Do credit card companies sell your data? Not in the way most people picture. Visa and Mastercard both say they don't sell your personal data, in the limited senses they each define, and both turn transaction data into anonymised or aggregated insights for businesses. Your bank, the company that issued your card, can share some of your information with other companies unless you opt out. This guide sets out what each company says it does, what a consumer group alleges, and which kinds of sharing you can switch off. It's about your personal and purchase data, not card debt being sold to collectors, which is a separate topic. The examples are mostly from the US, where bank privacy notices follow a standard federal format. Rules differ elsewhere.

Current as of October 26, 2026.

The Short Answer

Card networks (Visa, Mastercard)

  • Visa's US state privacy notice says it doesn't sell personal information for money. Mastercard told CBS News in 2023 that it doesn't sell personal cardholder data for marketing, location tracking or targeted advertising
  • Both use transaction data to build anonymised or aggregated insights for businesses
  • Mastercard lets you opt out of having your data anonymised for its analytics

Your bank (the card issuer)

  • Shares your information for its everyday business and its own marketing, which you can't limit
  • Often lets you limit sharing for marketing by affiliates and outside companies

Card-linked offer platforms

  • Use transaction data from partner banks to target the cashback offers you see in your banking app, data one major platform says it receives anonymised

Identified, Anonymised and Aggregated: Why the Wording Matters

Most of the argument over whether companies sell data comes down to three kinds of data:

  • Identified data: linked to you by name or account number. This is what your bank holds about you.
  • Anonymised or de-identified data: the company removes direct identifiers before using or sharing it.
  • Aggregated data: many people's transactions combined into totals and trends, such as spending in a city or a store category.

Card networks say the insights they provide to businesses are built from the second and third kinds. Identified data goes to the companies that handle your payment, such as your bank and the store's payment provider, which Visa's privacy notice lists among those it discloses personal information to. Critics point out that removing names doesn't always stop data being used to reach people individually. Both views are set out below.

What Visa Says

Visa's Global Privacy Notice, effective May 14, 2026, says it uses transaction data for analytics, modelling and business intelligence, and generates de-identified, anonymised or aggregated datasets for product development and consulting services to clients.

On selling, Visa's US state privacy notice, effective July 1, 2026, says Visa "does not sell Personal Information for money", although its websites and apps may use cookies and similar technologies. That notice covers the data state privacy laws apply to, such as Visa's websites and marketing. It says the payment transaction data Visa processes is often regulated by federal financial privacy law instead. It also says US Visa websites honour Global Privacy Control, a browser setting that tells sites you're opting out of sharing.

What Mastercard Says, and What Critics Say

Mastercard's Global Privacy Notice, effective January 19, 2026, lists generating anonymised and aggregated data to prepare insights for Mastercard's customers and partners about spending patterns, fraud and other trends. It also lists a right to opt out of the anonymisation of your personal information for data analyses.

That opt-out is on Mastercard's Data Analytics Opt-Out page, which asks for your Mastercard or Maestro card number. Go there from Mastercard's privacy notice or by typing mastercard.com yourself, never from a link in an email, text or ad. The page asks only for the card number, so treat any version asking for your security code or PIN as fake.

The consumer group U.S. PIRG Education Fund published a report on September 20, 2023, updated June 17, 2024, saying Mastercard sells cardholder transaction data in aggregated and anonymised bundles through third-party data marketplaces and its Data & Services division. PIRG argues that this still allows companies to target individuals. Mastercard disputed that framing. A Mastercard spokesman, Will Tsang, told CBS MoneyWatch on September 21, 2023: "Mastercard does not sell personal cardholder data for marketing, location tracking or targeted advertising."

Graphic titled Where your card data can go, subtitled Per each company's own documents, with three panels. Your bank: holds identified data, shares it for everyday business and its own marketing, and in Chase's notice, for example, you can limit sharing for affiliates' and nonaffiliates' marketing. Card networks: Visa says it doesn't sell personal information for money, Mastercard says it doesn't sell personal cardholder data for marketing or ads, both build anonymised or aggregated insights for businesses, and Mastercard offers a data analytics opt-out. Offer platforms: Cardlytics says it takes in about one in two US debit and credit card transactions, and that the data it receives from partner banks is anonymised. Banner: you can limit some sharing, not the payment record itself

What Your Bank Can Share

In the US, banks follow the Gramm-Leach-Bliley Act privacy rule. They send a privacy notice, often a standard table headed Facts, that lists each reason they share your information and whether you can limit it. Chase's consumer privacy notice, last updated December 2025, is a typical example:

Sharing you can't limit

  • Everyday business, such as processing your transactions and responding to court orders
  • Chase's own marketing to you
  • Joint marketing with other financial companies
  • Affiliates' everyday business, using information about your transactions and experiences

Sharing you can limit

  • Affiliates' everyday business, using information about your creditworthiness
  • Affiliates marketing to you
  • Outside companies (nonaffiliates) marketing to you

Chase's notice says you can limit sharing by phone or in your online privacy preferences, that it can start sharing a new customer's information 30 days after sending the notice, and that it keeps sharing after you stop being a customer unless you limit it. Your bank's notice may differ, so check its own table. For what the purchase record itself contains, see our guide to whether your bank can see what you buy.

