Wells Fargo California Consumer Privacy Act Notice and Notice at Collection

Legal Rights & Agreement Rules · Context

Wells Fargo CCPA Notice at Collection scope and effective date

Wells Fargo provides this California Consumer Privacy Act Notice at Collection, effective August 13, 2026, explaining how it collects, uses, retains, and discloses personal information of California residents and describing their statutory rights under the CCPA.

Supporting quotations

Effective: August 13, 2026

(Last Reviewed: 08/13/2026)

This California Consumer Privacy Act Notice at Collection ("Notice") is provided by the Wells Fargo companies described below. These companies are referred to in this Notice as "we" or "us."

This Notice explains how we collect, use, retain, and disclose personal information about California residents. The Notice also explains certain rights that California residents have under the California Consumer Privacy Act (the “CCPA”).

Qualifications & exceptions

• Applies specifically to personal information of California residents.
• Effective August 13, 2026 and last reviewed August 13, 2026.

Cross-references

• defined by (model-proposed): Definition of Personal Data and inclusion of contractors as service providers — Defines the scope of Personal Data and contractor inclusion governed by the CCPA Notice at Collection.

Legal Rights & Agreement Rules · Company practice

Discretionary processing of privacy requests from non-California U.S. residents

Although the CCPA legally applies only to California residents, U.S. residents of other states may submit privacy requests which Wells Fargo may process at its discretion under CCPA standards. Wells Fargo applies identical limitations and exceptions to non-resident requests and reserves the right to modify or terminate this discretionary practice at any time except where prohibited by law.

Supporting quotations

The CCPA only applies to information about residents of California. If you are a resident of a U.S. state other than California, you may submit a request and we may process it, as described in this Notice, even though the CCPA does not require us to do so. In accepting, processing, and responding to requests by individuals who are not California residents, we will apply all the same limitations and exceptions under the CCPA to those requests as apply to requests made by California residents. We reserve the right to change or stop the practice of accepting requests from U.S. residents of states other than California, except as otherwise required by law.

Qualifications & exceptions

• The CCPA legally applies only to California residents; processing requests from other states is voluntary.
• Wells Fargo applies all statutory CCPA limitations and exceptions to non-resident requests.
• Wells Fargo reserves the right to modify or stop processing out-of-state requests at any time unless prohibited by law.

Legal Rights & Agreement Rules · Context

Definition of Personal Data and inclusion of contractors as service providers

Under the CCPA, personal information covers information identifying, relating to, describing, or reasonably linkable, directly or indirectly, with a California resident or household, referenced as Personal Data. Throughout the Notice, any reference to service providers includes contractors.

Supporting quotations

Under the CCPA, "personal information" is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household. This information is referred to in this Notice as "Personal Data." Similarly, any reference to “service providers” within this notice also includes “contractors.”

Qualifications & exceptions

• Encompasses information identifying, relating to, or reasonably linkable to a California resident or household.
• Service providers explicitly includes contractors.

Cross-references

• defines (model-proposed): Wells Fargo CCPA Notice at Collection scope and effective date — Defines the scope of Personal Data and contractor inclusion governed by the CCPA Notice at Collection.

Data Access & Collection · Company practice

Collection contexts and relationship-dependent scope of Personal Data

Wells Fargo collects Personal Data in multiple business contexts, including providing financial products and services, human resources administration, and vendor management. The specific categories and volume collected depend on the company's relationship and interactions with the individual.

Supporting quotations

We collect Personal Data in a variety of contexts. For example, we collect Personal Data to provide financial products and services, for our human resources, and for vendor management purposes.

The Personal Data that we collect about a specific California resident will depend on, for example, our relationship or interaction with that individual.

Qualifications & exceptions

• Contexts include financial products/services, human resources, and vendor management.
• Specific data collected varies based on individual relationship and interactions.

Data Access & Collection · Company practice

Categories of Personal Data collected in the preceding 12 months

During the past 12 months, Wells Fargo collected eleven standard categories of Personal Data: personal identifiers, personal contact and financial details, characteristics of protected classes, purchase and transaction records, biometric information, online and browsing activity, geolocation data, audio/visual recordings, employment-related information, education information under FERPA, and inferences reflecting preferences or characteristics.

Supporting quotations

During the past 12 months, we have collected the following categories of Personal Data.

