Visa Inc · Privacy Policy

Visa U.S. State Privacy Supplementary Notice (Effective May 7, 2026)

This notice applies to U.S. residents in states with consumer privacy laws (like California's CCPA). It covers a specific slice of what Visa does — mainly information collected when you sign up for Visa marketing, attend Visa events, take surveys, use Visa-branded products like Click-to-Pay or Visa Payment Passkey, or browse Visa websites. It does not cover your payment transaction data, which is already regulated by federal financial privacy law.

Targeted advertising and cookies are the biggest practical issue here. Visa's websites may use cookies or similar tools that let advertising partners collect your data to show you personalized ads. On most Visa websites, this only happens with your consent, managed through a Cookie Preferences link at the bottom of each page. On U.S. Visa websites, Visa also honors Global Privacy Control (GPC) browser signals — if your browser sends one, Visa will treat it as an opt-out of ad tracking and only load strictly necessary cookies. If you clear your cookies or switch browsers, you'll need to re-enable GPC.

You have rights under applicable state law: access your data, correct it, delete it, and get a portable copy. You can also opt out of targeted advertising and (in some states) appeal a denial. To use these rights, visit the Privacy Rights Portal, call 1-844-909-1620, or email privacy@visa.com. Visa will verify your identity — usually by email — before acting on a request. One important limitation: if you're a cardholder wanting your transaction data, Visa says to contact your card issuer directly, since Visa often acts as a service provider and the issuer holds the direct relationship with you.

Visa does not sell your personal information for money. In 2024, Visa received 630 CCPA requests total and took an average of 26 days to respond. Most deletion and access requests were fulfilled; a small number were denied, mainly due to legal retention requirements.