Card-Linked Offers: How Banking App Deals Use Your Purchases

The cashback offers for specific stores in many banking apps are often run by an outside platform. One major platform, Cardlytics, says in its 2025 annual report that its US platform takes in roughly one in every two debit and credit card transactions. It says the data from its partner banks is anonymised so it can't be associated with any one individual, and that no personal data is shared by those banks with Cardlytics. It also says it assigns each bank customer a unique ID, and works with third parties to match its anonymised identifiers to theirs, for example to measure whether offers led to sales. Whether your bank uses such a platform, and whether you can turn the offers off, depends on your bank.

What You Can Opt Out Of

  • Your bank's marketing sharing. Use the choices in your bank's privacy notice. Under US rules you can't stop the sharing a bank needs to run your account.
  • Mastercard's analytics. The Data Analytics Opt-Out page above covers the anonymisation of your data for analyses.
  • Website and app tracking. Global Privacy Control covers sharing through cookies on sites that honour it, including US Visa websites, in each browser where you turn it on. It doesn't cover your card transactions.
  • California's privacy law. The CCPA gives a right to opt out of the sale or sharing of personal information, but Section 1798.145(e) says the law doesn't apply to information collected, processed, sold or disclosed subject to the Gramm-Leach-Bliley Act. Visa's own US notice, for example, says the payment transaction data it processes is often regulated by federal financial privacy law, which state privacy laws defer to.
  • UK. The ICO's guidance says people have an absolute right to stop their data being used for direct marketing, by any organisation.

What you can't opt out of is the payment record itself. Your bank and the card network need it to process the payment, catch fraud and meet legal duties.

What It Means for Your Privacy

Our take: a company can truthfully say it doesn't sell your personal data while your purchases still feed a data business. The real question is how well de-identification and aggregation hold up, and that's hard for anyone outside these companies to check. What you can control is the optional sharing listed above. Each opt-out only covers one company and one kind of use, so it's worth doing them separately. For the same who-sees-what question when you pay with crypto, see our guide to spending crypto privately.

Where COTI Fits

COTI's roadmap lists a virtual Visa or Mastercard, usable with Apple Pay and Google Pay and topped up through a private transfer, for Q2 to Q3 2027, as of October 26, 2026. It isn't live. A card like that would still run on a card network, so the network's data practices described here would still apply to its card payments. What COTI says it's working on is the crypto side: limiting how much the public blockchain shows about the funds behind the card, such as amounts. Our guide to how crypto cards work explains where that line falls.

Frequently Asked Questions

Does Visa sell my data?

Visa's US state privacy notice, which covers its website and marketing data, says it doesn't sell personal information for money. Its global notice says it uses transaction data for analytics and creates de-identified or aggregated datasets, including for consulting services to clients.

Does Mastercard sell my data?

Mastercard told CBS News in 2023 that it doesn't sell personal cardholder data for marketing, location tracking or targeted advertising. Its privacy notice says it generates anonymised and aggregated data for insights. U.S. PIRG argues that this amounts to selling data that can still be used to reach individuals. Mastercard offers an opt-out from the anonymisation of your data for analyses.

Do banks sell your transaction data?

Banks describe their sharing in their privacy notices rather than as selling. They can share with affiliates and outside companies for marketing, and in the US you can usually limit the marketing sharing. Some banks also work with card-linked offer platforms, which receive transaction data that one major platform says is anonymised.

Can I stop my bank sharing my data completely?

No. Sharing to run your account, prevent fraud and meet legal duties can't be limited, and in notices like Chase's neither can the bank's own marketing, joint marketing or affiliates' use of your transaction history. You can limit the rest of the marketing sharing listed in your bank's notice.

Where to Go From Here

Opting out takes a few minutes per company: your bank's privacy notice choices, Mastercard's analytics opt-out if you have a Mastercard, and Global Privacy Control in your browser. To follow COTI's plans for private payments, including the card planned for Q2 to Q3 2027, see COTI's roadmap.

Details checked October 26, 2026. Privacy notices and opt-outs change. Visa, Mastercard, Chase, Cardlytics and U.S. PIRG are cited for reference only and aren't affiliated with COTI. Nothing here is financial or legal advice.

Sources