Privacy notice for California residents
This privacy notice for California residents (notice) supplements the information contained in the privacy notices of The Vanguard Group, Inc. and its U.S. affiliates and subsidiaries (collectively, Vanguard or us), and applies solely to residents of the State of California (you). We provide this notice to comply with the California Consumer Privacy Act, as modified by the California Privacy Rights Act of 2020 (CCPA) and the regulations issued under it; accordingly, this notice addresses the specific requirements of the CCPA and should be read together with the other Vanguard privacy notices that apply based on your relationships with us. Any terms defined in the CCPA have the same meaning when used in this notice; that may differ from what those terms mean when we use them in other policies or disclosures.
1. Summary
The CCPA provides specific privacy rights to California residents, including the right to receive a privacy notice and certain rights you may choose to exercise relating to your personal information. Personal information is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular person or household. Personal information does not include aggregate or deidentified information or publicly available information.
This notice does not apply to all personal information we may collect about you. For example, it does not cover information we obtain in connection with providing financial products or services to our Personal Investor clients primarily for personal, family, or household use. Rather, that information is protected under federal law through the Gramm-Leach-Bliley Act. For further information, please review our Personal Investor Privacy Notice. This notice also does not apply to personal information we collect about employees or job applicants. Please see our separate California employee and job applicant notices for more information.
2. How we collect and disclose personal information
The tables below explain the categories of personal information we collect from California residents generally, the sources of that information, the purposes for which we use the information, and the categories of unaffiliated parties to whom we disclose the information for business or commercial purposes. In the tables, we use the term everyday business purposes to encompass the business purposes defined in the CCPA, as well as the following related purposes for which Vanguard may use personal information:
- To provide the information, product, or service you request or as you may reasonably expect given the context in which we collect the personal information (such as providing client service, personalization, and preference management; providing updated product and service information; and dispute resolution);
- For identity and credential management, including identity verification and authentication and system and technology administration;
- To protect the security and integrity of our systems, networks, applications, and data, including detecting, analyzing, and resolving security threats, and collaborating with cybersecurity centers, consortia, and law enforcement about imminent threats;
- For fraud detection and prevention;
- For legal and regulatory compliance, including all uses and disclosures of personal information required by law or reasonably needed for compliance with our policies and procedures, such as: anti-money laundering programs, security and incident response programs, intellectual property protection programs, and corporate ethics and compliance hotlines;
- For corporate audit, analysis, and reporting;
- To enforce our contracts and to protect against injury, theft, legal liability, fraud, or abuse, and to protect people or property, including physical security programs;
- To deidentify personal information or create aggregated datasets, such as for consolidating reporting, research, or analytics;
- To make back-up copies for business continuity and disaster recovery purposes; and
- For corporate governance, including mergers, acquisitions, and divestitures.
Additional information about how we share personal information for cross-context behavioral advertising and your right to opt out is included in Section 8, below.
