Branch is a deep-linking and mobile attribution platform operated by Branch Metrics, Inc., a privately held, VC-backed company headquartered in Mountain View, California. Branch's own privacy policy states it does not collect or store sensitive end-user information (names, emails, physical addresses, SSNs) and that customers can only access 'earned' cookies or identifiers tied to actual end-user activity on their own apps or websites; the policy lists a table of collected identifiers including IDFA, IDFV, RIDA, Branch Cookie ID, IP address and device metadata used for 'device identification and attribution.' Branch's marketing security page states 'we do not rent or sell personal data,' while its own CCPA notice for California residents separately discloses that, in the preceding 12 months, it disclosed identifiers, device information, connection/usage data and general location to advertisers and ad networks, adding 'this may be considered "sharing" or a "sale" under the CCPA' — a notable tension between the marketing claim and the legal self-declaration. No breach or regulator action was found in this research; Branch names a Head of Security and a Data Protection Officer and states it uses 'independent third-party security programs.'
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
6 ON FILE
[2025-09-15] · COLLECTION
Branch's privacy policy states its Terms & Conditions prohibit customers from providing Branch with sensitive end-user information (names, emails, physical addresses, SSNs), and that customers can only access 'earned' cookies or identifiers — meaning an end user must first visit a customer's site or download a customer's app before Branch collects the corresponding identifier.
Branch's privacy policy identifies the operating legal entity as Branch Metrics, Inc., with a registered address of 1975 W El Camino Real Ste. 102, Mountain View, CA 94040; no public ownership filing was found, consistent with a privately held company.
Branch's own marketing security page states 'we do not rent or sell personal data,' framing itself as not being 'in the business of renting or selling any customer's end-user data' — a claim that sits in tension with the CCPA-defined sale/sharing disclosure to ad networks made in Branch's own legal notice.
Branch's CCPA notice for California residents states that in the preceding 12 months, Branch disclosed identifiers, device information/device identifiers, connection and usage data, and general location data about Website Users to advertisers and ad networks, and explicitly states this disclosure 'may be considered "sharing" or a "sale" under the CCPA.'
Branch's security page names a Head of Security and IT (Lester Chan) and a Data Protection Officer / Senior Product & Privacy Counsel (Ayisha Gelin), and states its secure software development lifecycle 'enforces diligent security reviews, secure coding practices, and continuous security testing using a mix of internal and external penetration tests and independent third-party security programs'; no breach disclosure or regulator action was found in this research.
Branch's privacy policy lists a data table of identifiers collected for device identification and attribution, including advertising identifiers (IDFA, IDFV, RIDA), a proprietary Branch Cookie ID, IP address, CPU type, system build version, and internet connection type.