Personal Identifiers — Personal unique identifiers, such as full name and federal or state issued identification numbers, including Social Security number, driver’s license number, and passport number

Personal Information — Personal information, including contact details (e.g., telephone number and address), financial information (e.g., account number and balance), payment card details (e.g., credit and debit card numbers), and medical and health insurance information

Characteristics of Protected Classes — Characteristics of protected classes or groups under state or federal law, such as sex, disability, citizenship, primary language, immigration status, and marital status

Purchase Information — Purchase information, such as products and services obtained and transaction histories

Biometric Information — Biometric information, such as fingerprints and voiceprints

Internet or Online Information — Internet or online information (e.g., browsing history), including information about interaction with our websites, applications, or advertisements

Geolocation Data — Geolocation data, such as device location

Audio and Visual Information — Audio, electronic, visual, thermal, olfactory, or similar information, such as call and video recordings

Employment Information — Professional or employment-related information, such as work history, information from background checks, resumes, and personnel files, personal qualifications, training, and work preference, payroll and benefit information, leave and absence information, and performance and disciplinary information

Education Information — Education information subject to the federal Family Educational Rights and Privacy Act, such as student records and confirmation of graduation

Inferences — Inferences based on information about an individual to create a summary about, for example, an individual’s preferences and characteristics

Qualifications & exceptions

• Covers the 12-month period preceding the notice date.
• Includes FERPA-subject education data, background check records, biometric voice/fingerprints, and inference profiles.

Data Access & Collection · Company practice

Categories of Sensitive Personal Information collected

Wells Fargo collects Sensitive Personal Information under California law, including government identification numbers (Social Security, driver's license, passport), account login credentials and financial account numbers with security codes, precise geolocation, racial or ethnic origin, religious beliefs, citizenship, union membership, contents of non-directed communications, uniquely identifying biometric data, and health or sexual orientation details.

Supporting quotations

Sensitive Personal Information — Includes:

Social Security number, driver’s license, state identification card, or passport number;

Account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account;

Precise geolocation;

Racial or ethnic origin, religious or philosophical beliefs, citizenship, immigration status, or union membership;

The contents of mail, email, and text messages unless we are the intended recipient of the communication;

Biometric information processed to uniquely identify an individual

Health information, sexual orientation.

Qualifications & exceptions

• Includes government ID numbers, financial access credentials, and precise geolocation.
• Covers mail, email, and text content where Wells Fargo is not the intended recipient.
• Includes protected sensitive classifications such as racial/ethnic origin, health info, and sexual orientation.

Data Access & Collection · Company practice

Categories of sources from which Personal Data is collected

Wells Fargo collects Personal Data from diverse categories of sources depending on the individual relationship: directly from California residents or their representatives (via physical forms, phone, websites, and social media); public records and government entities; third-party data providers for fraud prevention, underwriting, and marketing (including data brokers, advertising networks, and analytics providers); outside entities supporting human resources and workforce management; and outside commercial partners, financial institutions, and transaction parties supporting everyday banking operations, services, and corporate transactions.

Supporting quotations

The sources from which we collect Personal Data depend on, among other things, our relationship or interaction with a specific California resident. The information below lists the categories of sources from which we collect Personal Data in different contexts.

From California residents directly, or other individuals acting on their behalf, through, for example, physical (e.g., paper application), audible (e.g., phone), and electronic (e.g., website, social media) sources.

Public records or widely available sources, including information from the media, and information that is made available by federal, state, and local government entities.

Outside companies or organizations that provide data to support activities such as fraud prevention, underwriting, and marketing. Examples may include internet service providers, social networks, data brokers, advertising networks, and data analytics providers.

Outside companies or organizations from whom we collect Personal Data to support human resource and workforce management activities. Examples may include service providers and social networks.

Outside companies or organizations from whom we collect Personal Data as part of providing products and services, completing transactions, supporting our everyday operations, or business management and development. Examples include companies or organizations to whom we provide products or services; other parties, partners, and financial institutions; and parties involved with mergers, acquisitions, and other transactions involving transfers of all or part of a business, or a set of assets.

Qualifications & exceptions

• Sources depend on Wells Fargo's specific relationship and interaction with the California resident.
• Direct sources include paper applications, phone interactions, websites, and social media.
• Third-party commercial sources include data brokers, ad networks, analytics providers, and business transaction partners.

Use & Processing · Company practice

Purposes for collecting, using, and disclosing data to provide and manage products and services

Wells Fargo collects, uses, and discloses Personal Data to service providers to establish and process transactions for banking products (checking, credit cards, loans, investments, commercial financing, payments), maintain accounts, issue statements, provide online banking customer service, handle collections, and obtain support from third-party partners and financial institutions.

