Fidelity Investments

"Both Fidelity and third-party service providers we hire, such as Google, Meta and Microsoft, may use cookies and other technologies, such as tags, or device ID, in online advertising. We may also use third-party service providers to help us determine which Fidelity products and services may be of interest to you. These service providers may collect information about your activity on Fidelity digital offerings using cookies and other technologies to analyze, for example, pages visited, search engine referrals, browsing patterns, and responses to advertisements and promotions."

Fidelity shares user data with major advertising platforms like Google, Meta, and Microsoft, and allows these third-party service providers to collect browsing activity data directly from users via cookies and tags.

"In some cases, our providers may combine this information collected on our Websites/Apps with information about your activity on other, unaffiliated websites or social media platforms to deliver our ads to you when you are visiting other websites or platforms. This sharing of your information with certain third parties via cookies and similar methods, and our providers' use of certain cookies, may be considered to be a 'sale' of personal information or 'sharing' of personal information for 'cross-context behavioral advertising' under the CCPA."

Fidelity's advertising partners combine user activity from Fidelity properties with activity on unaffiliated websites and social media platforms to build cross-site profiles and deliver targeted ads.

"When you use or interact with us via our digital offerings, or interact with us via electronic communications, we (or our service providers on our behalf) automatically collect technical, location, and internet usage information, such as device type, operating system, browser specifications, internet protocol address, and information about your interactions with our sites and mobile apps. Sensitive personal information, such as social security number, account login, password, or credentials allowing access to your account(s) or to our digital offerings, and precise geolocation information."

Fidelity automatically collects location data when users interact with its digital offerings and explicitly lists precise geolocation as sensitive personal information it may collect.

"Biometric information, such as when you use our voice-recognition service that we use for identity-verification and security purposes. Internet/electronic network activity information, including but not limited to browsing history, search history, and other information regarding your interactions with our digital offerings or our advertisements. Audio, electronic, visual, and similar data, such as call recordings."

Fidelity collects biometric information (voice recognition), detailed browsing and search history, call recordings, and device identifiers, which goes beyond what is strictly necessary for financial services.

"The retention periods for data elements within each category listed above vary depending on the nature of the data element and the purposes for which it is collected and used. Our retention period for the data elements within each category is set according to the following criteria: (1) the length of time that the data is needed for the purposes for which it was created or collected, (2) the length of time the data is needed for other operational or record retention purposes, (3) the length of time the data is needed in connection with our legal, compliance, and regulatory requirements."

Fidelity provides no concrete retention timelines, instead listing broad criteria that could justify indefinite retention of personal data including for vague 'operational purposes' and 'continuity of products and services.'

"This policy is reviewed annually and updated to reflect any changes. Fidelity ('we') may offer products, services and digital offerings that have a different or additional privacy policies that are made available to you if you choose to use those products, services or digital offerings."

The policy states it is updated annually to reflect changes but does not describe any mechanism for notifying users of material changes or obtaining consent before changes take effect.