California Privacy Center

Updated: July 2024

U.S. Bank is dedicated to doing the right thing. The information on this page provides details on how we respond to and implement processes to uphold applicable state laws. The laws on this page give individuals certain rights regarding the personal information that U.S. Bank or our affiliates have collected from or about them.

The information on this page complements the notices and disclosures regarding your rights under federal laws and regulations (e.g., the Gramm-Leach-Bliley Act). For more information, please visit usbank.com/privacy.

U.S. Bank California Privacy Notice for California residents

This Privacy Notice for California Residents (this “Notice”) applies solely to residents of the State of California (“consumers” or “you”) and supplements the information contained in any other Privacy Statement or Notice provided by U.S. Bank and its affiliates (collectively, “U.S. Bank” “our” or “we”). Please note that some of our affiliates may provide a separate privacy notice, in which case that notice will apply to your personal information. We adopt this Notice to comply with the California Consumer Privacy Act of 2018 and, as amended, the California Privacy Rights Act of 2020 (together, “CPRA”). This Notice describes how U.S. Bank collects, uses, and discloses information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your household (“personal information”). This Notice applies to personal information we collect online and offline, such as when you apply for our products or services, use our websites or applications, respond to surveys, contact customer support, when you visit our offices or attend a U.S. Bank event, or otherwise interact with us (collectively, “Services”). The information on this page complements the notices and disclosures regarding your rights under federal laws and regulations (e.g., the Gramm-Leach-Bliley Act). For more information, please visit usbank.com/privacy.

The rights contained in this Notice may not apply in certain situations depending on your relationship with U.S. Bank and U.S. Bank’s other legal obligations, and as otherwise provided for in the CPRA, and the GLBA exemption contained therein. We may, from time to time, make changes to this Notice. If we do make changes to the Notice, we will let you know by posting the revised Notice with a new “Last Updated” date posted at the top of the Notice. Any changes to this Notice will become effective when posted unless indicated otherwise. We encourage you to review this Notice regularly to stay informed about our information practices and the choices available to you.

Contents

Categories of personal information we collect

We may collect the following categories of personal information when you engage our Services:

• Identifiers — A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, passport number, signature or other similar identifiers
• Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)) — A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number and ATM card number, or any other financial information, medical information, or health insurance information.
• Sensitive personal information — Social Security number, driver's license, state identification card, or passport number; your account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; racial or ethnic origin, religious beliefs, or union membership; the contents of your mail, email, and text messages unless U.S. Bank was the intended recipient of the communication; health data; precise geolocation data; biometric information; and sex life or sexual orientation data
• Protected classification characteristics under California or federal law — Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information)
• Commercial information — Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies
• Biometric information — Fingerprints, faceprints, voiceprints and behavioral patterns
• Internet or other electronic network activity information — Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement
• Geolocation data — Physical location or movements
• Audio and visual Information — Audio, electronic, or similar information we capture through your communications with us, e.g., voice recordings of telephone conversations, emails and instant messaging, and security images if you visit our offices
• Employment information — Current or past job history
• Inferences drawn from other personal information — Inferences drawn from any of the information identified above to create a profile about you reflecting preferences, characteristics, attitudes and or similar trends

Where we collect your personal information

We will collect the personal information described above from one or more of the following sources:

• Directly from you or your company when you provide this information to us, when you request information, apply for products or services from us, use our websites or applications, respond to surveys, contact customer support, when you visit our ATMs, branches or offices or attend a U.S. Bank event, or otherwise interact with us
• From our affiliates, co-owners, partners and other related parties
• From other online and offline sources, such as public databases, social media platforms, and other third parties
• Vendors who provide services on our behalf

Use of personal information

We may use or disclose personal information that we collect for one or more of the following business purposes to, among other things:

• Provide you with, or evaluate your eligibility for, products and services that you or your company request from us.
• Communicate with you about your accounts or transactions with us.
• Send you important information regarding our products and services, changes to this Notice and/or other similar administrative information.
• Enter into transactions and conduct business dealings with our business partners, service providers and contractors.
• Allow you to participate in surveys, sweepstakes, contests and similar promotions, and to administer such promotions (note that these promotions may contain additional disclosures regarding our collection and/or use of your information).
• Consistent with local law, required disclosures, and choices and controls that may be available to you:
  • Send you offers and promotions for our products and services, or products and services that may be of interest to you;
  • Personalize content and experiences on our Services;
  • Verify your identity and/or location (or the identity or location of your authorized representative) for security, fraud prevention and other risk control purposes; and
  • Provide you with advertising based on your activity on our Services and on third-party websites and applications. For additional information regarding our use of your information for personalization and tracking, please refer to the Online Tracking and Advertising section of the Online Privacy and Security Policy.
• Optimize or improve our products and services.
• Help to ensure security and integrity. Detect, investigate, and prevent activities that may violate our policies or be illegal.
• Report to credit bureaus
• Comply with our legal and regulatory obligations.
• Enforce our terms and conditions and otherwise protect our rights and operations.

Disclosure of personal information for a business purpose

We may disclose your personal information for a business purpose to the following categories of parties:

• Affiliates;
• Service providers and contractors who help manage, develop, and analyze our business and/or deliver services to us and our clients, such as;
  • Professional services organizations, such as auditors and law firms
  • Our business partners
  • Online advertising services and networks
  • Internet service providers
  • Data analytics providers
  • Operating systems and platforms
  • Social networks
  • Data brokers
• Agencies and organizations working to prevent fraud in financial services; or
• Law enforcement, regulatory and other governmental agencies.

Retention period

We store personal information for as long as necessary to carry out the purposes for which we originally collected it and for other legitimate business purposes, including to meet our legal, regulatory, or other compliance obligations.

