"Upstart presents a high-risk privacy profile comparable to Google/Microsoft due to extensive collection of sensitive financial data (SSN, bank credentials, biometric data), broad sharing with investors, debt collectors, advertising networks, and continuous cross-platform tracking via cookies and pixels. While some opt-out mechanisms exist for residents of specific states, most data sharing cannot be restricted, and financial data is retained indefinitely for regulatory compliance, creating long-term exposure."
upstart Privacy Concerns & Scorecard
Data shared with loan investors and securitization entities, debt collection companies, and multiple non-affiliated third parties including advertising networks. Policy explicitly states data is 'shared' and 'sold' with advertising partners and social media platforms for targeted advertising
Upstart collects extensive sensitive financial data including Social Security numbers, bank account credentials, credit scores, tax returns, W-2s, pay stubs, and biometric data (images and selfies for identity verification)
Broad cross-site behavioral tracking and retargeting using cookies, web beacons, device identifiers, and pixels to deliver targeted advertisements on other platforms. Third-party tracking partners used for analytics and marketing performance measurement
Sharing for creditworthiness assessment, affiliate marketing, and non-affiliate marketing can be restricted, but most other sharing (with debt collectors, investors, creditors) cannot be limited. Opt-out rights limited to specific states (CA, CO, CT, MN, MT, OR, NV, ND, VT)
Financial data retained indefinitely due to regulatory requirements. Most consumer financial information cannot be deleted upon request. Policy states data retained 'for at least seven years' to comply with federal and state laws, with no deletion mechanism for regulated financial data
AI chatbot collects and processes personal information with automatically-generated responses that may contain inaccuracies or omissions. No explicit opt-out for chatbot data collection described
No recommended actions at this time.
Automate your privacy
Connect your accounts to TrueTerms to automate these privacy actions and monitor policy changes.
Data Collection & Tracking
Personal Information Collected
Verify identity, assess creditworthiness for lending decisions, comply with KYC/AML regulatory requirements
Assess ability to repay loans and calculate income-based lending products
Verify user identity and prevent fraud in loan application process
Fraud detection, personalization, analytics, marketing attribution
Analyze user engagement, improve services, deliver personalized content and advertising recommendations
Account management, loan origination, customer support, marketing communications
Account creation and management, credit assessment, personalization
Measure marketing campaign performance, optimize advertising, analyze web traffic
Cross-Platform Tracking
Upstart tracks users across multiple websites and applications through cookies, web beacons, device identifiers, and pixel tracking technologies. Third-party advertising partners use these same technologies to deliver targeted advertisements relevant to user interests on other platforms. This tracking follows users beyond Upstart's own sites and apps to measure marketing performance and personalize advertising.
Tracking Methods:
Cookies
First-party and third-party cookies track user interactions across Upstart services and partner websites to enable analytics, personalization, and targeted advertising
Web Beacons
Invisible tracking pixels embedded in emails and web pages to track user engagement and email open rates
Pixel Tracking
Marketing pixels track user browsing experience, analyze performance and traffic on Upstart site, and share information with marketing partners for retargeting
Device Identifiers & Fingerprinting
Unique device identifiers and device fingerprinting enable recognition of users across multiple devices and browsers for cross-device tracking and targeting
Terms of Service Updates
Expanded grounds for account termination and service restriction
NEW version grants Upstart explicit right to cancel registration, reject applications, terminate agreements, and restrict future access if any provided information is 'untrue, inaccurate, not current, or incomplete.' OLD version only addressed withdrawal of loan approval by Creditor under specific fraud/misrepresentation circumstances. This significantly broadens Upstart's unilateral termination authority.
Effective: September 6, 2026
Arbitration clause removed from prominent notice
OLD version explicitly states 'THESE TERMS CONTAIN AN AGREEMENT TO ARBITRATE ALL CLAIMS (see Section 16)' in bold warning text. NEW version 'Website Terms of Use' contains no such notice or visible arbitration clause in the provided excerpt. This represents either removal of arbitration requirements or material de-emphasis of dispute resolution terms users must accept.
Effective: September 6, 2026
New restriction on multiple accounts and registration authority
NEW version adds explicit restriction preventing users from registering multiple accounts 'unless the additional account is for purposes of applying for additional products or services' and prohibits registering on behalf of others. This limits user flexibility and gives Upstart discretion over account creation.
Effective: September 6, 2026
AI & Data Training
upstart uses your content to train AI
Below is what's used and how (if at all) you can object.
What Content Is Used
Financial Data and Credit History
Personal financial information, credit history, credit scores, transaction history, account balances, and employment data used for model training and development
Loan Application Data
Data from loan applications and credit assessment processes used to train lending models and underwriting algorithms
User Interaction and Behavior Data
Website browsing behavior, usage patterns, and engagement metrics used to train recommendation and personalization models
How to Object
No opt-out available
This service does not currently provide a public way to opt out of AI training.
Why We Analyzed upstart
TrueTerms automatically audits privacy policies and data practices using advanced machine learning to keep you informed and protected. This scorecard is based on the latest available public terms of service and privacy policies as of 2026.