is the first thing I look at on a payment app:

Biometric data is effectively permanent. Unlike a password or a card number, you cannot reset your face if the data is breached or misused.
Several states regulate biometric data specifically, with notice, consent, and retention requirements, and some create private rights of action.
The stated purpose here is identity verification, which is a legitimate anti-fraud use, but the user-side questions are how long the data is retained and whether it can be deleted on request.

ℹ

This is opinion about why the category warrants attention, not a claim that Cash App mishandles biometric data. As I read the notice, the stated use is verification; confirm the current retention and deletion language against the live notice.

📥 How to delete your data and get written proof

Send a dated written request. Identify your account, cite the applicable statute, and ask for access, deletion, and written confirmation of what categories are retained, including any biometric or facial-scan data.
Use the in-app privacy controls too. Use any in-app deletion and advertising opt-out, but keep the written request as your record.
Expect lawful retention carve-outs. A financial app may be permitted or required to retain certain records for legal and AML reasons, so total erasure is not always available; ask them to identify what is retained and why.
Follow up in writing if they miss the deadline. A documented follow-up preserves your rights and creates leverage.

⚠

Scope note. Terms.Law can help draft a CCPA or GDPR data access and deletion request and a follow-up. This is general information, not legal advice, and it does not create an attorney-client relationship.

🎯 The commerce-media advertising language, in plain English

The notice contains language that, starting on or after February 9, 2026, in connection with its commerce media network, the company may use data about your activity and may share your information. In plain English, a commerce media network is an advertising business that uses what it knows about your activity to target ads, sometimes on the company's own surfaces and sometimes with partners. As I read the notice, this contemplates advertising use of activity data. Whether and how you can opt out depends on the current notice text and your state: the CCPA gives California residents rights to opt out of certain sharing and targeted advertising. Confirm the exact opt-out scope and mechanism in the live notice and the in-app privacy settings.

⚖

This is a general read of how the advertising language is worded, not a finding about how the data is actually used. Confirm against the company's current notice.

📊 Cash App vs Square vs Stripe on data and privacy

Cash App and Square are both Block, Inc. products but aimed at different users; Stripe is a separate company. On the privacy dimension, the documents differ in who they cover and what they emphasize. The reading below is an automated read of each company's published documents; confirm the current wording before relying on any row.

Dimension	Cash App	Square	Stripe
Who it is for	Consumer / P2P money + bitcoin	Merchant payments	Merchant / developer payments
Biometric data	Yes, facial-scan category for verification	Confirm in the Square notice	Confirm in the Stripe notice
Advertising use of data	Commerce-media language, on or after Feb 9, 2026	Per the Square notice	Per the Stripe notice
State-law rights	CCPA / GDPR access, deletion, opt-out apply	Same statutory rights apply	Same statutory rights apply

See the Square Privacy review, the Stripe Privacy review, and the Cash App Terms of Service review.

Frequently Asked Questions

Practical privacy and data questions, answered against Cash App's published Privacy Notice as of June 28, 2026. Each answer is an opinion drawn from the published notice; the quoted text carries the weight. This is general legal information, not legal advice, and not a finding that Cash App acted unlawfully in any specific case. Verify the current sources before relying on this.

⚖

Neutral framing on purpose. The notice lists broad and sensitive data categories and an advertising use of activity data. Describing what the notice states is not the same as saying the data is misused. Automated assessment, as of June 28, 2026; verify the current sources.

What changed in the June 8, 2026 Privacy Notice?

The Privacy Notice shown as Effective June 8, 2026 lists categories of personal information that include a biometric and facial-scan category, alongside identity, financial, transaction, device and location, customer-support, and third-party-source categories. It also carries commerce-media and personalized-advertising language effective on or after February 9, 2026. The biometric category and the advertising language are the two points I would flag first. This describes what the notice states, not a finding of wrongdoing. Automated methodology assessment, opinion based on the published notice as of 2026-06-28; verify the current sources.

“Photographs, facial scan and biometric information extracted from such images for verification purposes.”Cash App Privacy Notice, Categories of personal information (Effective June 8, 2026) · cash.app/legal/privacy

What is the February 9, 2026 commerce-media personalized-ads language?