Categories, sources, and purposes
We collect this type of information from:
- You
- Your employer
- Independent financial advisors
- Assigned by us
- Other financial institutions involved in processing your transactions (for example, your bank)
- Service providers that help us understand our clients, including data analytics providers, data brokers, data aggregators, and public records providers
- Automatically, such as when you use our websites or mobile applications
- Advertising networks
- Social networks
- Internet service providers
Sample data elements
- Full name, nicknames, or previous names (such as maiden names)
- Honorifics and titles, preferred form of address
- Client ID
- Mailing address
- IP address
- Email address
- Social Security or other taxpayer identification number
- Passport number
- Contact information for related persons, such as authorized users of your account
Business or commercial purposes for collecting and disclosing the personal information
- To identify and communicate with you
- To send transactional and account information (such as statements or confirmations)
- To send marketing communications, surveys, and invitations
- To personalize our communications and provide client service
- For marketing and advertising
- To better understand our clients and prospective clients and to enhance our relationship information
- For our everyday business purposes
Categories of unaffiliated parties to whom we disclose this category of personal information for a business or commercial purpose
- Service providers that we use to support our business and operations (such as address verification, processing transactions, communications, technical support, security and fraud prevention, non-behavioral advertising, analytics, public relations, social media, marketing services, promotions, call centers, web hosting, monitoring and related services, and event-related services)
- Other unaffiliated parties (including government agencies, lawyers, auditors, and consultants) as required by law, or when needed to protect our legal rights or those of others
Personal Records, including the information described in Cal. Civ. Code § 1798.80(e). We collect this type of information from:
- You
- Your employer
- Other financial institutions involved in processing your transactions (for example, your bank)
- Service providers that help us understand our clients, including data analytics providers, data brokers, data aggregators, and public records providers
- Automatically, such as when you use our websites or mobile applications
- Advertising networks
- Social networks
- Internet service providers
Sample data elements
- Name
- Signature
- Social Security or other taxpayer identification number
- Passport number
- Address
- Phone number
- Driver’s license or state identification card number
- Insurance policy number
- Education
- Employment and employment history
- Bank account number, credit card number, debit card number, or other financial information
- Medical information
- Health insurance information
- Information concerning family members, beneficiaries, or dependents
Business or commercial purposes for collecting and disclosing the personal information
- To identify you
- To maintain the integrity of our records
- For client verification
- For security and risk management, fraud prevention, and similar purposes
- For marketing and advertising
- To better understand our clients and prospective clients and to enhance our relationship information
- For our everyday business purposes
Categories of unaffiliated parties to whom we disclose this category of personal information for a business or commercial purpose
- Service providers that we use to support our business and operations (such as address verification, processing transactions, communications, technical support, security and fraud prevention, non-behavioral advertising, analytics, public relations, social media, marketing services, promotions, call centers, web hosting, monitoring and related services, and event-related services)
- Other unaffiliated parties (including government agencies, lawyers, auditors, and consultants) as required by law, or when needed to protect our legal rights or those of others
We collect this type of information from:
- You
- Service providers that help us understand our clients, including data analytics providers, data brokers, data aggregators, and public records providers
- Social networks
We may also infer information about you based on information you have given us and on your past interactions with us and other companies. See Inferences below.
Sample data elements
- Age and date of birth, gender, marital and family status, and languages spoken
- Household demographic data, including from real estate records and census data
Business or commercial purposes for collecting and disclosing the personal information
- To better understand you and to understand our clients generally
- To design products, services, and programs that may be of interest to our clients
- To identify prospective clients
- For internal business purposes, such as quality control, training, and analytics
- For our everyday business purposes
Categories of unaffiliated parties to whom we disclose this category of personal information for a business or commercial purpose
- Service providers that we use to support our business and operations (such as processing transactions, communications, security and fraud prevention, analytics, research and development, call centers, and event-related services)
- Other unaffiliated parties (including government agencies, lawyers, auditors, and consultants) as required by law, or when needed to protect our legal rights or those of others
We collect this type of information from:
- You
- Other financial institutions involved in processing your transactions (for example, your bank)
- Service providers that help us understand our clients, including data analytics providers, data brokers, data aggregators, and public records providers
- Automatically, such as when you use our websites or mobile applications
Sample data elements
- Client account information, transaction history, and related records (such as records of purchases and sales of securities)
- Client service records
- Data from public social media profiles, such as Facebook, Twitter, LinkedIn, and similar platforms
- Hobbies and interests
- Other records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies
Business or commercial purposes for collecting and disclosing the personal information
- To maintain our business relationship with you, including client service
- For marketing and advertising
- To better understand our clients and prospective clients and to enhance our relationship information
- For recordkeeping and compliance, including dispute resolution
- For internal business purposes, such as finance, quality control, training, reporting, and analytics
- For risk management, fraud prevention, and similar purposes
- For our everyday business purposes
Categories of unaffiliated parties to whom we disclose this category of personal information for a business or commercial purpose
- Service providers that we use to support our business and operations (such as processing transactions, technical support, security and fraud prevention, non-behavioral advertising, analytics, research and development, public relations, social media, marketing services, promotions, call centers, web hosting, monitoring and related services, and event-related services)
- Other unaffiliated parties (including government agencies, lawyers, auditors, and consultants) as required by law, or when needed to protect our legal rights or those of others
We collect this type of information from:
- You and from your devices when you interact with our websites and mobile applications. For example, when you visit our websites, our server logs record your IP address and other information.