Supporting quotations

The purposes for which we collect, use, and disclose Personal Data depend on, among other things, our relationship or interaction with a specific California resident. The table below lists the purposes for which we collect, use, and disclose the categories of Personal Data, listed above in different contexts, to our service providers for various business purposes, as permitted by law.

Provide and manage products and services

Establish and process transactions for our products and services, including checking accounts, credit cards, loans, investment accounts, commercial financing, and payment services

Support the ongoing management and maintenance of our products and services, including to provide account statements, online banking access, customer service, payments and collections, and account notifications

Obtain support for fulfilling the above purposes from our third-party service providers, professional services and business partners, and financial institutions

Qualifications & exceptions

• Covers checking, credit cards, loans, investments, and payment processing.
• Includes disclosure to third-party service providers, partners, and financial institutions.

Use & Processing · Company practice

Purposes for data use supporting everyday operations, risk, legal, and compliance requirements

Wells Fargo uses and discloses Personal Data to support everyday operations, perform accounting and monitoring, conduct information security and anti-fraud operations, perform credit underwriting and due diligence, support audits and investigations, respond to legal demands, defend legal claims, comply with laws, manage IT and communications systems, and engage third-party service providers.

Supporting quotations

Support our everyday operations, including to meet risk, legal, and compliance requirements

Perform accounting, monitoring, and reporting

Enable information security and anti-fraud operations, as well as credit, underwriting and due diligence

Support audit and investigations and legal requests and demands, as well as exercise and defend legal claims

Enable the use of service providers for business purposes

Comply with laws, regulations, policies, procedures, and contractual obligations

Obtain support for fulfilling the above purposes from our third-party service providers, professional services and business partners, and financial institutions

Operate and manage IT and communications systems and facilities, and allocate company assets

Qualifications & exceptions

• Includes information security, fraud prevention, credit underwriting, and due diligence.
• Encompasses compliance with legal demands, audit requests, and defense of claims.

Not stated here

• The specific text of referenced laws, external policies, regulations, and contractual obligations is not supplied in this source document.

Sharing & Disclosure · Company practice

Sharing Personal Data for cross-context behavioral advertising, marketing, and business development

Wells Fargo uses Personal Data to market, develop, and improve products, conduct research, manage customer relationships, and evaluate mergers and acquisitions. This explicitly includes 'sharing' Personal Data with third parties for cross-context behavioral advertising (tailored advertising on third-party websites, apps, and services) and obtaining support from marketing and business partners.

Supporting quotations

Manage, improve, and develop our business

Market, personalize, develop, and improve our products and services

This includes “sharing” Personal Data for purposes of delivering tailored advertising on third party websites, applications or services (also known as cross-context behavioral advertising)

Conduct research and analysis, including for product and services innovation

Support customer relationship management

Evaluate and engage in mergers, acquisitions, and other transactions involving transfers of all or part of a business, or a set of assets

Obtain support for fulfilling the above purposes from our service providers and from our professional services, business, and marketing partners

Qualifications & exceptions

• Explicitly includes 'sharing' Personal Data for cross-context behavioral advertising on third-party platforms.
• Covers product improvement research, analytics, customer relationship management, and corporate M&A.

Cross-references

• referred to by (model-proposed): Procedures for Request to Opt-Out of Sharing and processing Global Privacy Control signals — Provides the mechanism and preference signal processing for consumers to opt out of cross-context behavioral advertising sharing.

Use & Processing · Company practice

Purposes for collecting and processing data for employment, HR, and facilities management

Wells Fargo processes Personal Data for human resources and workforce administration, including employee recruitment, onboarding, compensation and benefits administration (healthcare, retirement), attendance tracking, facility security and monitoring, internal investigations and disciplinary proceedings, business continuity planning, and IT system allocation.

Supporting quotations

Support employment, infrastructure, and human resource management

Provide benefits to employees and dependents, including healthcare and retirement plans

Manage pay and compensation activities

Manage attendance, time keeping, leaves of absence, and vacation

Manage and operate our facilities and infrastructure, including conducting risk and security control and monitoring activities

Recruit new employees, process employment applications, and onboard new employees

Perform identity verification, accounting, budgeting, audit, and other internal functions, such as internal investigations, disciplinary matters, and handling grievances and terminations

Operate and manage IT and communications systems and facilities, allocate company assets and human resources, and undertake strategic planning and project management

Conduct research, analytics, and data analysis, such as to assist in succession planning and to ensure business continuity

Obtain support for fulfilling the above purposes from our third-party service providers, professional services and business partners

Qualifications & exceptions

• Applies to workforce, job applicants, employees, and their dependents.
• Includes background checks, grievance handling, and facility security monitoring.

