Vanguard (The Vanguard Group, Inc.) is a U.S. asset manager and brokerage, unusual among peers for its client-owned mutual structure: Vanguard is owned by its funds, which are in turn owned by fund shareholders, rather than by outside stockholders. Its GLBA privacy notice discloses standard financial-account data collection and answers "Yes" to sharing for everyday-business, marketing, and joint-marketing purposes, but notably answers "No"/"We don't share" for nonaffiliate marketing and affiliates' creditworthiness sharing — narrower than some bank peers. Its online privacy policy and CCPA notice disclose third-party cookies, web beacons, and Interest-Based Advertising routed through the Digital Advertising Alliance, and the Vanguard App Store privacy label confirms Purchase History and Search History are used for the developer's own advertising/marketing. Ownership is self-disclosed plainly on Vanguard's own site rather than traceable through SEC 10-K filings (Vanguard itself is privately/mutually held, not publicly traded). In January 2025 the SEC ordered Vanguard to pay $106.41 million over misleading statements about capital-gains tax consequences of target-date retirement funds — an investor-protection matter, not a data-privacy incident, and no privacy-specific breach or enforcement action was found.
TRACK RECORD
1 ENFORCEMENT ACTION
[2025-01-17]
The SEC's press release (Release 2025-21, January 17, 2025) states that The Vanguard Group, Inc. will pay $106.41 million to settle charges for misleading statements related to capital gains distributions and tax consequences for retail investors who held Vanguard Investor Target Retirement Funds in taxable accounts — an investor-protection order, not a data-privacy or security enforcement action.
The Vanguard mobile app's App Store privacy label (self-reported by The Vanguard Group, Inc.) lists Purchases, Financial Info, Location, User Content, Search History, Identifiers, Usage Data, and Diagnostics as data categories collected and linked to the user's identity.
Vanguard's Personal Investor Privacy Notice (GLBA notice, rev. September 2023) states that the personal information Vanguard collects and shares depends on the product or service, and can include Social Security number and income, transaction or loss history and account transactions, and assets and investment experience.
Vanguard's own investor corporate-portal page states that Vanguard is owned by the mutual funds it manages, which are in turn owned by the funds' shareholders — the client-owned mutual structure underlying the company.
Vanguard's 'Do not sell or share my personal information for California residents' page states Vanguard does not sell personal information for payment or other compensation, while separately disclosing that Vanguard and its digital advertising providers collect cookie IDs, advertising IDs, and device IDs from site visitors for advertising purposes, which CCPA classifies as a 'share.'
Vanguard's GLBA notice states it does not share for affiliates' creditworthiness purposes or for nonaffiliates to market to customers ('We don't share' for both), while still sharing for affiliates' everyday-business purposes covering transactions and experiences.
The SEC's press release (Release 2025-21, January 17, 2025) states that The Vanguard Group, Inc. will pay $106.41 million to settle charges for misleading statements related to capital gains distributions and tax consequences for retail investors who held Vanguard Investor Target Retirement Funds in taxable accounts — an investor-protection order, not a data-privacy or security enforcement action.
Vanguard's Online Privacy Notice states that Vanguard uses cookies, web beacons, and other tracking technologies, and works with advertising service providers to deliver advertising services that are customized based on users' online activities over time and across unaffiliated websites, described as Interest-Based Advertising.
The Vanguard App Store privacy label discloses a 'Developer's Advertising or Marketing' purpose that uses Purchase History and Search History data collected and linked to the user's identity.