Banks (DMV) · Bank · Structural / no discrete incident
Capital One
Headline
Capital One lets you turn on a 'Datasharing' feature to connect your account to third-party apps — but the fine print says that once you do, YOUR OWN ACCOUNT DATA is now 'in the third party's control' and NO LONGER…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Capital One lets you turn on a 'Datasharing' feature to connect your account to third-party apps — but the fine print says that once you do, YOUR OWN ACCOUNT DATA is now 'in the third party's control' and NO LONGER covered by Capital One's own privacy policy. Capital One built the feature, encourages you to use it, and then walks away from responsibility for what happens to your data the moment you actually use it.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Historically one of only 3 major card issuers (with BofA, TD) WITHOUT forced arbitration in card terms (per Public Citizen 2024 review) — verify current deposit-account agreement to confirm this still holds, since issuers can reintroduce these clauses (a reported 2026 Bank of America change was not verified this pass). AUG 2026 FINDING (verify against your current cardmember agreement before relying on it): Capital One and Bank of America gave up credit-card arbitration clauses as part of a 2010 antitrust settlement, and reporting citing CFPB work indicates both CONTINUED to leave the clause out after the settlement period expired in 2013 — meaning there is no arbitration clause to opt out of, and no deadline to miss. Chase went the other way, reintroducing forced arbitration on many cards from Aug 11 2019 with a one-time opt-out that closed Aug 10 2019. This is a real and actionable difference between issuers, and it is exactly the kind of fact a cardholder would never find unaided. The source is 2020 reporting, so CONFIRM against the current agreement — issuers reintroduce these clauses, as Chase did.
Data sharing
Combines info from phone/email contacts, third-party data brokers (fraud/ID verification/marketing), co-brand card partners, and public sources; collects biometric data for authentication/fraud prevention; separate 'Datasharing' program lets you authorize sharing account data with named third-party apps, after which Capital One says the data is 'in their control' and no longer covered by CapOne's own policy.
Fees and billing
Standard card/deposit fee schedules; reported (not verified this pass against FDIC Summary of Deposits data) to be the largest bank by deposits in the DC metro so its terms affect an outsized share of DMV customers.
Contacts
Privacy contact. webinfo@capitalone.com (Do Not Call list: 1-888-817-2970)
Legal notice. PUBLIC COMPANY (COF). Service route: c/o General Counsel / Corporate Secretary, McLean, Virginia — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.
Mailing address. PRIVACY NOTICE ADDRESS (use this, not the HQ): Capital One, P.O. Box 30285, Salt Lake City, UT 84130-0285, USA. Corporate HQ is Capital One Financial Corp, 1680 Capital One Drive, McLean, VA 22102-3491 — the two differ, and the P.O. box is the one stated in the consumer privacy notice.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy capitalone.com/privacy/online-privacy-policy/ | Not fetched yet | NO (HTML only) |
| Terms of service capitalone.com/digital/corporate-terms/ (Online Banking T&Cs) | Not fetched yet | NO (HTML only) |
| Website capitalone.com | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
Headquarters on file: Virginia. Provisions of VCDPA on file:
| Provision | Type | Source |
|---|---|---|
| Applicability Threshold Va. Code § 59.1-576 | threshold | source |
| Right to Confirm and Access Va. Code § 59.1-577(A)(1) | hard | source |
| Right to Correction Va. Code § 59.1-577(A)(2) | hard | source |
| Right to Deletion Va. Code § 59.1-577(A)(3) | hard | source |
| Right to Data Portability Va. Code § 59.1-577(A)(4) | hard | source |
| Right to Opt Out of Sale, Targeted Advertising, and Profiling Va. Code § 59.1-577(A)(5) | hard | source |
| Right to Appeal Denied Request Va. Code § 59.1-577(C) | hard | source |
| Sensitive Data — Opt-In Consent Required Va. Code § 59.1-578(A)(5); § 59.1-575 (definitions) | hard | source |
| Privacy Notice Requirements Va. Code § 59.1-578(C) | hard | source |
| Processor Contract Requirements Va. Code § 59.1-579(B) | hard | source |
| Data Protection Assessment Va. Code § 59.1-580 | hard | source |
| Enforcement — AG Only; Civil Penalties Va. Code § 59.1-584 | hard | source |