Use & Processing · Company practice

Statutory permitted purposes for collecting and processing Sensitive Personal Information

Wells Fargo collects, uses, and discloses personal information and Sensitive Personal Information without inferring characteristics about individuals, strictly for purposes permitted by California law: performing requested services/goods, detecting security incidents, transient non-personalized advertising, maintaining accounts, servicing orders, quality/safety control, countering unlawful actions, and HR administration.

Supporting quotations

We collect, use and disclose personal information and sensitive information, as permitted by law to:

Perform services for our business, provide goods or services as requested by individuals

Detect and investigate security incidents

Use for short-term transient purposes, such as displaying first party, non-personalized advertising

Process and fulfill orders, maintain and service accounts, provide customer service, verify customer information, process payments, and provide financing

Conduct activities relating to quality and safety control or product improvement

Support employment, infrastructure, and human resource management

Counter wrongful or unlawful actions

Collect and process, for purposes permitted by law, without inferring characteristics about an individual

Qualifications & exceptions

• Processed without inferring characteristics about the individual.
• Limited to legally permitted operational and security purposes, including transient non-personalized ads and security incident detection.

Sharing & Disclosure · Company practice

Categories of service providers and third parties to whom Personal Data is disclosed or shared

Wells Fargo discloses or shares Personal Data with multiple recipient categories: commercial partners, financial institutions, and operational service providers (including ISPs, operating systems, platforms, ad networks, analytics providers, and M&A transaction parties); authorized representatives of California residents (accountants, financial advisors, powers of attorney); government agencies for regulatory compliance; human resources service providers (recruiting, training, benefits); consumer reporting agencies for routine reporting; and third-party advertising partners and social media platforms for cross-context behavioral advertising.

Supporting quotations

The categories of service providers and third parties to whom we disclose or share Personal Data about a specific individual depend on, among other things, our relationship or interaction with a specific California resident. Such service providers and third parties include:

Outside companies or organizations, including service providers, to whom we disclose Personal Data as part of providing products and services, completing transactions, supporting our everyday operations, or business management and development. Examples may include internet service providers, social networks, operating systems and platforms, advertising networks, and data analytics providers; companies or organizations to whom we provide products or services; other parties, partners, and financial institutions; and parties involved with mergers, acquisitions, and other transactions involving transfers of all or part of a business, or a set of assets.

Companies or individuals that represent California residents such as an accountant, financial advisor, or person holding power of attorney on behalf of a California resident

Government agencies, including to support regulatory and legal requirements

Outside companies or organizations, including service providers, to whom we provide Personal Data to support human resource activities and workforce management. Examples may include recruiting, training, data analytics, and employee benefits providers

Outside companies or organizations, in connection with routine or required reporting, including consumer reporting agencies and other parties

Third-party marketing and advertising technology providers, advertising partners, and social media platforms, in connection with our cross-context behavioral advertising activities

Qualifications & exceptions

• Recipients depend on the specific relationship and interactions with the California resident.
• Includes disclosure to consumer reporting agencies, government regulators, and resident representatives.

Sharing & Disclosure · Company practice

Sharing of Identifiers, Personal Information, and Purchase Information for cross-context behavioral advertising

In the preceding 12 months, Wells Fargo shared Personal Identifiers, Personal Information, and Purchase Information with third-party marketing and advertising technology providers, advertising partners including social media platforms, and data analytics providers for cross-context behavioral advertising.

Supporting quotations

The table below shows, for each Personal Data category we have collected, the categories of third parties with whom we may share Personal Data for purposes of cross-contextual behavioral advertising in the preceding 12 months. The table below contains briefer descriptions of the categories of Personal Data and third parties. The full descriptions of the categories of Personal Data and third parties are available above.

Personal Identifiers

Third-party marketing and advertising technology providers

Third-party advertising partners including social media platforms

Data analytics providers

Personal Information

Third-party marketing and advertising technology providers

Third-party advertising partners including social media platforms

Data analytics providers

Purchase Information

Third-party marketing and advertising technology providers

Third-party advertising partners including social media platforms

Data analytics providers

Qualifications & exceptions

• Shared for cross-context behavioral advertising in the preceding 12 months.
• Recipients include marketing ad-tech providers, social media platforms, and data analytics companies.

Sharing & Disclosure · Company practice

Sharing of Online Activity, Geolocation, and Inferences for cross-context behavioral advertising

In the preceding 12 months, Wells Fargo shared Internet or Online Information, Geolocation Data, and Inferences with third-party marketing and ad-tech providers, advertising partners including social media platforms, and data analytics providers for cross-context behavioral advertising.

