Cboe Global Markets
Financials
28
out of 100. Number 417 of 512, counting from the worst.
Where Cboe Global Markets does well
- Arbitration 0 of 20. Nothing found.
- Renewals 0 of 20. Nothing found.
- No forced arbitration or class-action waiver: website disputes go to ordinary courts (state and federal courts in Cook County, Illinois), which is better than most financial-adjacent tech companies. Data 'sales' are disclosed and opt-outable via the 'Do Not Sell or Share My Personal Information' footer link, and Cboe says it does not knowingly sell/share children's data under
- GDPR and CCPA data-subject rights (access, correction, deletion, portability) are spelled out with request channels, and Cboe participates in the EU-U.S. Data Privacy Framework with a free independent JAMS dispute-resolution mechanism for privacy complaints. The privacy policy is current (updated February 4,
- and reasonably detailed, and the thin consumer surface means there are no auto-renew subscription traps to fall into.
Cboe hands your IP address, email, and browsing activity to ad-tech and marketing firms — and it openly admits this counts as a legal 'sale' of your data under California privacy law.
The fine print
6 clauses and findings from the draft archive, dated 1 October 2026. The plain English comes first; the small print is the company's own words. None of these has been checked yet.
-
Cboe hands your IP address, email, and browsing activity to ad-tech and marketing firms — and it openly admits this counts as a legal 'sale' of your data under California privacy law. An opt-out exists via the 'Do Not Sell or Share My Personal Information' footer link, but the default is sharing.
We may disclose certain identifiers (like IP address and email address), internet or other electronic network activity information (like information regarding an individual's browsing interactions on our Website), and commercial information (like the fact that a browser visited a page directed to people who are considering using our services) to certain analytics, advertising, and marketing providers in ways that may be considered 'sales' under certain privacy laws, such as the CCPA.
-
Cboe can rewrite the rules of the site at any time, even without telling you, and merely visiting the site afterward means you've agreed to the new rules. The privacy policy has a parallel clause allowing changes 'without prior notice.'
From time to time, Cboe reserves all rights to modify the Terms of the Website or to change or discontinue any aspect or feature of the Website with or without notice to you. ... A user's access or use of the Website after the posting of modifications to these Terms will constitute such user's acceptance of the Terms, as modified.
-
Your data doesn't go away when you leave. Cboe reserves the right to keep it indefinitely afterward, with no fixed deletion timeline — only vague references to 'necessary' periods and legal obligations.
Cboe may retain your data after you cease your relationship with us. In addition, personal data may be retained for the period necessary to fulfill the purposes outlined in this Notice and Privacy Policy and as otherwise needed for legal, regulatory, or litigation purposes, as may be required under applicable law.
-
Anything you post, upload, or submit to Cboe's sites becomes theirs to use forever, anywhere, including sublicensing to others — with no payment to you and no way to revoke it.
You expressly grant ... to Cboe a non-exclusive, irrevocable, worldwide, transferable, royalty-free, perpetual license to use, publicly display, publicly perform, reproduce, distribute, sublicense and create derivative works from your User Content in any manner or through any media now known or later developed, without any payment to you.
-
Even if Cboe's own errors, outages, or bad data directly cost you money, the terms disclaim liability for ALL damages — including direct damages — no matter what legal theory you sue under. Meanwhile the indemnity clause requires YOU to cover Cboe's legal costs if your use of the site generates a claim.
CBOE ... SHALL NOT BE RESPONSIBLE OR LIABLE TO YOU OR ANY THIRD PARTY FOR ANY DAMAGES, LOSSES AND EXPENSES OF ANY KIND AND HOWEVER ARISING, INCLUDING WITHOUT LIMITATION DIRECT, INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES ... REGARDLESS OF WHETHER A CLAIM ARISES IN CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY, OR OTHERWISE.
-
Cboe collects fingerprints, face scans, criminal histories, racial origin, and health data — an unusually deep set of sensitive data for what presents itself as a website privacy policy. (Fair context: this applies mainly to exchange members, staff, and facility-access applicants, not casual site visitors.)
Biometric Data: includes fingerprint data and facial scans to facilitate background checks and identify individuals who have been granted access to Cboe facilities and systems. ... Identifiable Data: includes criminal history ... and race/racial origin for the purposes of facilitating these background checks. Health Data: includes health information such as COVID-19 vaccination data and COVID-19 test results processed to determine whether individuals should be granted access to Cboe facilities.
How these were found
Documents relied on: (1) Terms and Conditions for Use of Cboe Websites, https://www.cboe.com/terms, 'Last Updated: November 16, 2022' (over 3 years old, read directly via browser_open); (2) Cboe Privacy Notice and Policy, https://www.cboe.com/privacy, 'Last Updated: February 4, 2026' (read directly via browser_open, 554 lines). No mirror sites needed; cboe.com did not block fetching. Cboe is a B2B stock-exchange operator (options/futures exchanges, market-data businesses) with a thin consumer surface — no consumer subscriptions, shopping carts, or paid consumer accounts — so several categories score 0 for lack of applicable provisions. The B2B agreements (Global Data Agreement, Data Subscriber Agreement, connectivity terms) were reviewed only in search-result snippets and were NOT scored; they carry their own fees, auto-renew terms, and liability limits but apply to institutional counterparties, not website consumers. Cboe Digital's separate October 2022 Terms of Use (a PDF for digital-asset exchange participants) was found in search but not scored, as it is not the general public-facing document.
These notes come from the original draft and are not independent verification.