Data Report Card · Coinbase
Coinbase Data Report Card
Crypto exchange · Coinbase Global, Inc.
Data
Practices
Practices
2Access1Portability1Friction1Deletion1Sells1Trains AI
=
C
7/12
Agent
Readiness
Readiness
2Access
1Portability
2API access
=
B
5/6
Agent Readiness is a derived signal — a synthesis of two existing cells (Access, Portability) plus one sourced factor (API access), not an independently measured grade. API access scale: Best (2) consumer-grantable API · Moderate (1) partial / encumbered · Restrictive (0) manual export only. What is Agent Readiness?
Reviewed Jun 2026 · policies are checked weekly for changes · stated — every cell is read from Coinbase's published policy; none has been tested (run by us) yet.
2Accessstated
Coinbase provides a self-serve Privacy Rights Dashboard (coinbase.com/settings/privacy-rights) to request access to the personal information it holds, and confirms receipt within 24 hours, satisfying the access right.
Coinbase — How to access privacy settings and make requests · accessed Jun 2026 ↗1Portabilitystated
You can self-serve export your transaction history as CSV or PDF from Account settings and request a broader data copy, but CSV is the only true machine-readable format offered (PDF is not structured), so portability is scored at the single-format level.
Coinbase — Data Privacy FAQ (transaction export) · accessed Jun 2026 ↗1Frictionstated
Rights are exercised through a self-serve Privacy Rights Dashboard (no email queue), but actual completion takes up to 30 days — the 24-hour figure is only acknowledgment of receipt. Scored on real turnaround, not confirmation speed, so friction is at the moderate level.
Coinbase — How to access privacy settings and make requests · accessed Jun 2026 ↗1Deletionstated
Coinbase honors deletion requests through the Privacy Rights Dashboard, but as a regulated money-services business it retains personal and transaction data (typically up to five years) to meet Bank Secrecy Act / anti-money-laundering obligations, so deletion is scored at the partial level.
Coinbase — Global Privacy Policy (retention) · accessed Jun 2026 ↗1Sells / sharesstated
Coinbase does not sell data for money, but discloses identifiers to analytics and advertising partners which "may constitute a sale / share" under the CCPA; an opt-out is provided via the Do Not Sell or Share link, so sharing is scored at the partial level.
Coinbase — US Privacy Notice (Do Not Sell / Share) · accessed Jun 2026 ↗1Trains AIstated
Coinbase's Global Privacy Policy makes no affirmative commitment against using personal data to train AI or machine-learning models; absent a clear no-training pledge, model-training use is scored conservatively at the partial level.
Coinbase — Global Privacy Policy (silent on AI training) · accessed Jun 2026 ↗2API access — feeds Agent Readiness, not the /12stated
A consumer can grant an app OAuth 2.0 access to their Coinbase account data via the Coinbase App API (scopes such as
Coinbase — App OAuth2 access & refresh tokens · accessed Jun 2026 ↗wallet:user:read and wallet:transactions:read), with refresh tokens (offline_access) and revocation from account settings, so agent access is scored at the full level.Reviewed Jun 2026 from Coinbase's Global Privacy Policy, US Privacy Notice, and Privacy Rights Dashboard help pages. All cells are "stated" (read from published policy), not tested. Coinbase is a regulated financial service: deletion is offered but heavy BSA/AML retention (up to ~5 years) applies, and it discloses identifiers to advertising partners (a CCPA "sale / share" with opt-out). The May 2025 support-contractor breach and the class actions / DOJ-SEC inquiries that followed are NOT recorded as enforcement, because no regulator or court judgment has issued.
Events
Breaches, policy changes, and export-format changes we’ve recorded at Coinbase — other parties’ actions, alongside the enforcement record above. An event never changes a grade by itself. All events →
No events on record for Coinbase.
Grade history
Every change to this company’s grade since it was first published, and why. All grade changes →
No changes since this grade was first published in Jun 2026.
How to request your data from Coinbase
- Go to https://www.coinbase.com/settings/privacy-rights — Coinbase's data-request entry point.
- Privacy Rights Dashboard (coinbase.com/settings/privacy-rights): access / delete; Do Not Sell or Share opt-out; privacy@coinbase.com.
- Expected wait: self-serve Privacy Rights Dashboard for access / deletion; confirmation within 24h, up to 30 days to process; transaction export (CSV/PDF) from Account settings; BSA/AML retention up to ~5 years — Coinbase's stated turnaround (we haven't independently timed a request yet).
- No self-serve option, or want a formal request? Contact Coinbase — Privacy Rights Dashboard: mailto:privacy@coinbase.com.
These steps reflect Coinbase's documented process as of Jun 2026. The wait time is the company's stated figure, not yet independently measured by us.