Supporting quotations

Internet or Online Information

Third-party marketing and advertising technology providers

Third-party advertising partners including social media platforms

Data analytics providers

Geolocation Data

Third-party marketing and advertising technology providers

Third-party advertising partners including social media platforms

Data analytics providers

Inferences

Third-party marketing and advertising technology providers

Third-party advertising partners including social media platforms

Data analytics providers

Qualifications & exceptions

• Shared for cross-context behavioral advertising in the preceding 12 months.
• Recipients include marketing ad-tech providers, social media platforms, and data analytics companies.

Sharing & Disclosure · Restriction or exception

Categories of Personal Data and Sensitive Information not shared for cross-context behavioral advertising

In the preceding 12 months, Wells Fargo did not share six categories of collected data for cross-context behavioral advertising with third parties: Characteristics of Protected Classes, Biometric Information, Audio and Visual Information, Employment Information, Education Information, and Sensitive Personal Information.

Supporting quotations

Characteristics of Protected Classes

None

Biometric Information

None

Audio and Visual Information

None

Employment Information

None

Education Information

None

Sensitive Personal Information

None

Qualifications & exceptions

• Explicitly excludes protected classes, biometrics, audio/visual, employment, education, and sensitive personal information from cross-context behavioral ad sharing.
• Covers practices in the preceding 12 months.

Retention & Deletion · Company practice

Criteria and exceptions governing Personal Data and Sensitive Information retention

Wells Fargo determines data retention periods based on data type, collection purpose, relationship nature, and records management schedules, keeping Personal Data and Sensitive Personal Information no longer than reasonably necessary to fulfill the Notice purposes. Records are destroyed according to retention schedules, but may be held beyond scheduled periods due to regulatory requirements, audits, investigations, or legal proceedings.

Supporting quotations

We determine retention periods based on the type of Personal Data, the purpose for which it was collected or used, the nature of our relationship with you, and our records-management requirements. We will keep Personal Data, including Sensitive Personal Information, no longer than reasonably necessary to fulfil the purposes described in this Notice. Under our records and information management policy, we are required to destroy records containing Personal Data, including Sensitive Personal Information, according to specific periods in our retention schedule. However, we may need to hold such records beyond these retention periods as set forth in our records and information management policy, due to regulatory requirements or in response to a regulatory audit, investigation, or other legal matter.

Qualifications & exceptions

• Retention periods are based on data type, purpose, relationship nature, and records management schedules.
• Records containing Personal Data and Sensitive Personal Information are destroyed according to schedule.
• Records may be retained beyond standard periods due to regulatory requirements, audits, or legal matters.

Not stated here

• Specific retention periods and the text of the internal records management policy schedule are not supplied in this document.

Sharing & Disclosure · Restriction or exception

Prohibition on selling Personal Data and restrictions on selling or sharing data of minors under 16

Wells Fargo does not sell and has not sold Personal Data, including Sensitive Personal Information, in the preceding 12 months under the CCPA definition of sale (disclosure for monetary or valuable consideration). Furthermore, Wells Fargo has no actual knowledge that it sells or shares Personal Data (including Sensitive Personal Information) of minors under 16 years of age for cross-context behavioral advertising.

Supporting quotations

The CCPA defines a “sale” as the disclosure of Personal Data for monetary or other valuable consideration. Wells Fargo does not sell and has not, within the last 12 months, sold Personal Data, including Sensitive Personal Information. Furthermore, we have no actual knowledge that we sell or share (for purposes of cross-context behavioral advertising) Personal Data, including Sensitive Personal Information, of minors under 16 years of age.

Qualifications & exceptions

• Wells Fargo does not sell and has not sold Personal Data (including Sensitive Personal Information) in the past 12 months.
• No actual knowledge of selling or sharing data of minors under 16 years of age for cross-context behavioral advertising.

Legal Rights & Agreement Rules · User right or choice

California resident rights under CCPA: Know, Delete, Correct, Opt-Out of Sharing, and Non-Discrimination

California residents have statutory rights under the CCPA to submit requests: a Request to Know (categories of data collected, source categories, business/commercial purposes, disclosure categories, sharing categories, and specific pieces of data); a Request to Delete; a Request to Correct inaccurate personal data; and a Request to Opt-Out of Sharing for cross-context behavioral advertising. Individuals also have the right to be free from discrimination or retaliation (including as employees, applicants, or independent contractors) for exercising CCPA rights.