- Automatically, via technologies such as operating systems, cookies, and web beacons, when you visit our websites or mobile applications
- Service providers, including computer security services, digital advertising providers, and data analytics providers
Sample data elements
- IP address
- Device identifiers or other persistent identifiers
- Online user name
- Encrypted password
- Device characteristics (such as browser information)
- Web server logs
- Application logs
- Browsing data and search history
- First-party cookies
- Third-party cookies
- Web beacons, clear GIFs, and pixel tags
Business or commercial purposes for collecting and disclosing the personal information
• For system administration and technology management, including optimizing our websites and applications
• For information security and cybersecurity purposes, including detecting threats
• For recordkeeping, including logs and records maintained as part of transaction and interaction information
• To better understand our clients and prospective clients and to enhance our relationship information, including by associating you with different devices and browsers you may use
• For marketing and advertising purposes
• For our everyday business purposes
Categories of unaffiliated parties to whom we disclose this category of personal information for a business or commercial purpose
• Service providers that we use to support our business and operations (such as processing transactions, communications, technical support, security and fraud prevention, non-behavioral advertising, analytics, research and development, public relations, social media, marketing services, promotions, call centers, web hosting, monitoring and related services, and event-related services)
• Other unaffiliated parties (including government agencies, lawyers, auditors, and consultants) as required by law, or when needed to protect our legal rights or those of others
We collect this type of information from:
- You
- Automatically, such as when we record calls to our client service center, use CCTV cameras in our facilities, or communicate with you via videoconferencing software
- Social media
- Data providers that aggregate information you make publicly available, such as on social media sites
Sample data elements
- Video images
- CCTV recordings
- Call center recordings and call monitoring records
- Voicemails
- Videoconference information
- Your general geographic location (for example, city, state, and zip code)
Business or commercial purposes for collecting and disclosing the personal information
- For internal business purposes, such as call recordings used for training, coaching, or quality control
- For relationship purposes, such as the use of photos and videos for social media purposes (with your permission)
- For premises security purposes and loss prevention
- For information security and fraud prevention
- To better understand our clients and prospective clients and to enhance our relationship information
- For our everyday business purposes
Categories of unaffiliated parties to whom we disclose this category of personal information for a business or commercial purpose
- Service providers that we use to support our business and operations (such as processing transactions, communications, technical support, security and fraud prevention, non-behavioral advertising, analytics, research and development, public relations, social media, marketing services, promotions, call centers, web hosting, monitoring and related services, and event-related services)
- Other unaffiliated parties (including government agencies, lawyers, auditors, and consultants) as required by law, or when needed to protect our legal rights or those of others
We collect this type of information from:
- We determine your general geographic location automatically from your IP address when you use our online services. We collect this information from device operating systems and from data analytics providers.