The notice states that, starting on or after February 9, 2026, in connection with its commerce media network the company may use data about your activity and may share your information. In plain terms this describes an advertising network built on user activity data. Whether and how you can opt out depends on the current notice text and your state; the CCPA gives California residents rights to opt out of certain sharing and targeted advertising. Confirm the exact opt-out scope in the live notice. This is general information about how the notice reads, not a finding of wrongdoing. Automated methodology assessment, opinion based on the published notice as of 2026-06-28; verify the current sources.

“Starting on or after February 9, 2026: In connection with our commerce media network, we may use data about your activity ...”Cash App Privacy Notice, Commerce media / personalized advertising (Effective June 8, 2026) · cash.app/legal/privacy

Does Cash App collect biometric or facial-scan data?

Under the published Privacy Notice, the categories collected include a biometric category described as photographs, facial scan, and biometric information extracted from such images for verification purposes. Biometric data is among the most sensitive categories because you cannot change your face, and several states regulate it specifically. As I read the notice, the stated purpose is verification; the user-side concern is retention and deletion. This describes what the notice states, not a finding of wrongdoing. Automated methodology assessment, opinion based on the published notice as of 2026-06-28; verify the current sources.

“Photographs, facial scan and biometric information extracted from such images for verification purposes.”Cash App Privacy Notice, Categories of personal information (Effective June 8, 2026) · cash.app/legal/privacy

What personal data does Cash App collect?

The notice lists identity data (name, email, zip or postal code, phone number, Cashtag, signature, authentication), financial data (bank account and payment card numbers, the Cash App Card), transaction data, device and location data, a biometric and facial-scan category, customer-support data (including call recordings and transcripts), and information from third-party sources such as identity-verification agencies and app stores. Broad and sensitive by nature for a money app. Automated methodology assessment, opinion based on the published notice as of 2026-06-28; verify the current sources.

“When and where the transactions occur, the names of the transacting parties, a description of the transactions ...”Cash App Privacy Notice, Categories of personal information (Effective June 8, 2026) · cash.app/legal/privacy

Can Cash App share my data for advertising, and can I opt out?

The notice contains commerce-media and personalized-advertising language that, starting on or after February 9, 2026, lets the company use and share information in connection with its commerce media network. The exact opt-out scope and mechanism should be confirmed in the current notice and in-app settings, because state privacy laws such as the CCPA give residents rights to opt out of certain sharing and targeted advertising and to request deletion. As I read the notice, advertising use of activity data is contemplated. This is general information, not legal advice about your situation. Automated methodology assessment, opinion based on the published notice as of 2026-06-28; verify the current sources.

“Starting on or after February 9, 2026: In connection with our commerce media network, we may use data about your activity ...”Cash App Privacy Notice, Commerce media / personalized advertising (Effective June 8, 2026) · cash.app/legal/privacy

How do I delete my Cash App data and get proof?

If you are a California resident under the CCPA, or an EU or UK resident under the GDPR, you generally have the right to request access to and deletion of your personal data and written confirmation of what is still held, including any biometric or facial-scan data. A clear, dated written request that identifies your account, cites the statute, and asks for confirmation of deletion and of any retained categories tends to work better than an in-app tap alone, because it creates a record and a response deadline. A financial app may lawfully retain some records for AML and legal reasons, so ask them to identify what is retained and why. Terms.Law can help draft the request. This is general information, not legal advice. Automated methodology assessment, opinion based on the published notice as of 2026-06-28; verify the current sources.

“Photographs, facial scan and biometric information extracted from such images for verification purposes.”Cash App Privacy Notice, Categories of personal information (Effective June 8, 2026) · cash.app/legal/privacy

Why did Cash App close or restrict my account?

This is a Terms-of-Service question rather than a Privacy Notice question; the companion Cash App Terms of Service review covers it in detail. In short, the Terms give the company broad discretion to suspend, freeze, decline, or reverse a transaction and to close an account, including for suspected fraud or illegal activity, in response to legal process, or if it believes a transaction is erroneous, and to require you to link a new bank account to receive a held balance on closure. On the privacy side, an information or verification gap, including a failed biometric or identity check, can be part of why an account is restricted. Automated methodology assessment, opinion based on the published terms as of 2026-06-28; verify the current sources.

