Skip to content
Credit Karma
FINANCE & FINTECH
LAST UPDATED 4 AUG 2026
28
OF 100
PARANOIA SCORE
F
EDITORIAL OPINION · HOW WE SCORE ›

WHAT THE POLICIES SAY

Credit Karma is a free credit-monitoring service owned by Intuit, which acquired it for $7.1 billion in a deal cleared in late 2020 only after the DOJ required divestiture of Credit Karma Tax to Square. Members grant access to their TransUnion and Equifax credit reports plus identity data including Social Security numbers; the FTC has described the company as amassing over 2,500 data points per consumer. Its openly disclosed business model analyzes that data to recommend credit cards, loans, and insurance from bank and lender partners who typically pay a commission on approval. Data practices are governed by Intuit's Global Privacy Statement, which permits combining information across Intuit products and uses session-replay tools, while stating personal information is not sold for monetary consideration. In January 2023 the FTC finalized a $3 million consent order over allegedly deceptive 'pre-approved' credit offers.

TRACK RECORD

2 ENFORCEMENT ACTIONS
[2023-01-23]
On January 23, 2023, following a public comment period, the FTC finalized a consent order (approved 4-0) settling charges over Credit Karma's 'pre-approved' claims; the order requires the company to pay $3 million for distribution to affected consumers and to stop making these types of deceptive claims.
ftc.gov ↗
[2022-09-01]
On September 1, 2022, the FTC announced an enforcement action alleging that Credit Karma deployed dark patterns to misrepresent that consumers were 'pre-approved' for credit card offers from February 2018 to April 2021, causing consumers to incur hard inquiries on their credit reports; the proposed order required a $3 million payment and a halt to the challenged claims.
ftc.gov ↗

TIMELINE

NO ENTRIES ON FILE YET.

TOOLS WE RECOMMEND

PLUS

RECEIPTS

15 ON FILE
[2020-12-14] · COLLECTION
The service's policy indicates this service claims that your personal data is not being sold.
creditkarma.com ↗
[2022-09-01] · COLLECTION
In its September 1, 2022 press release announcing an enforcement action, the FTC stated that using Credit Karma's services requires consumers to provide personal information allowing the company to amass over 2,500 data points per consumer, including credit and income information, which it uses to send targeted advertisements and financial-product recommendations.
ftc.gov ↗
[2026-03-09] · COLLECTION
The Intuit Global Privacy Statement (last updated March 9, 2026), which governs Credit Karma, states that credit reports and scores are requested on members' behalf from credit bureau partners TransUnion, Experian, and Equifax, and that these partners may also provide employment or income data, Social Security numbers, and vehicle or driver information.
creditkarma.com ↗
OWNERSHIP TRANSPARENCY
Credit Karma's 'How it works' page plainly discloses in its FAQ that Credit Karma is part of the Intuit family of companies alongside QuickBooks, Mailchimp, and TurboTax, while operating as a distinct entity with its own brand.
creditkarma.com ↗
[2020-11-25] · OWNERSHIP TRANSPARENCY
A U.S. Department of Justice press release dated November 25, 2020 announced that Intuit was required to divest Credit Karma's tax business, Credit Karma Tax, to Square Inc. in order to proceed with its $7.1 billion acquisition of Credit Karma, resolving a DOJ antitrust complaint over digital do-it-yourself tax preparation competition.
web.archive.org ↗
[2025-09-03] · OWNERSHIP TRANSPARENCY
Intuit Inc.'s Form 10-K for fiscal year 2025 (filed with the SEC on September 3, 2025) reports Credit Karma as a named business segment offering credit scores and reports, credit and identity monitoring, and personalized recommendations of credit card, loan, and insurance products.
sec.gov ↗
SHARING
Credit Karma's 'Our Security Practices' page states that the company does not sell members' personal information to, or share it with, unaffiliated third parties for those parties' own advertising or marketing purposes.
creditkarma.com ↗
SHARING
Credit Karma's own 'How it works' page states that the company analyzes member data to recommend financial products such as credit cards and loans, and that when a member applies for and is approved for a recommended product, the bank or lender typically pays Credit Karma a commission.
creditkarma.com ↗
[2020-12-14] · SHARING
The service's policy indicates information is gathered about you through third parties.
creditkarma.com ↗
[2024-11-08] · SHARING
The service's policy indicates sensitive data is collected and shared to target advertising.
creditkarma.com ↗
[2026-03-09] · SHARING
The Intuit Global Privacy Statement (March 9, 2026) states that data users share is used across the Intuit Platform — combining, for example, QuickBooks bookkeeping details, Mailchimp contact and purchase-history details, TurboTax information (with consent where required), and Credit Karma recommendations — while also stating that Intuit, Mailchimp and Credit Karma do not otherwise 'sell' personal information to third parties for monetary consideration.
creditkarma.com ↗
TRACK RECORD
Credit Karma publishes a security practices page describing encryption of data in transit and at rest, a dedicated incident-response team, independent third-party vulnerability assessments, an external bug bounty program, ISO 27001 review of its systems, and SOC 2 compliance.
creditkarma.com ↗
[2022-09-01] · TRACK RECORD
On September 1, 2022, the FTC announced an enforcement action alleging that Credit Karma deployed dark patterns to misrepresent that consumers were 'pre-approved' for credit card offers from February 2018 to April 2021, causing consumers to incur hard inquiries on their credit reports; the proposed order required a $3 million payment and a halt to the challenged claims.
ftc.gov ↗
[2023-01-23] · TRACK RECORD
On January 23, 2023, following a public comment period, the FTC finalized a consent order (approved 4-0) settling charges over Credit Karma's 'pre-approved' claims; the order requires the company to pay $3 million for distribution to affected consumers and to stop making these types of deceptive claims.
ftc.gov ↗
[2026-03-09] · TRACKING TECH
The Intuit Global Privacy Statement (March 9, 2026) discloses use of cookies, web beacons, pixels, and session-replay technologies from FullStory and Medallia that record users' clicks, mouse movements, scrolls, and keystrokes for video replay; it also states that users with a recognized browser opt-out mechanism (such as Global Privacy Control) enabled are automatically opted out of tracking for targeted advertising.
creditkarma.com ↗

DATA SOURCES

ToS;DR
CC BY-SA · TOSDR.ORG ↗
Claims are summarized from these sources and may be edited from the original. Text adapted from a CC BY-SA source is shared under CC BY-SA.
LAST REVIEWED 2026-08-04 · METHODOLOGY v1.7
HOME
TOP RATED
CITY
WATCHING