Coinbase

FINANCE & FINTECH

LAST UPDATED 4 AUG 2026

OF 100

PARANOIA SCORE

WHAT THE POLICIES SAY

Coinbase is a publicly traded US cryptocurrency exchange (Coinbase Global, Inc., Nasdaq: COIN). As a regulated financial service it collects extensive identity data — government-issued ID documents, Social Security numbers, biometric information from verification photos or videos, and employment and source-of-funds details — and analyzes public blockchain activity. Its privacy policy permits disclosure to law enforcement and tax authorities; the company reported 12,716 government and law-enforcement requests in its 2025 Transparency Report, and it has sold its Tracer blockchain-analytics software to US agencies including ICE. It shares conversion data, including IP addresses, with advertisers such as Meta and AppLovin. Its record includes a 2021 SMS two-factor flaw affecting at least 6,000 customers and a May 2025 insider-bribery breach disclosed in an SEC 8-K.

TRACK RECORD

2 ENFORCEMENT ACTIONS

[2025-05-14]

In a Form 8-K filed with the SEC (Item 1.05, Material Cybersecurity Incident, date of report May 14, 2025), Coinbase disclosed that a threat actor obtained customer data and internal documentation by paying multiple overseas support contractors or employees, demanded money not to publicly disclose the information, and that Coinbase did not pay the demand; the company preliminarily estimated $180 million to $400 million in remediation costs and voluntary customer reimbursements.

sec.gov ↗

[2021-09-24]

In a customer notification letter dated September 24, 2021 and filed with the California Attorney General, Coinbase disclosed that between March and May 20, 2021, third parties exploited a flaw in its SMS Account Recovery process to bypass SMS two-factor authentication and that at least 6,000 Coinbase customers had funds removed from their accounts; Coinbase stated it deposited funds equal to the value improperly removed and updated its SMS Account Recovery protocols.

oag.ca.gov ↗

TIMELINE

NO ENTRIES ON FILE YET.

TOOLS WE RECOMMEND

PLUS

RECEIPTS

13 ON FILE

[2020-12-15] · COLLECTION

The service's policy indicates information is provided about how your personal data is used.

coinbase.com ↗

[2026-05-27] · COLLECTION

Coinbase's Global Privacy Policy (last updated May 27, 2026) lists identity-verification data collected from customers, including government-issued identity documents such as passports and driver's licenses, Social Security or social insurance numbers, employment and salary information, proof of residency, and biometric information generated from photos or videos submitted for identity verification.

web.archive.org ↗

[2020-12-15] · OWNERSHIP TRANSPARENCY

The service's policy indicates your data may be processed and stored anywhere in the world.

coinbase.com ↗

[2026-02-12] · OWNERSHIP TRANSPARENCY

Coinbase Global, Inc.'s Form 10-K for fiscal year 2025, filed with the SEC on February 12, 2026, documents its corporate structure: Coinbase, Inc. was incorporated in Delaware in May 2012, Coinbase Global, Inc. was incorporated in January 2014 as the Delaware holding company for Coinbase, Inc. and other subsidiaries, and its Class A common stock trades on Nasdaq under the symbol COIN.

sec.gov ↗

[2020-12-15] · SHARING

The service's policy indicates information is gathered about you through third parties.

coinbase.com ↗

[2022-06-29] · SHARING

The Intercept reported on June 29, 2022, based on contract documents released via a Freedom of Information Act request, that Coinbase sold its Coinbase Tracer blockchain-analytics software to US Immigration and Customs Enforcement — a single analytics license in August 2021 for $29,000 followed by a purchase potentially worth $1.36 million — with contract features listed as including multi-hop link analysis, transaction demixing, and historical geo tracking data.

theintercept.com ↗

[2025-12-01] · SHARING

Coinbase's seventh annual Transparency Report, published December 1, 2025, discloses that the company received 12,716 requests for customer information from government agencies and law enforcement between October 1, 2024 and September 30, 2025 — a ~19% increase over the prior year, with ~53% of requests originating outside the United States.

web.archive.org ↗

[2026-05-27] · SHARING

Coinbase's Global Privacy Policy (last updated May 27, 2026) permits the company to access, preserve, and disclose customer information when it believes doing so is reasonably necessary to comply with law, law-enforcement and governmental requests, court orders, or for disclosure to tax authorities.

web.archive.org ↗

TRACK RECORD

Coinbase's security page states that the company pays rewards for responsible disclosure of security vulnerabilities through its Bug Bounty program, and that as the largest publicly traded crypto company it publishes financial statements quarterly and is audited annually by an independent third party.

web.archive.org ↗

[2021-09-24] · TRACK RECORD

oag.ca.gov ↗

[2025-05-14] · TRACK RECORD

sec.gov ↗

TRACKING TECH

Coinbase's Cookie Policy states that Coinbase and companies it works with place cookies and similar technologies (web beacons, SDKs, pixels, mobile advertising identifiers, tags, local storage) on users' devices, and that its Google Analytics cookie (_gat_gtag) is used to surface targeted Coinbase ads on Google and measure conversion rates.

web.archive.org ↗

[2026-05-27] · TRACKING TECH

Coinbase's Global Privacy Policy (last updated May 27, 2026) states that, to help provide or promote its services, Coinbase discloses conversion data — including IP addresses — to advertisers such as Meta to create custom audience lists, and to AppLovin.

web.archive.org ↗

DATA SOURCES

ToS;DR

CC BY-SA · TOSDR.ORG ↗

Claims are summarized from these sources and may be edited from the original. Text adapted from a CC BY-SA source is shared under CC BY-SA.

LAST REVIEWED 2026-08-04 · METHODOLOGY v1.7