data report card

Data Report Card · Coinbase

Coinbase Data Report Card

Crypto exchange · Coinbase Global, Inc.
Data
Practices
2Access1Portability1Friction1Deletion1Sells1Trains AI
=
C
7/12
Agent
Readiness
2Access 1Portability 2API access
=
B
5/6

Agent Readiness is a derived signal — a synthesis of two existing cells (Access, Portability) plus one sourced factor (API access), not an independently measured grade. API access scale: Best (2) consumer-grantable API · Moderate (1) partial / encumbered · Restrictive (0) manual export only. What is Agent Readiness?

Help me make a request →
Reviewed Jun 2026 · policies are checked weekly for changes  ·  stated — every cell is read from Coinbase's published policy; none has been tested (run by us) yet.
2Accessstated
Coinbase provides a self-serve Privacy Rights Dashboard (coinbase.com/settings/privacy-rights) to request access to the personal information it holds, and confirms receipt within 24 hours, satisfying the access right.
Coinbase — How to access privacy settings and make requests · accessed Jun 2026 ↗
1Portabilitystated
You can self-serve export your transaction history as CSV or PDF from Account settings and request a broader data copy, but CSV is the only true machine-readable format offered (PDF is not structured), so portability is scored at the single-format level.
Coinbase — Data Privacy FAQ (transaction export) · accessed Jun 2026 ↗
1Frictionstated
Rights are exercised through a self-serve Privacy Rights Dashboard (no email queue), but actual completion takes up to 30 days — the 24-hour figure is only acknowledgment of receipt. Scored on real turnaround, not confirmation speed, so friction is at the moderate level.
Coinbase — How to access privacy settings and make requests · accessed Jun 2026 ↗
1Deletionstated
Coinbase honors deletion requests through the Privacy Rights Dashboard, but as a regulated money-services business it retains personal and transaction data (typically up to five years) to meet Bank Secrecy Act / anti-money-laundering obligations, so deletion is scored at the partial level.
Coinbase — Global Privacy Policy (retention) · accessed Jun 2026 ↗
1Sells / sharesstated
Coinbase does not sell data for money, but discloses identifiers to analytics and advertising partners which "may constitute a sale / share" under the CCPA; an opt-out is provided via the Do Not Sell or Share link, so sharing is scored at the partial level.
Coinbase — US Privacy Notice (Do Not Sell / Share) · accessed Jun 2026 ↗
1Trains AIstated
Coinbase's Global Privacy Policy makes no affirmative commitment against using personal data to train AI or machine-learning models; absent a clear no-training pledge, model-training use is scored conservatively at the partial level.
Coinbase — Global Privacy Policy (silent on AI training) · accessed Jun 2026 ↗
2API access — feeds Agent Readiness, not the /12stated
A consumer can grant an app OAuth 2.0 access to their Coinbase account data via the Coinbase App API (scopes such as wallet:user:read and wallet:transactions:read), with refresh tokens (offline_access) and revocation from account settings, so agent access is scored at the full level.
Coinbase — App OAuth2 access & refresh tokens · accessed Jun 2026 ↗
Reviewed Jun 2026 from Coinbase's Global Privacy Policy, US Privacy Notice, and Privacy Rights Dashboard help pages. All cells are "stated" (read from published policy), not tested. Coinbase is a regulated financial service: deletion is offered but heavy BSA/AML retention (up to ~5 years) applies, and it discloses identifiers to advertising partners (a CCPA "sale / share" with opt-out). The May 2025 support-contractor breach and the class actions / DOJ-SEC inquiries that followed are NOT recorded as enforcement, because no regulator or court judgment has issued.

How to request your data from Coinbase

  1. Go to https://www.coinbase.com/settings/privacy-rights — Coinbase's data-request entry point.
  2. Privacy Rights Dashboard (coinbase.com/settings/privacy-rights): access / delete; Do Not Sell or Share opt-out; privacy@coinbase.com.
  3. Expected wait: self-serve Privacy Rights Dashboard for access / deletion; confirmation within 24h, up to 30 days to process; transaction export (CSV/PDF) from Account settings; BSA/AML retention up to ~5 years — Coinbase's stated turnaround (we haven't independently timed a request yet).
  4. No self-serve option, or want a formal request? Contact Coinbase — Privacy Rights Dashboard: mailto:privacy@coinbase.com.

These steps reflect Coinbase's documented process as of Jun 2026. The wait time is the company's stated figure, not yet independently measured by us.

Help me make a request →