“We may suspend, refuse, freeze, decline, delay, redirect or reverse any transaction request ... for any reason, even after funds or Virtual Currency has been credited to your Virtual Currency Account ...”Cash App Terms of Service, Suspension, Termination, Reversal of Transactions · cash.app/legal

How is Square different from Cash App on privacy?

Cash App and Square are both Block, Inc. products but aimed at different users and governed by different published documents. Cash App is a consumer money and bitcoin app whose Privacy Notice covers consumer identity, financial, transaction, device, biometric, and advertising data. Square is a merchant payments platform whose documents focus on business and payment data and on reserves and payouts on the contract side. If your concern is a consumer Cash App balance, bitcoin, or biometric data, the Cash App documents control; if it is a Square merchant account, the Square documents control. Automated methodology assessment, opinion based on the published documents as of 2026-06-28; verify the current sources.

“Photographs, facial scan and biometric information extracted from such images for verification purposes.”Cash App Privacy Notice, Categories of personal information (Effective June 8, 2026) · cash.app/legal/privacy

Is Cash App safe to use with sensitive financial or biometric information?

As a data-sensitivity matter, a payment app processes financial data, transaction history, bank account information, government identity data, and, per the published notice, a biometric and facial-scan category, which together is a high-sensitivity profile. The notice also describes commerce-media advertising use of activity data effective on or after February 9, 2026. Whether that is acceptable for you depends on your risk tolerance and your state privacy rights. In my opinion, a user holding meaningful balances should understand the biometric category, the advertising language, and the deletion and opt-out rights available in their state. This is general information about how the notice reads, not legal advice or a finding of wrongdoing. Automated methodology assessment, opinion based on the published notice as of 2026-06-28; verify the current sources.

“Bank account and payment card numbers you add to your Cash App account, as well as your Cash App Card ...”Cash App Privacy Notice, Categories of personal information (Effective June 8, 2026) · cash.app/legal/privacy

⚖

Want your Cash App data deleted, or were your funds restricted? For a data deletion request, you can start one here. If Cash App or Square restricted your funds, upload screenshots and transaction history for attorney review. This is an automated assessment, not legal advice. Terms.Law can help draft a CCPA or GDPR data request, and represents merchants in fund-hold disputes.

Cash App Privacy Policy Review

📄 Notice Information

⚠ Data Sensitivity: Tier 2 (Highly Sensitive)

Privacy Score Breakdown

Compare With Other Processors

🐕 Concerned about your data?

⚖ What the notice says vs the risk read

📜 What the notice says

🧾 The Terms.Law risk read

⚠ What I Check First

Biometric and facial-scan data category

Commerce-media advertising on activity data (Feb 9, 2026)

Broad financial and transaction data

Customer-support call recordings and transcripts

Device and location data

Third-party-source data

⚖ Regulatory context (separate from the privacy score)

CFPB consent order, January 16, 2025

State-regulator multistate settlement (BSA/AML), January 2025

💬 Company response (Block, as reported)

🔎 Go Deeper

Frequently Asked Questions

The Bottom Line

What Cash App's Published Documents Say

Data categories and biometric data

Account, freeze, and closure powers

January 2025 CFPB and state-regulator actions

Delete your data, or recover restricted funds

Cash App Privacy Policy Review

📄 Notice Information

⚠ Data Sensitivity: Tier 2 (Highly Sensitive)

Privacy Score Breakdown

Compare With Other Processors

🐕 Concerned about your data?

Related Resources

⚖ What the notice says vs the risk read

📜 What the notice says

🧾 The Terms.Law risk read

⚠ What I Check First

Biometric and facial-scan data category

Commerce-media advertising on activity data (Feb 9, 2026)

Broad financial and transaction data

Customer-support call recordings and transcripts

Device and location data

Third-party-source data

⚖ Regulatory context (separate from the privacy score)

CFPB consent order, January 16, 2025

State-regulator multistate settlement (BSA/AML), January 2025

💬 Company response (Block, as reported)

🔎 Go Deeper

Frequently Asked Questions

The Bottom Line

What Cash App's Published Documents Say

Data categories and biometric data

Account, freeze, and closure powers

January 2025 CFPB and state-regulator actions

Delete your data, or recover restricted funds

Related Resources