TD Bank (TD Bank, N.A.), the U.S. retail-banking arm of Canada's Toronto-Dominion Bank (TSX/NYSE: TD), operates as "America's Most Convenient Bank" across the U.S. Northeast and Southeast. Its Online Privacy Notice discloses standard-bank collection (SSN, account/transaction data, device and browser identifiers, mobile advertising IDs, location, contacts and photos via app permissions) and sharing with service providers, affiliates for marketing, other financial institutions, and, with consent, third-party fintech apps and data aggregators. Its California CCPA notice affirmatively states TD has not sold or shared personal information in the preceding 12 months, and the TD Bank (US) App Store privacy label lists only "Data Not Linked to You" categories used for analytics and TD's own advertising/marketing, with no identity-linked or third-party-advertising category disclosed. Ownership is traceable through SEC 40-F filings naming the Toronto-Dominion Bank's U.S. subsidiary chain. Track record includes a September 2024 CFPB order requiring TD Bank to pay $28 million after the bank systemically furnished inaccurate consumer credit information to reporting agencies for several years; separately, TD Bank's Canadian parent and U.S. subsidiaries reached a roughly $3 billion resolution with DOJ, FinCEN, and the OCC in October 2024 over anti-money-laundering compliance failures — a bank-secrecy/compliance matter distinct from consumer-data handling, noted here for context rather than scored on.
TRACK RECORD
1 ENFORCEMENT ACTION
[2024-09-11]
The CFPB's September 11, 2024 order states its investigation found that for several years TD Bank repeatedly gave inaccurate account information -- including systemic errors about personal bankruptcies and credit card delinquencies, and information it knew or suspected was fraudulent -- to consumer reporting companies, resulting in $7.76 million in redress to consumers and a $20 million civil money penalty.
TD Bank's Online Privacy Notice states it may collect personal information such as name, mailing address, phone number, email address, account number, date of birth and Social Security number when a user fills out an online form, registers, logs in, or updates an account through its online services.
The Toronto-Dominion Bank's Annual Information Form (filed as Exhibit 99.1 to its Form 40-F with the SEC) describes its U.S. Retail segment as including TD Bank, and separately names TD Group U.S. Holdings LLC, TD Bank U.S. Holding Company, TD Bank, N.A., and TD Bank USA, N.A. as entities within its corporate structure.
TD's California Privacy Notice states TD has not sold or shared personal information in the preceding 12 months and does not sell or share personal information of minors under 16, while still offering a "Do Not Sell or Share My Personal Information" opt-out mechanism under the CCPA.
TD Bank's Online Privacy Notice states it may share personal information for everyday business purposes with third parties, its service providers, its affiliates (for the affiliates' own advertising and marketing), other financial institutions that jointly offer products, and, with consent, third-party fintech apps and data aggregators.
The CFPB's September 11, 2024 order states its investigation found that for several years TD Bank repeatedly gave inaccurate account information -- including systemic errors about personal bankruptcies and credit card delinquencies, and information it knew or suspected was fraudulent -- to consumer reporting companies, resulting in $7.76 million in redress to consumers and a $20 million civil money penalty.
The TD Bank (US) App Store privacy label (developer: TD Bank, N.A.) lists only a "Data Not Linked to You" category -- Location, Usage Data, and Identifiers -- used for the developer's own Advertising or Marketing, Analytics, and App Functionality purposes; the label shows no "Data Linked to You" or "Data Used to Track You" section.
TD Bank's Online Privacy Notice states it associates collected information using unique identifiers such as IP address, customer ID, visitor ID, unique device identifier, and mobile advertising identifier, by using cookies and other tracking technologies to track activity across its online services and associate a user's computer(s) and mobile device(s) with one another.