Data Report Card · Coinbase
Coinbase Data Report Card
C
7/12 Policy grade · Crypto exchange · Coinbase Global, Inc.
Reviewed Jun 2026 · policies are checked weekly for changes · stated — every cell is read from Coinbase's published policy; none has been tested (run by us) yet.
2Accessstated
Coinbase provides a self-serve Privacy Rights Dashboard (coinbase.com/settings/privacy-rights) to request access to the personal information it holds, and confirms receipt within 24 hours, satisfying the access right.
Coinbase — How to access privacy settings and make requests · accessed Jun 2026 ↗1Portabilitystated
You can self-serve export your transaction history as CSV or PDF from Account settings and request a broader data copy, but CSV is the only true machine-readable format offered (PDF is not structured), so portability is scored at the single-format level.
Coinbase — Data Privacy FAQ (transaction export) · accessed Jun 2026 ↗Connects to apps: Yes. A consumer can grant an app OAuth 2.0 access to their Coinbase account data via the Coinbase App API (scopes such as
wallet:user:read and wallet:transactions:read), with refresh tokens (offline_access) and revocation from account settings, so agent access is scored at the full level. Coinbase — App OAuth2 access & refresh tokens · accessed Jun 2026 ↗1Frictionstated
Rights are exercised through a self-serve Privacy Rights Dashboard (no email queue), but actual completion takes up to 30 days — the 24-hour figure is only acknowledgment of receipt. Scored on real turnaround, not confirmation speed, so friction is at the moderate level.
Coinbase — How to access privacy settings and make requests · accessed Jun 2026 ↗1Deletionstated
Coinbase honors deletion requests through the Privacy Rights Dashboard, but as a regulated money-services business it retains personal and transaction data (typically up to five years) to meet Bank Secrecy Act / anti-money-laundering obligations, so deletion is scored at the partial level.
Coinbase — Global Privacy Policy (retention) · accessed Jun 2026 ↗1Sells / sharesstated
Coinbase does not sell data for money, but discloses identifiers to analytics and advertising partners which "may constitute a sale / share" under the CCPA; an opt-out is provided via the Do Not Sell or Share link, so sharing is scored at the partial level.
Coinbase — US Privacy Notice (Do Not Sell / Share) · accessed Jun 2026 ↗1Trains AIstated
Coinbase's Global Privacy Policy makes no affirmative commitment against using personal data to train AI or machine-learning models; absent a clear no-training pledge, model-training use is scored conservatively at the partial level.
Coinbase — Global Privacy Policy (silent on AI training) · accessed Jun 2026 ↗Reviewed Jun 2026 from Coinbase's Global Privacy Policy, US Privacy Notice, and Privacy Rights Dashboard help pages. All cells are "stated" (read from published policy), not tested. Coinbase is a regulated financial service: deletion is offered but heavy BSA/AML retention (up to ~5 years) applies, and it discloses identifiers to advertising partners (a CCPA "sale / share" with opt-out). The May 2025 support-contractor breach and the class actions / DOJ-SEC inquiries that followed are NOT recorded as enforcement, because no regulator or court judgment has issued.
Events
Breaches, policy changes, and export-format changes we’ve recorded at Coinbase — other parties’ actions, alongside the enforcement record above. An event never changes a grade by itself. All events →
No events on record for Coinbase.
Grade history
Every change to this company’s grade since it was first published, and why. All grade changes →
No changes since this grade was first published in Jun 2026.
How to request your data from Coinbase
- Go to https://www.coinbase.com/settings/privacy-rights — Coinbase's data-request entry point.
- Privacy Rights Dashboard (coinbase.com/settings/privacy-rights): access / delete; Do Not Sell or Share opt-out; privacy@coinbase.com.
- Expected wait: self-serve Privacy Rights Dashboard for access / deletion; confirmation within 24h, up to 30 days to process; transaction export (CSV/PDF) from Account settings; BSA/AML retention up to ~5 years — Coinbase's stated turnaround (we haven't independently timed a request yet).
- No self-serve option, or want a formal request? Contact Coinbase — Privacy Rights Dashboard: mailto:privacy@coinbase.com.
These steps reflect Coinbase's documented process as of Jun 2026. The wait time is the company's stated figure, not yet independently measured by us.