Sample data elements
- Your general geographic location (for example, city, state, and zip code)
Business or commercial purposes for collecting and disclosing the personal information
- For information security and fraud prevention
- To better understand our clients and prospective clients and to enhance our relationship information
- For our everyday business purposes
Categories of unaffiliated parties to whom we disclose this category of personal information for a business or commercial purpose
- Service providers that we use to support our business and operations (such as processing transactions, communications, technical support, security and fraud prevention, non-behavioral advertising, analytics, research and development, public relations, social media, marketing services, promotions, call centers, web hosting, monitoring and related services, and event-related services)
- Other unaffiliated parties (including government agencies, lawyers, auditors, and consultants) as required by law, or when needed to protect our legal rights or those of others
We collect this type of information from:
- You
- Service providers, including companies that help us conduct internal investigations or assist us with identity verification
Sample data elements
- Compliance program data, including client screening records, and other records maintained to demonstrate compliance with applicable laws, such as tax laws and anti-money laundering laws
- Occupational and environmental safety records
- Records relating to complaints and internal investigations, including compliance hotline reports
- Records of privacy and security incidents involving personal information, including any security breach notifications
Business or commercial purposes for collecting and disclosing the personal information
- To comply with and demonstrate compliance with applicable laws
- For legal matters, such as litigation and regulatory matters, including for use in connection with civil, criminal, administrative, or arbitral proceedings, or before regulatory or self-regulatory bodies, including service of process, investigations in anticipation of litigation, and execution or enforcement of judgments and orders
- For our everyday business purposes
Categories of unaffiliated parties to whom we disclose this category of personal information for a business or commercial purpose
- Government agencies, lawyers, auditors, consultants, and other unaffiliated parties as required by law, or when needed to protect our legal rights or those of others
We collect this type of information from:
- You
- Your employer
- Service providers that help us understand our clients, including data brokers and public records providers
Sample data elements
- Job title
- Employer name and industry
- Date of hire
Business or commercial purposes for collecting and disclosing the personal information
- To establish and maintain our business relationship with you, including processing purchases and sales of securities in your accounts
- For recordkeeping and compliance
Categories of unaffiliated parties to whom we disclose this category of personal information for a business or commercial purpose
- Service providers that we use to support our business and operations (such as processing transactions, communications, technical support, security and fraud prevention, non-behavioral advertising, analytics, public relations, social media, marketing services, promotions, call centers, and event-related services)
- Other unaffiliated parties (including government agencies, lawyers, auditors, and consultants) as required by law, or when needed to protect our legal rights or those of others
The personal information we collect includes the following categories of sensitive personal information. Note that the sensitive personal information we collect may vary depending on the nature of your interactions with us and may not include all the examples listed below. We do not use or disclose sensitive personal information for purposes to which the right to limit use and disclosure applies under the CCPA.
We collect this type of information from:
- You
- Your employer
Sample data elements
- Social Security or other taxpayer identification number
- Passport number
Business or commercial purposes for collecting and disclosing the personal information
- To identify you
- To maintain the integrity of our records
- For client verification
- For security and risk management, fraud prevention, and similar purposes
- For our everyday business purposes
Categories of unaffiliated parties to whom we disclose this category of personal information for a business or commercial purpose
- Service providers that we use to support our business and operations (such as processing transactions, communications, and security and fraud prevention)
- Other unaffiliated parties (including government agencies, lawyers, auditors, and consultants) as required by law, or when needed to protect our legal rights or those of others
We collect this type of information from:
- You, including as part of your transaction and interaction information
- Payment processors and other financial institutions
- Security and fraud prevention service providers
We may infer financial information about you (such as interest in certain products or services) based on your existing account status and transaction activity.
Sample data elements
- Bank account number(s) and details
- Your account numbers at other financial institutions
- Payroll information
Business or commercial purposes for collecting and disclosing the personal information
- To maintain our business relationship with you, including processing purchases and sales of securities in your accounts
- For recordkeeping and compliance, including dispute resolution
- For internal business purposes, such as finance, audits, training, reporting, and analytics
- For our everyday business purposes
Categories of unaffiliated parties to whom we disclose this category of personal information for a business or commercial purpose
- Service providers that we use to support our business and operations (such as processing transactions, communications, and security and fraud prevention)
- Other unaffiliated parties (including government agencies, lawyers, auditors, and consultants) as required by law, or when needed to protect our legal rights or those of others
We create inferred and derived information by analyzing our relationship and transactional information.
