"Coinbase presents a high-risk privacy profile (score: 72/100) comparable to major ad-tech platforms. The service collects extensive sensitive data including biometrics, financial details, and government IDs, then shares this information broadly with law enforcement, regulators, advertisers (Meta, AppLovin), and other VASPs. Coinbase uses cross-site behavioral tracking, indefinite data retention for vague 'security' purposes, and imposes non-absolute user rights limitations, while relying on legitimate interest rather than explicit consent for marketing activities."
coinbase Privacy Concerns & Scorecard
Coinbase collects an exceptionally broad range of sensitive and identifying data including biometric information (selfies, photographs, videos), government-issued identity documents, financial account details (bank account numbers, payment card information), tax identification numbers, social security numbers, employment information, and blockchain transaction data. The policy explicitly states data is collected from users under 18 who are discouraged but not technically prevented from using services.
Coinbase shares sensitive financial and identity data with an extensive ecosystem of third parties including law enforcement, government regulators (SEC, CFTC, FCA, CySEC, ASIC), tax authorities, and advertising platforms (Meta, AppLovin) with minimal specificity on consent or limiting conditions. Travel Rule requires sharing counterparty information in cryptocurrency transfers with other Virtual Asset Service Providers.
Coinbase receives information from marketing and advertising partners about where users view marketing content and what actions users take on and off Coinbase sites and apps. This enables cross-site behavioral tracking and retargeting. Users see targeted ads for Coinbase services on other apps and websites.
User rights to data deletion, access, and correction are explicitly limited and not absolute. Coinbase can deny requests if compliance would 'adversely affect rights of others' or if requests are deemed frivolous. Identity verification is required before honoring privacy requests with potential to decline requests if identity cannot be verified.
Biometric information is retained for 'regulatory compliance period' with no specific duration defined. Deletion requests may be denied, and data deletion upon account closure is not guaranteed as data may be retained for legal/regulatory obligations.
No recommended actions at this time.
Automate your privacy
Connect your accounts to TrueTerms to automate these privacy actions and monitor policy changes.
Data Collection & Tracking
Personal Information Collected
Account creation, identity verification, regulatory compliance (KYC/AML), and fraud detection
Payment processing, transaction settlement, tax reporting, and regulatory compliance with financial authorities
Service delivery, compliance with Travel Rule requirements, fraud prevention, and regulatory reporting
Regulatory compliance, fraud detection, service localization, and sanctions list screening
Fraud detection, security, service optimization, and analytics
Service improvement, product development, personalization, and analytics
Customer support, service improvement, quality assurance, and dispute resolution
Regulatory compliance, sanctions screening, identity verification, and fraud prevention
Marketing and customer acquisition
Account verification, regulatory compliance, and institutional customer management
Cross-Platform Tracking
Coinbase receives information from marketing and advertising partners about where you view marketing content and what actions you take on and off Coinbase sites and apps. Conversion data including your IP address is shared with Meta and AppLovin, who match this information with their own user databases to create custom audience lists and target you with Coinbase ads on other platforms. This enables cross-site behavioral tracking and retargeting of Coinbase services across the web and mobile apps.
Tracking Methods:
Cookies and Tracking Pixels
First-party and third-party cookies placed on websites to track user behavior, preferences, and interactions. Third-party tracking pixels from Meta and AppLovin placed on Coinbase properties to enable audience matching and conversion tracking
Device Fingerprinting
Collection of device characteristics (browser version, operating system, IP address, screen resolution) to create a unique identifier for fraud detection and cross-device tracking
Analytics Providers
Third-party analytics services track user interactions, feature usage, crash data, and engagement metrics across Coinbase apps and websites
Conversion Tracking
IP address and conversion data shared with Meta and AppLovin to create custom audience lists and measure advertising effectiveness across platforms
App-Based Behavioral Tracking
In-app tracking of user interactions, preferences, feature usage, and navigation patterns within Coinbase mobile and web applications
AI & Data Training
coinbase does not train AI on your content
Based on their public policy, your content is not used to train AI models.
How to Object
No opt-out available
This service does not currently provide a public way to opt out of AI training.
Why We Analyzed coinbase
TrueTerms automatically audits privacy policies and data practices using advanced machine learning to keep you informed and protected. This scorecard is based on the latest available public terms of service and privacy policies as of 2026.