"Citi's privacy practices present a critical risk profile (78/100) comparable to Google/Microsoft-level data aggregation. The company collects extensive sensitive data including SSNs, financial credentials, biometric information, and protected characteristics; shares non-sensitive data with third-party advertisers under CCPA definitions without affirmative consent; deploys cross-device fingerprinting and behavioral tracking across third-party sites; and reserves the right to adjust service pricing based on perceived data value. Users face compounded risks from vague retention policies, device-specific opt-outs that fail to prevent ad retargeting, and policies that can change immediately upon posting."
citi Privacy Concerns & Scorecard
Policy changes can take effect immediately without requiring user consent; users accept by continued use
Collection of highly sensitive financial and government identifiers that could enable identity theft or account compromise
Sensitive financial credentials and account information shared with third-party aggregation service providers without clear security obligations
Cross-site behavioral tracking and retargeting using device fingerprinting and multiple tracking technologies without reliable opt-out
Vague retention policy lacks specific timeframes and no guarantee of data deletion after account closure
No recommended actions at this time.
Automate your privacy
Connect your accounts to TrueTerms to automate these privacy actions and monitor policy changes.
Data Collection & Tracking
Personal Information Collected
Account verification, identity confirmation, compliance with financial regulations (KYC/AML)
Account access, transaction processing, third-party aggregation services, fraud prevention
Credit decisions, financial profiling, risk assessment, targeted marketing for financial products
Location-based services, targeted marketing, fraud prevention
Account verification, identity confirmation, fraud prevention, customer service interactions
Regulatory compliance, demographic profiling, targeted marketing segmentation
Financial profiling, credit decisions, targeted marketing for products
Cross-device tracking, ad targeting, fraud prevention, personalization
Interest-based advertising, behavioral profiling, marketing campaign measurement, personalization
Targeted marketing, pricing decisions, service customization, ad targeting
Financial profiling, wealth assessment, targeted product marketing, account management
Compliance, fraud prevention, risk assessment, regulatory requirements
Account management, marketing communications, customer contact, service delivery
Account security, authentication, identity verification
Cross-Platform Tracking
Citi uses device fingerprinting to recognize and track you across multiple devices and associates your identity across devices for consistent ad delivery. The company tracks your online behavior across third-party websites and apps using cookies, web beacons, and pixel tags, and creates behavioral profiles and inferences about your interests based on your activity across different sites and services.
Tracking Methods:
Cookie (First-Party & Third-Party)
First-party cookies store login session and preferences; third-party cookies placed by advertisers track user behavior across Citi and third-party websites for interest-based advertising
Web Beacon & Pixel Tag
Invisible tracking pixels embedded in emails and web pages measure email open rates, ad interactions, and conversion tracking across owned and third-party properties
Log Files
Server-side logs capture IP address, device information, browser type, and access patterns to Citi services
Device Fingerprinting
Combination of device characteristics (OS, browser, plugins, screen resolution) creates a unique fingerprint to identify and track users across multiple devices for ad delivery and fraud detection
Account Login
User authentication provides deterministic identity linkage across sessions and devices for personalization and profiling
AI & Data Training
citi does not train AI on your content
Based on their public policy, your content is not used to train AI models.
How to Object
No opt-out available
This service does not currently provide a public way to opt out of AI training.
Why We Analyzed citi
TrueTerms automatically audits privacy policies and data practices using advanced machine learning to keep you informed and protected. This scorecard is based on the latest available public terms of service and privacy policies as of 2026.