We also obtain inferred and derived information from third-party data suppliers—companies that collect demographic and other personal information to help with firms’ marketing and customer service activities.
Sample data elements
- Inferences drawn about you from your personal information, such as your preferences, financial products and services that may interest you, and your investing patterns and behaviors
- Propensities, attributes, and/or scores generated by internal analytics programs and used for information security and fraud prevention purposes, product and service development and improvement, and marketing
Business or commercial purposes for collecting and disclosing the personal information
- To better understand you and to understand our clients generally
- To design products, services, and programs that may be of interest to our clients
- To identify prospective clients
- For marketing and advertising
- For internal business purposes, such as quality control, training, and analytics
- For our everyday business purposes
Categories of unaffiliated parties to whom we disclose this category of personal information for a business or commercial purpose
- Service providers that we use to support our business and operations (such as security and fraud prevention, non-behavioral advertising, analytics, research and development, public relations, social media, marketing services, promotions, and web hosting, monitoring, and related services)
- Other unaffiliated parties (including government agencies, lawyers, auditors, and consultants) as required by law, or when needed to protect our legal rights or those of others
| Category and sources of personal information | Sample data elements | Business or commercial purposes for collecting and disclosing the personal information | Categories of unaffiliated parties to whom we disclose this category of personal information for a business or commercial purpose | ||
We collect this type of information from:
|
|
|
|
||
We collect this type of information from:
|
|
|
|
||
We collect this type of information from:
We may also infer information about you based on information you have given us and on your past interactions with us and other companies. See Inferred and derived information below. |
Household demographic data, including from real estate records and census data |
|
|
||
We collect this type of information from:
|
|
|
|
||
We collect this type of information from:
|
|
|
|
||
We collect this type of information from:
|
|
|
|
||
|
|
|
|
||
We collect this type of information from:
|
|
|
|
||
We collect this type of information from:
|
|
|
|
The personal information we collect includes the following categories of sensitive personal information. Note that the sensitive personal information we collect may vary depending on the nature of your interactions with us and may not include all of the examples listed below. We do not use or disclose sensitive personal information for purposes to which the right to limit use and disclosure applies under the CCPA.
| Category and sources of personal information | Sample data elements | Business or commercial purposes for collecting and disclosing the personal information | Categories of unaffiliated parties to whom we disclose this category of personal information for a business or commercial purpose |
|
We collect this type of information from:
We may infer financial information about you (such as interest in certain products or services) based on your existing account status and transaction activity |
|
|
|
|
We create inferred and derived information by analyzing our relationship and transactional information. We also obtain inferred and derived information from third-party data suppliers—companies that collect demographic and other personal information to help with firms’ marketing and customer service activities. |
|
|
|
3. How long we keep your personal information
We keep the categories of Personal Information described above for as long as necessary or permitted for the purposes described in this Notice or otherwise authorized by law. This generally means holding the information for as long as one of the following apply:
- Your personal information is reasonably necessary to manage our operations, to manage your relationship with us, or to satisfy another purpose for which we collected the information;
- Your personal information is reasonably necessary to carry out a disclosed purpose that is reasonably compatible with the context in which the personal information was collected;
- The personal information is reasonably necessary to protect or defend our rights or property (which will generally relate to applicable laws that limit actions in a particular case); or
- We are otherwise required or permitted to keep your personal information by applicable laws or regulations.
Where personal information is used for more than one purpose, we will retain it until the purpose with the latest period expires. For more information about our retention policies, please contact us using the contact details below.
4. Your rights
If you are a resident of California, you have the right to submit certain requests relating to your personal information as described below. In some circumstances—for example, with respect to employer-sponsored retirement plans—Vanguard is a service provider to other businesses and is not the proper party to respond directly to your privacy rights requests. If you are a retirement plan participant who would like to make a CCPA request, please submit your request directly to the Plan Sponsor using one of the methods it has designated for submitting such requests. Regardless of your relationship with us, Vanguard’s website and/or mobile app offer additional options for viewing, accessing, and updating your personal information.