Supporting quotations

If you are a California resident, you have the right to request:

The following information ("Request to Know"):

a. The categories of Personal Data we collected about you and the categories of sources from which we collected the Personal Data;

b. The business or commercial purpose for collecting or sharing Personal Data about you;

c. The categories of third parties to whom we disclosed Personal Data about you, and the categories of Personal Data disclosed;

d. The categories of Personal Data about you that we shared and the categories of third parties with whom we shared such Personal Data; and

e. The specific pieces of Personal Data we collected about you.

Deletion of Personal Data we collected from you ("Request to Delete").

Correction of inaccurate personal information that we maintain about you ("Request to Correct").

Opt out of sharing, for purposes of cross-context behavioral advertising, ("Request to Opt-Out of Sharing").

In addition, you have the right to be free from discrimination by a business for exercising your CCPA privacy rights, including the right as an employee, applicant, or independent contractor not to be retaliated against for exercising your CCPA privacy rights.

Qualifications & exceptions

• Rights include Request to Know (categories, sources, purposes, disclosures, shares, specific pieces).
• Rights include Deletion, Correction of inaccurate data, and Opt-Out of Sharing for targeted ads.
• Includes statutory protection against discrimination or retaliation for employees, applicants, and contractors.

Cross-references

• qualified by (model-proposed): Methods and identity verification procedures for Requests to Know, Delete, and Correct — Specifies the identity verification procedures and documentation required to exercise CCPA rights to Know, Delete, or Correct.
• has exception (model-proposed): Statutory exemptions from CCPA requests under GLBA, HIPAA, consumer accounts, and legal duties — Statutory exemptions under GLBA, HIPAA, and other laws limit California residents rights to Know, Delete, or Correct Personal Data.

Legal Rights & Agreement Rules · Company practice

Availability of annual CCPA data request metrics disclosure

Wells Fargo publishes metrics regarding CCPA data requests in an annual disclosure accessible via its privacy website.

Supporting quotations

View Wells Fargo's CCPA data request metrics in our annual disclosure.

Qualifications & exceptions

• Metrics regarding CCPA data requests are published in an annual disclosure.

Not stated here

• The content of the linked annual disclosure metrics document is not supplied in this agreement.

Legal Rights & Agreement Rules · Procedure

Methods and identity verification procedures for Requests to Know, Delete, and Correct

California residents may submit Requests to Know, Delete, or Correct by calling 1-844-774-9229 or via the online privacy center. Online banking customers and employees can authenticate using existing log-in credentials; all other individuals must provide identity information (name, contact details, SSN or ITIN, date of birth) and a copy of government-issued photo ID (driver's license, state ID, or matricula card). Wells Fargo verifies identity by matching submitted information against similar data sources.

Supporting quotations

If you are a California resident, you can make a Request to Know, Delete, or Correct by:

Contacting us at 1-844-774-9229; or

Submitting your request at www.wellsfargo.com/privacycenter/.

Wells Fargo Online® customers and Wells Fargo employees: you can make a request by using your existing Wells Fargo log-in credentials.

For all other individuals, we will ask you to provide the following information to identify yourself:

Name, contact information, Social Security or individual taxpayer identification number, and date of birth; and

A copy of a government-issued photo ID. We accept your driver’s license, state ID, or matricula card.

When you make a Request to Know, Delete, or Correct, we will attempt to verify that you are who you say you are. For example, we will attempt to match information that you provide in making your Request with other sources of similar information to reasonably verify identity.

Qualifications & exceptions

• Requests can be submitted by toll-free phone (1-844-774-9229) or online privacy center.
• Online banking customers and employees can authenticate with existing credentials.
• Other individuals must provide identifying data (SSN/ITIN, DOB) and government photo ID (driver's license, state ID, matricula card).

Not stated here

• The external portal at the privacy center link is outside of this document and not supplied here.

Cross-references

• qualifies (model-proposed): California resident rights under CCPA: Know, Delete, Correct, Opt-Out of Sharing, and Non-Discrimination — Specifies the identity verification procedures and documentation required to exercise CCPA rights to Know, Delete, or Correct.
• qualified by (model-proposed): Verification requirements for individual and entity authorized agents submitting CCPA requests — Extends submission and verification rules to individual and legal entity authorized agents acting on behalf of residents.

Legal Rights & Agreement Rules · User right or choice

Procedures for Request to Opt-Out of Sharing and processing Global Privacy Control signals

California residents can make a Request to Opt-Out of Sharing via Wells Fargo's online opt-out notice page. Wells Fargo also processes CCPA-mandated opt-out preference signals, such as the Global Privacy Control (GPC), which set opt-out preferences for the specific browser or device used.

