U.S. Bank Mobile Banking

"Including unique personal identifier, online identifier, Internet Protocol address, hashed email address, hashed telephone number, mobile advertising IDs (MAID) (e.g., Android Advertising ID (AAID), Google Advertising ID (GAID), Google Click ID (GCLID), and Apple's identifier for advertisers (IDFA)), or other identifiers. Including the type of operating system and browser you use... your Media Access Control (MAC) address and other device identifiers."

U.S. Bank collects a wide array of device identifiers and advertising IDs across platforms, enabling cross-device tracking and unified profiling across browsers, apps, and services.

"We may disclose or share information: With our vendors, service providers, and other third parties; With our affiliates and otherwise within the U.S. Bancorp family of financial service providers; With other companies to joint market or to bring you co-branded services, products, or programs."

The policy authorizes sharing personal information with a broad and open-ended set of third parties including affiliates, vendors, joint marketing partners, and co-branded service providers.

"Including physical location or movements, which may include your actual location to help you in finding a nearby ATM, branch, or office. We do not access location data stored on your device without your permission. Some features will not fully function unless you have enabled access to your location data."

U.S. Bank collects physical location and movement data, and conditions full functionality on granting location access, which can pressure users into enabling location tracking.

"Including biometric information, for example, identify verification by voiceprint. Including behavioral characteristics, such as keystroke and mouse movement patterns. Including data resulting from your activity, such as transaction information and the pages you visit on our online services... voice to text queries in the mobile app."

U.S. Bank collects voiceprint biometrics, keystroke and mouse movement behavioral patterns, and voice-to-text queries — data that goes well beyond what is needed for basic banking services.

"We store information for as long as necessary to carry out the purposes for which we originally collected it and for other legitimate business purposes, including to meet our legal, regulatory, or other compliance obligations. We may use and disclose information even when you are no longer our customer or client."

The retention policy is open-ended with no specific timelines, and the bank explicitly states it continues to use and disclose personal information even after the customer relationship ends.

"From time to time, we may update this Privacy Policy to accommodate new technologies, industry practices, regulatory requirements, or for other purposes. Any changes to this Privacy Policy will become effective when the revised policy is posted. By continuing to use the online services following such changes, you are agreeing to accept the terms of the revised Privacy Policy."

U.S. Bank reserves the right to change the privacy policy unilaterally, with changes taking effect immediately upon posting and continued use treated as acceptance of the new terms.