"LastPass presents a moderate-to-high privacy risk (score: 58/100) driven primarily by extensive collection of sensitive vault data, third-party sharing with advertising networks for behavioral targeting, and use of third-party cookies that may constitute data sales under state privacy laws. While the zero-knowledge encryption model mitigates some risks to vault confidentiality, LastPass retains the right to continue processing personal data based on 'compelling legitimate grounds' even after user objection, and account deletion does not guarantee complete data removal across all systems."
lastpass Privacy Concerns & Scorecard
LastPass reserves the right to continue processing data if it determines 'compelling legitimate grounds' override user interests, even after user objection. When processing customer data, user requests may be redirected to the customer rather than honored directly.
LastPass automatically collects device identifiers, IP addresses, operating system information, usage data, session data, and call/chat recordings without granular user consent mechanisms explicitly documented.
LastPass shares data with dark web monitoring services, breach monitoring third parties, fraud detection services, and unspecified 'service providers' without limiting to necessary service functions.
LastPass uses third-party cookies and tracking technologies for behavioral profiling and personalized advertising, tracking website usage and user preferences across sessions.
Data retention periods are vaguely defined as 'no longer than needed for business purposes or legal obligations' with specific retention periods relegated to separate Technical and Organizational Measures documentation not publicly detailed.
No recommended actions at this time.
Automate your privacy
Connect your accounts to TrueTerms to automate these privacy actions and monitor policy changes.
Data Collection & Tracking
Personal Information Collected
Account creation, authentication, password recovery, and user identification
Core password management functionality and vault storage
Billing, payment processing, and account subscription management
Device authentication, security monitoring, crash reporting, and cross-device tracking
Security monitoring, fraud detection, and usage analytics
Product improvement, analytics, and personalized advertising
Account recovery, customer support, and product feedback
Breach notification service and security alerts
Fraud detection, security decisions, and personalization
User identification, professional context, and data enrichment
Cross-Platform Tracking
LastPass tracks you across the web using third-party cookies placed on partner sites and advertising networks (Facebook, Google) to build a profile of your interests and browsing behavior for targeted advertising. Device identifiers and IP addresses enable tracking of your activity across devices and sessions.
Tracking Methods:
Third-Party Cookies
LastPass places and allows third-party cookies on its site and partner sites (via Facebook, Google) to track browsing behavior and build behavioral profiles for personalized advertising
Device Fingerprinting
Collection of device identifiers, IP addresses, OS information, and browser characteristics to create unique device fingerprints for cross-device and cross-session tracking
Tracking Pixels
Invisible tracking pixels embedded in emails, web pages, and advertising networks to monitor user interactions and conversions
Social Media Pixel Tracking
Facebook and Google pixels track LastPass users across their respective platforms and partner sites to enable cross-contextual advertising and audience building
Session & Usage Logging
Automatic logging of user session data, activity patterns, feature usage, and engagement metrics within LastPass application
Terms of Service Updates
Payment Dispute Resolution Timeline Added
New language specifies that after a fee dispute is resolved, customers must pay undisputed fees within fifteen (15) days. The previous version's sentence was incomplete, but this addition creates a new payment obligation deadline tied to dispute resolution that customers should be aware of.
Effective: September 3, 2026
AI & Data Training
lastpass does not train AI on your content
Based on their public policy, your content is not used to train AI models.
How to Object
No opt-out available
This service does not currently provide a public way to opt out of AI training.
Why We Analyzed lastpass
TrueTerms automatically audits privacy policies and data practices using advanced machine learning to keep you informed and protected. This scorecard is based on the latest available public terms of service and privacy policies as of 2026.