Your Privacy Choices: U.S. State Privacy Laws Supplementary Notice

Effective date: July 01, 2026

U.S. State Privacy Laws Supplementary Notice

This supplementary notice only applies to residents of certain U.S. States whose information is processed pursuant to applicable U.S. State law privacy requirements, including the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”) and other applicable U.S. state consumer privacy laws (together with CCPA, “State Privacy Laws”).

At Visa, we are committed to safeguarding the privacy and security of all Personal Information that is entrusted to us. Visa has a Global Privacy Program to help ensure your information is handled properly, and your Personal Information is protected. It also reflects the requirements of the privacy laws in all countries and states where Visa operates.

In the United States, payment transaction and other information Visa processes in connection with operating its electronic payments networks often is regulated by existing federal financial privacy laws. State Privacy Laws recognize that, where such financial information is already protected by federal privacy law, these State Privacy Laws do not apply to this information. Visa’s privacy program reflects the sensitivity of the financial and other information we handle. If you have questions about how we handle your data, please review the Visa Global Privacy Notice.

Visa also processes certain information that is subject to State Privacy Laws. State Privacy Laws may apply to (1) information we collect when individuals sign up for marketing and personalization from Visa, attend Visa-sponsored events, participate in surveys, or interact with our websites and apps, and (2) information collected from individuals who use our Visa-branded products, for example Click-to-Pay or Visa Payment Passkey Services. This supplemental privacy notice explains our practices for information subject to State Privacy Laws.

For information that Visa collects subject to State Privacy Laws, the Visa Global Privacy Notice describes the categories of Personal Information that we may have collected or disclosed for business purposes in the past 12 months, the sources of the Personal Information, the business or commercial purposes for which we use or disclose the information, and the categories of third parties to whom we disclose the information for business purposes. Visa does not authorize the use of such Personal Information to train large language models. Visa retains the Personal Information it has collected as long as the information is needed for the purposes set forth in the Visa Global Privacy Notice and this U.S. State Privacy Laws Supplementary Notice, and for any additional period that may be required or permitted by law. The length of time your Personal Information is retained depends on the purpose(s) for which it was collected, how it is used, and the requirements to comply with applicable laws.

State Privacy Laws provide their residents with specific privacy rights, including the right to correct inaccurate Personal Information, delete Personal Information, and access Personal Information and other information about our Personal Information processing practices, including in a portable format. Some State Privacy Laws may also give their residents the right to appeal our decisions with respect to your privacy rights requests. As described further in the sections below, State Privacy Laws may also give their residents the right to opt-out of having their Personal Information sold, processed for targeted advertising purposes or used for profiling in certain contexts, as well as certain rights in relation to the processing of their sensitive Personal Information. Finally, State Privacy Laws may give their residents the right not to receive discriminatory treatment for the exercise of any of these privacy rights.

The right to opt out of sale of Personal Information

Some State Privacy Laws provide you with the right to opt out of the “sale” of your Personal Information. Visa does not sell Personal Information for money, although our websites and applications may use cookies or similar technologies as described below. Our Global Privacy Notice describes how we disclose information to third parties, such as when we process payments, provide services to your card issuer, prevent fraud, or otherwise share your Personal Information with your consent.

The right to opt out of the processing of Personal Information for certain advertising purposes

Some State Privacy Laws provide you with the right to opt out of the processing of your Personal Information for purposes of serving you advertisements that are relevant to you based on your activity across our services and other sites (“targeted advertising” or “cross-contextual behavioral advertising”), including the sharing of your Personal Information for these targeted advertising purposes.

Like many companies, we use services that help deliver personalized and interest-based ads to you, and our websites and applications may use cookies or similar technologies that allow advertising partners to collect your Personal Information for their use. On most Visa websites, Visa only permits advertising partners to collect your Personal Information in this manner with your consent. To request to opt-in (or to change your mind after opting-in), please click the Cookie Preferences link on the bottom of the Visa website you are interacting with or visit the Visa Cookie Notice.

For US Visa websites, Visa detects and honors Global Privacy Control (GPC) signals sent by your browser. When we detect a valid GPC signal, we treat it as a request to opt-out of the sharing of your Personal Information for personalized marketing and ad-tracking. This means only strictly necessary cookies will be enabled. Please note that this setting applies only to the browser where the GPC signal is enabled. If you clear your cookies or use a different browser or device, you will need to re-enable GPC.

Please note that some transfers of your Personal Information may not be for purposes of personalized marketing or targeted advertising, and certain exemptions may apply under applicable State Privacy Laws. Your choices do not affect other disclosures of your information, as outlined in our Global Privacy Notice, such as when we process payments, provide services to your card issuer, or prevent fraud.

Sensitive Personal Information rights

In the United States, the payment transaction and certain other information that Visa collects when it operates its payment networks is regulated by existing federal financial privacy laws. Further, any sensitive Personal Information subject to applicable State Privacy Law is only processed for purposes under the applicable law which do not require your consent or for which you do not have a right to limit.

Access, correction, deletion, and appeal rights

You may exercise your rights, authorize another person to act on your behalf, or appeal a denial of a request by:

• Visiting our Privacy Rights Portal
• Calling Visa at 1-844-909-1620
• Emailing us at privacy@visa.com
• Mailing us a letter:
  Visa Global Privacy Office
  900 Metro Center Blvd.
  Foster City, CA, 94404

Please do not include sensitive information, such as your account number, in emails.

Please understand that your rights are subject to some limitations, such as:

• For security reasons and to prevent unauthorized disclosure of Personal Information, cardholders should contact their payment card issuers to access their information.
• State Privacy Laws contemplate that service providers should refer access and deletion requests to the companies with whom the individual has the direct relationship.
• Some State Privacy Laws may also prohibit companies from including certain elements of sensitive Personal Information, such as payment card number, in their access reports, even if you have provided those data elements to use for marketing.
• If you request that we delete your Personal Information, we will do so except in those situations where our retention is permitted by the applicable State Privacy Laws.

If you have any other questions or requests, please contact us at privacy@visa.com

Financial Incentives

Visa provides loyalty and other similar promotional programs in order to reward and thank loyal customers for using the Visa payment network and other Visa services. You can opt into these programs through the mechanisms described when they are offered to you, such as via email.

Additional Disclosures for Large Businesses

The CCPA requires certain businesses to compile and disclose information each year regarding their compliance with the CCPA for the previous twelve-month period. Visa has selected to provide these reports annually for the preceding calendar year 2025.