Supporting quotations

To make a Request to Opt-Out of Sharing, click here . We also process opt-out preference signals, such as the Global Privacy Control, as required by the CCPA. These signals set the opt out of sharing preferences for the specific browser or device you are using. For information about how to use the Global Privacy Control, please visit https://globalprivacycontrol.org/ .

Qualifications & exceptions

• Opt-out of sharing can be submitted through the dedicated opt-out notice link.
• Wells Fargo processes browser/device opt-out preference signals including the Global Privacy Control (GPC).
• Opt-out preference signals apply to the specific browser or device used.

Not stated here

• The text of the separately linked opt-out notice and the external Global Privacy Control specification are not supplied in this source document.

Cross-references

• refers to (model-proposed): Sharing Personal Data for cross-context behavioral advertising, marketing, and business development — Provides the mechanism and preference signal processing for consumers to opt out of cross-context behavioral advertising sharing.

Legal Rights & Agreement Rules · Restriction or exception

Statutory exemptions from CCPA requests under GLBA, HIPAA, consumer accounts, and legal duties

Personal Data handled by Wells Fargo is frequently subject to federal privacy laws other than the CCPA (including the Gramm-Leach-Bliley Act and HIPAA) or statutory exceptions. Exempt Personal Data is outside the scope of CCPA Requests to Know, Delete, or Correct, and Wells Fargo may decline all or part of a request relating to exempt data (such as consumer personal/household banking accounts subject to separate notices like the Wells Fargo U.S. Consumer Privacy Notice). Furthermore, data will not be deleted if retention is necessary to comply with legal obligations, nor provided if doing so would adversely affect another individual's privacy rights.

Supporting quotations

Privacy and data protection laws, other than the CCPA, apply to much of the Personal Data that we handle. When these other laws apply, Personal Data may be exempt from, or outside the scope of, a request to Know, Delete, or Correct. For example, Personal Data subject to certain federal privacy laws, such as the Gramm-Leach-Bliley Act or the Health Insurance Portability and Accountability Act (HIPAA), is exempt from CCPA Requests. As a result, we may decline all or part of your Request to the extent that it relates to exempt Personal Data. This means that we may not provide, delete, correct, or opt-out some, or all, of this Personal Data when you make a CCPA Request.

As examples, our processing of, or response to, a CCPA Request may not include some or all of the following Personal Data:

Consumer Accounts. Personal Data related to consumer accounts used for personal, family, or household purposes and applications for such accounts. We have other privacy notices providing certain information on use and sharing of this data, for example, the Wells Fargo U.S. Consumer Privacy Notice, available at www.wellsfargo.com/privacy-security.

The types of Personal Data described above are examples. We have not listed all types of Personal Data that may not be included when we respond to or process CCPA Requests.

In addition to the above examples, we may not include Personal Data when we respond to or process CCPA Requests when the CCPA recognizes another exception. For example, we will not provide the Personal Data about another individual when doing so would adversely affect the data privacy rights of that individual. As another example, we will not delete Personal Data when it is necessary to maintain that Personal Data to comply with a legal obligation.

We will verify and respond to your request consistent with applicable law, taking into account the type and sensitivity of the Personal Data subject to the request.

Qualifications & exceptions

• Personal Data subject to GLBA or HIPAA is exempt from CCPA Requests to Know, Delete, or Correct.
• Personal Data related to consumer banking accounts is subject to separate notices (e.g. U.S. Consumer Privacy Notice) and may be excluded.
• Requests will not delete data required to comply with legal obligations or provide data affecting others' privacy rights.

Not stated here

• The text of the referenced Wells Fargo U.S. Consumer Privacy Notice and linked privacy pages is not supplied in this document.

Cross-references

• exception to (model-proposed): California resident rights under CCPA: Know, Delete, Correct, Opt-Out of Sharing, and Non-Discrimination — Statutory exemptions under GLBA, HIPAA, and other laws limit California residents rights to Know, Delete, or Correct Personal Data.

Legal Rights & Agreement Rules · Procedure

Verification requirements for individual and entity authorized agents submitting CCPA requests

California residents may authorize an individual or legal entity agent to submit CCPA requests on their behalf. Individual agents must provide their own identity data/photo ID, the resident's identity data/photo ID, and proof of authorization (signed permission, power of attorney, guardianship/conservatorship order, or custodial parent birth certificate for minors). Legal entity agents must provide authorization proof from the resident, the resident's identity data/photo ID, and proof of authority on letterhead signed by an officer.

