Does your website use third-party services? Get GDPR compliant in minutes.
Try FlowConsentFree plan · 10-min setup
Plaid is an open-banking data network that connects end-user bank accounts to financial applications via its Plaid Link JavaScript SDK. It aggregates account details, balances, transactions and identity data on behalf of fintech apps. In the EU and UK, Plaid Financial Ltd operates as an FCA-authorised Account Information Service Provider under PSD2, making its processing subject to both GDPR and open-banking regulation. Because Plaid transfers data to the United States and sets tracking cookies, deploying it requires explicit user consent and careful DPIA documentation.
Plaid is a financial data network that allows consumer-facing apps to connect directly to a user's bank account. The integration happens through Plaid Link, a JavaScript SDK that opens a secure overlay in which the user authenticates with their bank credentials or via OAuth. Once authorised, Plaid retrieves account information (IBANs, sort codes), balances, transaction history going back up to two years, and identity data such as the account holder's name and address. In the EU and UK, this service is delivered by Plaid Financial Ltd, a company authorised by the UK Financial Conduct Authority as an Account Information Service Provider under the Payment Services Regulations 2017, which implement PSD2.
Plaid collects bank account metadata, balance figures, categorised transaction records, and identity fields. It also sets first-party session cookies during the Link flow and loads resources from cdn.plaid.com and production.plaid.com. The primary cookies include a session identifier (_plaid_session), a device fingerprint cookie used for fraud prevention, and analytics cookies that measure Link conversion rates. These cookies are set on the publisher's domain via the embedded SDK as well as on Plaid's own subdomains. Because these cookies are not strictly necessary for the core service once consent is given for account linking, they fall under the scope of the ePrivacy Directive and require prior opt-in consent.
Financial transaction data can constitute special-category data under Art. 9 GDPR when it reveals health-related expenditure, religious donations or political contributions. Controllers must therefore consider whether Art. 9(2)(a) explicit consent is required in addition to the Art. 6(1)(a) lawful basis for ordinary personal data. Under PSD2, the user must give free, specific, informed and unambiguous consent for each account information service, meaning bundled consent within general terms and conditions is invalid. Fraud-prevention processing may rely on legitimate interests (Art. 6(1)(f)), but this requires a documented balancing test demonstrating that the data subject's rights do not override the controller's interests.
Get GDPR compliant in 10 minutes
Free plan available · No credit card required
Plaid Financial Ltd transfers personal and financial data to its US parent Plaid Inc. under the EU-US Data Privacy Framework (DPF), to which Plaid Inc. is a certified participant. UK transfers rely on the UK Extension to the DPF. Controllers should verify Plaid's current DPF certification at privacyshield.gov, include the transfer in their Records of Processing Activities under Art. 30 GDPR, and document the transfer mechanism in their privacy notice. Standard Contractual Clauses are used as a supplementary safeguard. Given the post-Schrems II environment, a Transfer Impact Assessment is advisable, particularly for high-volume or sensitive financial datasets.
Plaid Link must not be initialised until the user has given valid consent under both GDPR and the ePrivacy Directive. In practice this means loading the Plaid Link script only after the Consent Management Platform signals a positive consent choice. The consent UI must clearly name Plaid, describe the categories of bank data to be accessed, disclose the transfer to the US and provide a meaningful withdrawal mechanism. Conditional loading is best achieved by wrapping the Plaid Link initialisation call inside the CMP callback and avoiding any pre-loading of cdn.plaid.com resources before consent fires. Consent records must be stored with a timestamp and version identifier so that they can be produced in response to regulatory enquiries.
Developers integrating Plaid should: (1) gate the Plaid Link script behind CMP consent; (2) execute a DPIA before go-live and review it annually; (3) add Plaid Financial Ltd to the Data Processing Agreement schedule with appropriate sub-processor provisions; (4) update the privacy notice to describe Plaid's data collection, legal basis, retention periods and US transfer; (5) implement a bank account disconnection flow that triggers Plaid's account removal API so data is promptly deleted; (6) ensure sandbox.plaid.com is only used in development and never receives real user data; and (7) subscribe to Plaid's security bulletins and review any changes to their sub-processor list, notifying users of material changes within the timeframe required by Art. 13 and 14 GDPR.
Websites using Plaid must obtain user consent under GDPR regulations.
DPIA considerations
A Data Protection Impact Assessment is mandatory before deploying Plaid in any EU or UK context. Key risk factors include: (1) special-category financial data (detailed transaction histories can reveal health conditions, religious affiliation or political views, triggering Art. 9 GDPR); (2) large-scale processing of sensitive banking credentials and account data; (3) international transfers to the United States relying on the EU-US Data Privacy Framework, which requires ongoing monitoring following the Schrems II landscape; (4) PSD2 obligations requiring explicit, granular consent for each account information service; (5) risk of re-identification when transaction data is combined with identity data. The DPIA must document data flows through Plaid Link, assess the security of OAuth redirect flows, review Plaid Financial Ltd's sub-processor chain, and conclude with residual risk mitigation measures including contractual safeguards and access controls.