5. The right to know
You have the right to request that we disclose certain information to you about our collection and use of your personal information. Once we receive and confirm your verifiable request, we will disclose the following to you (unless an exception applies):
- The categories of personal information we collected about you, including:
- The categories of sources for the personal information we collected about you.
- Our business or commercial purpose for collecting, selling, or sharing personal information.
- The categories of recipients to which we disclosed that personal information
- The categories of personal information that we sold, and for each category identified, the categories of third parties to which we sold that particular category of personal information.
- The categories of personal information that we disclosed for a business purpose, and for each category identified, the categories of recipients to which we disclosed that particular category of personal information.
- The specific pieces of personal information we collected about you.
6. The right to delete
You have the right to request that we delete personal information we collected from you, subject to certain exceptions.
7. The right to correct
If you believe that personal information we maintain about you is inaccurate, you have the right to request that we correct that information.
8. When we sell or share personal information and your right to opt out
Although we do not sell personal information in exchange for money, some of the ways in which we share personal information for advertising may be considered “sales” or “sharing” under the CCPA. We and our digital advertising providers collect certain information from your devices when you visit our websites, through cookies and other technologies, and when you use our mobile applications. This includes the following categories of personal information: Identifiers, Personal Records, Commercial Information, Internet or Other Electronic Network Activity Information, Geolocation Data, and Inferences. We share these categories of personal information with our digital advertising providers to deliver Vanguard ads that may be of interest to you. We do not have actual knowledge that we sell or share the personal information of California residents under 16 years of age.
The manner in which you may opt out of interest-based advertising may vary depending on your relationship with Vanguard. For further information visit our Privacy Center. When you access Vanguard’s U.S. Financial Advisors website (https://advisors.vanguard.com/), we will provide you with the ability to limit certain third-party data sharing related to Interest-Based Advertising with certain service providers. To limit this sharing, click here. When you complete this process, you will provide us with your email address. We will send you a validation code to the email address you specify, and once you confirm that validation code electronically, we will remove the email address you specified from third party sharing. If you have more than one email address on file with us, you will need to complete this process for each email address on file to fully limit our sharing. By clicking on the “Manage Cookies” link at the bottom of Vanguard’s Financial Advisors, Institutional Investors, or Corporate websites, you may also further limit the collection of information by certain cookies, as well as the sharing of cookie information related to Interest-Based Advertising. Note that blocking some types of cookies may impact your experience of the site and the services we are able to offer. To learn more, visit our Privacy Center.
9. Non-discrimination
If you choose to exercise any of your privacy rights under the CCPA, you also have the right not to receive discriminatory treatment by us.
10. How to submit a CCPA rights request
If you are a California resident, you may exercise the rights described above by submitting a verifiable request to us by either:
- Visiting our Privacy Center; or
- Calling us:
- Retirement plan participants 877-637-5832
- Institutional investors 888-568-0464
- Financial professionals 855-638-8057
- Vanguard worker (e.g., current, former employee, job applicant, or contractor) 888-364-1453
If you have an account with us, please have your account information available when you call or log in to our secure website to facilitate verification for requests to know, requests to correct, and requests to delete.
If you do not have an account or are unable to log in, you will be asked to provide 2-3 pieces of personal information that we will match against our records to verify your identity.
11. Authorized Agents
You may designate an authorized agent to make a request on your behalf; however, you will still need to verify your identity directly with us before your request can be processed. An authorized agent may submit a request on your behalf using the webform or toll-free number listed in Section 10 above.
12. Changes to this notice
We reserve the right to amend this notice at our discretion and at any time.
13. Contact Information
If you have any questions relating to this notice or how we handle your personal information, please email us at privacy@vanguard.com. This email link is for privacy related issues. If you need assistance with your existing account, please click here for contact information. You may also call us at the phone numbers listed in Section 10 above.
Revised June 2024