Supporting quotations

If you are a California resident, you may authorize an agent to make a request on your behalf. A California resident's authorized agent may make a request on behalf of the California resident by using the submission methods listed above under “How To Make Requests.” As part of our verification process, we may request that you provide, as applicable:

For an individual ("requestor") making a request on behalf of a California resident:

The requestor's name; contact information; Social Security or individual taxpayer identification number; date of birth; and driver’s license, state ID, or matricula card.

The name; contact information; Social Security or individual taxpayer identification number; date of birth; and driver’s license, state ID, or matricula card of the California resident on whose behalf the request is being made.

A document to confirm that the requestor is authorized to make the request. We may accept, as applicable, a signed permission by the California resident on whose behalf the request is made, a copy of a power of attorney, legal guardianship or conservatorship order, or a birth certificate of a minor if the requestor is the custodial parent.

For a company or organization ("legal entity requestor") making a request on behalf of a California resident:

Proof that the California resident has authorized the legal entity requestor to make the request. We may accept as applicable, a signed permission by the California resident on whose behalf the request is made, copy of power of attorney, or legal guardianship or conservatorship order.

The name; contact information; Social Security or individual taxpayer identification number; date of birth; and driver’s license, state ID, or matricula card of the California resident on whose behalf the request is being made. From the individual who is acting on behalf of the legal entity requestor, proof that the individual is authorized by the legal entity requestor to make the request. We accept a letter on the legal entity requestor's letterhead, signed by an officer of the organization. We provide a template to use via the URL provided above for making requests.

Qualifications & exceptions

• Applies to both individual requestors and legal entity requestors acting on behalf of California residents.
• Requires verifiable proof of authority (power of attorney, signed permission, guardianship order, or minor birth certificate).

Cross-references

• qualifies (model-proposed): Methods and identity verification procedures for Requests to Know, Delete, and Correct — Extends submission and verification rules to individual and legal entity authorized agents acting on behalf of residents.

Use & Processing · Company commitment

Commitment to maintain deidentified information without attempting re-identification

Where Wells Fargo maintains or uses deidentified information, it commits to maintaining and using it in a deidentified format and will not attempt to re-identify the information.

Supporting quotations

Where we maintain or use deidentified information, we will continue to maintain and use the deidentified information in a deidentified fashion and will not attempt to re-identify the information.

Qualifications & exceptions

• Wells Fargo will not attempt to re-identify deidentified information.

Legal Rights & Agreement Rules · Company practice

Periodic modifications to the CCPA Notice and posting of updated versions

Wells Fargo reserves the right to periodically change or update this Notice, posting revised versions directly on the webpage with a 'Last Updated' date indication.

Supporting quotations

We may change or update this Notice periodically. When we do, we will post the revised Notice on this webpage indicating when the Notice was "Last Updated."

Qualifications & exceptions

• Revised notices are posted on the webpage indicating the Last Updated date.

Legal Rights & Agreement Rules · Context

Scope of Wells Fargo corporate entities and subsidiaries providing the CCPA Notice

This Notice is provided by Wells Fargo & Company and subsidiaries that either act as a business under the statutory CCPA definition or are controlled by Wells Fargo & Company and use the Wells Fargo brand name, specifically including Wells Fargo Bank, N.A.

Supporting quotations

This Notice is provided by Wells Fargo and Company and its subsidiaries that either: (1) act as a business within the meaning of the CCPA, or (2) are controlled by Wells Fargo and Company and use the Wells Fargo name. As an example, companies providing this Notice include Wells Fargo Bank, N.A.

Qualifications & exceptions

• Applies to Wells Fargo & Company and subsidiaries acting as a CCPA business or controlled subsidiaries using the Wells Fargo name.
• Specifically includes Wells Fargo Bank, N.A.

Account & Service Control · Procedure

Contact channels for privacy inquiries and separate phone channel for account questions

Questions or concerns about Wells Fargo's privacy policies and practices may be directed to PrivacyCenter@wellsfargo.com. Individuals are directed not to send sensitive information or account-specific questions to that email address, but to call 1-800-TO-WELLS (1-800-869-3557) instead.

Supporting quotations

If you have any questions or concerns about Wells Fargo’s privacy policies and practices, please contact us at PrivacyCenter@wellsfargo.com. Please do not use this email address to send sensitive information or account-specific questions; instead call 1-800-TO-WELLS (1-800-869-3557) with any account-specific questions.

Qualifications & exceptions

• PrivacyCenter@wellsfargo.com is for general privacy inquiries, not sensitive or account-specific questions.
• Account-specific questions must be directed to phone support at 1-800-TO-WELLS (1-800-869-3557).