Sample consent text
We use Plaid to securely connect your bank account to this service. Plaid (operated in the EU/UK by Plaid Financial Ltd, an FCA-authorised Account Information Service Provider) will access your account information, balances and transaction history on your behalf. Your data will be processed in the EU and UK and may be transferred to Plaid Inc. in the United States under the EU-US Data Privacy Framework. Plaid also sets cookies on your device via its Link interface. You can withdraw this consent at any time by disconnecting your account in your profile settings, after which Plaid will delete your data in accordance with its retention policy. Do you consent to Plaid accessing your bank account data?
Third-party domains contacted
plaid.comcdn.plaid.comproduction.plaid.comsandbox.plaid.comCookies placed
| Name | Type | Duration | Purpose |
|---|---|---|---|
| _plaid_session | session | Session | Maintains state and authentication context during the Plaid Link bank account connection flow. Required for the OAuth redirect and credential-verification steps to function correctly. |
| plaid_device_id | persistent | 2 years | Device fingerprinting cookie used by Plaid's fraud and abuse prevention system to identify returning devices and detect anomalous authentication patterns. |
| _plaid_analytics | analytics | 1 year | Analytics cookie loaded from cdn.plaid.com that measures Plaid Link funnel conversion rates, drop-off points and feature usage to improve the Link product. |
| plaid_csrf_token | functional | Session | CSRF protection token set during the Plaid Link OAuth flow to prevent cross-site request forgery attacks during the bank authentication redirect sequence. |
| plaid_ab | functional | 30 days | A/B testing and feature-flag cookie used internally by Plaid to roll out new Link UI variants and measure their effect on authentication success rates. |
Plaid uses cookies for user preferences — inform visitors with a consent banner.
Plaid sets several cookies through its Link SDK: a session cookie (_plaid_session) to maintain state during the bank authentication flow, a device fingerprint cookie used for fraud and abuse prevention, and analytics cookies on cdn.plaid.com that measure Link funnel performance. These cookies are set both on the publisher's domain and Plaid's own subdomains, and they persist beyond the immediate session in some cases. Because they are not strictly necessary for a purely functional service, they require prior informed consent under the ePrivacy Directive.
Yes, consent is required on two separate grounds. First, under the ePrivacy Directive, cookies and similar trackers set by Plaid Link require an affirmative opt-in before they are placed. Second, under PSD2 and GDPR, users must give explicit, granular consent for each account information service before Plaid may access their bank account data. Bundled consent in terms and conditions is not sufficient; the consent UI must clearly name Plaid and describe the data accessed.
For financial account data aggregation, the primary legal basis is explicit consent under Art. 6(1)(a) GDPR, reinforced by the PSD2 consent requirement for account information services. Where Plaid processes financial data that reveals health, religious or political information, Art. 9(2)(a) explicit consent applies in addition. Fraud prevention processing may rely on legitimate interests under Art. 6(1)(f), but a documented balancing test is required to demonstrate that this overrides data subjects' rights. Contractual necessity (Art. 6(1)(b)) applies to the core payment initiation step only.
Yes. Plaid Financial Ltd (the EU/UK entity) transfers personal and financial data to Plaid Inc. in the United States. This transfer is covered by the EU-US Data Privacy Framework, to which Plaid Inc. is a certified participant, and supplemented by Standard Contractual Clauses. Controllers must record this transfer in their Art. 30 register, disclose it in their privacy notice, and consider conducting a Transfer Impact Assessment for large-scale or sensitive financial datasets given the evolving legal landscape following Schrems II.
Yes, a Data Protection Impact Assessment is mandatory. Plaid's processing meets multiple GDPR Art. 35 triggers: large-scale processing of financial data, potential revelation of special-category data through transaction analysis, and systematic monitoring of individuals' financial behaviour. The DPIA must document data flows through Plaid Link, assess the security of OAuth redirect flows, evaluate Plaid Financial Ltd's sub-processor chain, record the US transfer mechanism, and define residual risk mitigations. The DPIA should be reviewed at least annually or when Plaid updates its data processing terms.
Gate the Plaid Link script entirely behind CMP consent so it does not load or set cookies until the user opts in. Display a clear consent notice naming Plaid, describing the data categories and the US transfer. Sign a Data Processing Agreement with Plaid Financial Ltd and add it to your sub-processor schedule. Complete a DPIA before launch. Update your privacy notice to cover Plaid's data collection, legal basis, retention periods and the US transfer. Implement a bank account disconnection feature that calls Plaid's account removal API so data is deleted when users withdraw consent. Store timestamped consent records for audit purposes.
In Europe, regulated open-banking APIs provided directly by banks under PSD2 (XS2A) can be used without a third-party aggregator, eliminating the US data transfer risk and reducing cookie footprint. Providers such as TrueLayer (UK/EU), Nordigen (now GoCardless Open Banking) and Salt Edge are EU-based alternatives that process data within the EEA and may simplify your GDPR documentation. The right choice depends on geographic coverage, the bank connectivity required and the complexity of your consent and data minimisation requirements.
Add a dedicated Plaid entry to your cookie policy table listing the _plaid_session cookie, the device fingerprint cookie and any analytics cookies, with their duration, purpose and the legal basis (consent). In your privacy policy, add a section describing Plaid as a data processor, the categories of financial data collected, the PSD2 and GDPR legal bases, the US transfer mechanism (EU-US DPF plus SCCs), Plaid's retention period and users' right to withdraw consent and request deletion. Link to Plaid's own privacy policy at plaid.com/legal/privacy-notice. Review and update both documents whenever Plaid updates its data processing addendum.