Sharing or selling your personal information

We do not sell personal information to third parties for monetary consideration without your prior consent, but we may share your personal information with third parties for cross-context behavioral advertising.

The categories of personal information that we may have shared are:

• Identifiers, including IP addresses, cookie identifiers, and other pseudonymous identifiers
• Account information
• Protected classification information
• Internet or other electronic network activity information
• Professional or employment information
• Inferences drawn from personal information

We do not purposefully sell or share the personal information of children under the age of 16.

For more on your personal information share/sale rights, see Right to Opt-out of Sharing or Selling.

We reserve the right to transfer any personal information we have about you in the event we sell or transfer all or a portion of our business or assets (including in the event of a merger, acquisition, joint venture, reorganization, divestiture, dissolution or liquidation).

Use of sensitive personal information

Under the CPRA, we collect the types of sensitive personal information described in the Categories of Personal Information We Collect section above. U.S. Bank only collects and uses sensitive personal information for certain limited purposes, such as providing services and products to consumers, detecting data security incidents and protecting against fraud (“Limited Purposes”). Because U.S. Bank uses this sensitive personal information for Limited Purposes, there is no need for us to provide a Limit Use and Disclosure of Sensitive Personal Information right under the CPRA.

Summary of prior 12-month personal information handling practices

We provide in the chart below a summary of our prior 12-month personal and sensitive information handling practices. You can learn more about the information we collect at or before the point of collection above in the Categories of Personal Information We Collect, Where We Collect Your Personal Information, Use of Personal Information, and Disclosure of Personal Information for a Business Purpose sections.

PRINT

Your rights and choices

This section describes your CPRA rights and explains how to exercise those rights:

Right To Know

You have the right, subject to certain exceptions defined in the CPRA and other applicable laws and regulations, to request that U.S. Bank disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request, we will disclose to you:

• The categories of personal information we collected about you.
• The categories of sources for the personal information we collected about you.
• The business or commercial purpose for collecting, selling, or sharing the personal information.
• The categories of third parties with whom we disclose that personal information.
• The categories of personal information that each recipient received.
• The specific pieces of personal information we collected about you.

You have the right to receive this information in a format, to the extent technically feasible, that is portable, usable, and allows you to transmit the personal information to a person without impediment, where the processing is carried out by automated means.

Right to Request Deletion

You have the right, subject to certain exceptions defined in the CPRA and other applicable laws and regulations, to request that U.S. Bank delete any of your personal information that we collected from you and retained. Once we receive and confirm your verifiable consumer request we will delete (and direct the recipients of your personal information to delete) your personal information from our records.

Right to Correct Your Personal Information

Please note the following right is effective January 1, 2023.

You have the right, subject to certain exceptions defined in the CPRA and other applicable laws and regulations, to submit a request to correct any inaccurate personal information that we may have about you.  To correct your information, please visit the How do I change my address, phone number or email address? section of the Customer Service page.

Right to Opt-out of Sharing or Selling

Please note the following right is effective January 1, 2023.

We use technologies such as cookies, pixel tags, web beacons, and other similar technologies, that gather information on our website. That information is used for a variety of purposes, such as to understand how visitors interact with our websites, or to serve advertisements on our websites or on other websites. We also use your email address to deliver advertising to you on third party platforms, such as social media sites, search results, and others’ websites. The use of these technologies and tools for advertising constitutes a ‘share’ or ‘sale’ of personal information under the CPRA.

We also treat opt-out preference signals, such as the Global Privacy Control, as valid requests to opt-out of the sale or sharing of your personal information. An opt-out preference signal is a signal that is sent by a platform, technology, or mechanism on your behalf that communicates your choice to opt-out of the sharing for targeted advertisements or sale of your personal information. You can learn more about implementing opt-out preference signals by visiting the Global Privacy Control website here or by exploring other developing technologies and services that offer this tool.

Exercising your rights

To exercise the rights described above, please submit a verifiable consumer request to us through one of the following methods:

• Current, Former or Prospective Customer Requests:
  • Please complete the Personal Information Request Form. This form allows you to request the details of the personal information that U.S. Bank has about you and to request access, to that information. Once received, U.S. Bank must use reasonable methods to verify the identity of the requestor before responding. If we cannot verify the requestor, we will either deny the request or ask for additional identifying information. U.S. Bank will respond within 45 days of the request unless additional time is required.
  • If you are a U.S. Bank customer, you can log in to online banking. You can locate the “Request for personal information” link within the Self service area under Customer service.
• Workforce (employee, prospective, current, or former) Requests:
  • Please complete the Personal Information Request Form. This form allows you to request the details of the personal information that U.S. Bank has about you and to request access, to that information. Once received, U.S. Bank must use reasonable methods to verify the identity of the requestor before responding. If we cannot verify the requestor, we will either deny the request or ask for additional identifying information. U.S. Bank will respond within 45 days of the request unless additional time is required.
  • Or call us at 1-800-806-7009.

You may only make a verifiable consumer request for access twice within a 12-month period.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. We will generally verify your identity by asking you to provide personal information related to your recent interactions with us. Making a verifiable consumer request does not require you to create an account with us. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

Requests by Authorized Agents

You may exercise your privacy rights through an authorized agent. If we receive your request from an authorized agent, we may ask for evidence that you have provided such agent with a power of attorney or that the agent otherwise has valid written authority to submit requests to exercise rights on your behalf.

Nondiscrimination

You have the right not to be discriminated against for exercising any of your privacy rights. This includes us not: (a) denying you goods or services; (b) charging you different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties; (c) providing you a different level or quality of goods or services; (d) suggesting to you that you will receive a different price or rate for goods or services or a different level or quality of goods or services; and (e) retaliating against you for exercising your privacy rights.