Bank of America Mobile Banking

"Information from your computer and mobile devices where allowed by individual browsers and/or operating systems, such as: Unique device identifiers (for example Media Access Control (MAC) and Internet Protocol (IP) addresses) Browser type, version, language, and display/screen settings... unique and measurable patterns such as keystrokes, mouse clicks and movements, swipes and gestures."

The policy collects keystroke patterns, mouse movements, swipes, gestures, MAC addresses, and device identifiers — behavioral biometrics and device fingerprinting that go beyond what's needed for basic banking functionality.

"Geolocation information (for example, for real time ATM or financial center location, upon request, or for fraud prevention)... finding nearby ATMs, financial centers, and other specialized location based services near your location."

Bank of America collects geolocation data from user devices, which while partially justified for ATM location and fraud prevention, enables real-time location tracking.

"This Notice is subject to change. We update this Notice periodically to comply with the most recent federal and local laws. Please review it whenever you have questions. If we make changes to this Notice, we will revise the Last updated date on this page."

Bank of America can change the privacy notice at any time with no obligation beyond updating a date on the page — no direct notification or consent mechanism is provided.

"We may share the personal information we collect from and about you online described in this Notice with: Affiliates and Subsidiaries of Bank of America, such as Merrill. Third-Party Providers who have contracts with Bank of America. Government Agencies as required by laws and regulations."

Personal information is shared broadly with affiliates like Merrill and contracted third-party providers, creating a wide data-sharing network beyond the direct banking relationship.

"We may use personal information about your activities on our Sites and Mobile Apps, such as pages visited and key words entered, to help determine which of our ads or offers may be of interest to you. We may use personal information about your relationship with us (such as types of accounts, transactional information or the location in which you bank) to help determine which advertisements or offers to present to you."

Bank of America combines online browsing activity, account relationship data, and transactional information to build profiles for ad targeting across their own properties and third-party sites.

"We retain personal information for a period of time as required by laws and regulations and the necessary business purpose. We securely delete personal information as soon as legally permitted."

The retention policy provides no specific timelines, using vague language about 'business purpose' and legal requirements that could justify indefinite retention.