Mastercard
Financials
61
out of 100. Number 111 of 512, counting from the worst.
Where Mastercard does well
- Renewals 2 of 20. Few problems found.
- Mastercard states plainly that it does not sell personal information (as defined by California privacy law) and does not 'share' personal information for targeted advertising — a genuine differentiator from data brokers.
- The Click to Pay terms are stricter than the website ToU on changes: non-material changes take effect on publication, but material changes require affirmative acceptance before you can keep using the service, and you get a 30-day written window to opt out of any future change to the arbitration provision.
- The only auto-renewing subscriptions found are B2B developer API plans (Fintech Express), not consumer products — and those give 30-day email notice before quarterly/annual charges plus prorated refunds on cancellation.
- Mastercard runs a dedicated 'My Data' portal for access/deletion/portability requests, promises not to deny service or charge different prices for exercising privacy rights, and offers an opt-out of the anonymized-analytics program.
If you use Click to Pay (Mastercard's online checkout profile, which stores your card number and billing info), you give up your right to sue in court and to join a class action — every dispute goes to a private arbitrator instead.
The fine print
6 clauses and findings from the draft archive, dated 1 October 2026. The plain English comes first; the small print is the company's own words. None of these has been checked yet.
-
If you use Click to Pay (Mastercard's online checkout profile, which stores your card number and billing info), you give up your right to sue in court and to join a class action — every dispute goes to a private arbitrator instead.
To the extent permitted by applicable law, these Terms provide that all disputes between you and Mastercard will be resolved by BINDING ARBITRATION. YOU AGREE TO GIVE UP YOUR RIGHT TO GO TO COURT to assert or defend your rights under this contract, except for matters that may be taken to small claims court. Your rights will be determined by a NEUTRAL ARBITRATOR and NOT a judge or jury, and your claims cannot be brought as a class action (if class action claims can be filed in your jurisdiction).
-
Mastercard can rewrite its site terms whenever it wants without telling you directly — just posting the change on the site counts as notice. Your continued use is treated as acceptance.
Mastercard reserves the right to change these Terms of Use at any time, at our own discretion and without notice to you; however, all such changes will be posted to this Site.
-
Mastercard turns your card-swipe history into anonymized analytics — predictive spending and credit-risk models sold to banks and merchants. It doesn't sell your identifiable data, but it commercializes the patterns in your transactions. The opt-out exists but is a buried 'click here' link, not an opt-in.
Anonymise Personal Information and prepare and furnish aggregated data reports showing anonymised information (including compilations, analyses, analytical and predictive models and rules, and other aggregated reports) for the purpose of advising our financial institutions, merchants and other customers and partners regarding past and potential future patterns of spending, fraud, credit risk, and other insights that may be extracted from this data. The Personal Information we anonymise may include payment transactions.
-
If you turn on Do Not Track in your browser, Mastercard explicitly ignores it.
Because there is not yet a consensus on how companies should respond to web browser-based do-not-track ('DNT') mechanisms, Mastercard does not respond to web browser-based DNT signals at this time.
-
Anything you post on a Mastercard site you give them a permanent, irrevocable license to — they can edit, re-license, or copyright it in their name forever, you waive your creator rights, and you even appoint them your 'attorney-in-fact' to act on your behalf regarding it.
By making a posting, you understand that you are granting Mastercard a worldwide, perpetual, royalty-free, fully-paid, irrevocable, sublicensable, transferrable, nonexclusive license in and to the post... By making a post, you are waiving and agree not to assert any copyrights or 'moral' rights... You are also agreeing to appoint Mastercard as your irrevocable attorney-in-fact with respect to the post.
-
No matter what goes wrong with Click to Pay — even Mastercard's own negligence — the most you can ever recover is $100.
NOTWITHSTANDING THE FOREGOING, THE INDEMNIFIED PARTIES' TOTAL LIABILITY TO YOU FOR ALL DAMAGES, LOSSES, AND CAUSES OF ACTION, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), OR OTHERWISE WILL NOT, UNDER ANY CIRCUMSTANCES, EXCEED ONE HUNDRED U.S DOLLARS (US $100).
How these were found
Documents actually read via browser_open: (1) Mastercard Global Privacy Notice — https://www.mastercard.com/global/en/privacy-notice.html (current; page fetched successfully, no version date displayed at top; search cache showed crawl 3 hours before read); (2) Mastercard Terms of Use PDF — https://asset.mastercard.com/content/dam/gdpr/fe/Terms_of_Use.pdf (titled for the Fintech Express developer program site; this is the only full mastercard.com Terms of Use document located — a general mastercard.com consumer ToU page could not be found separately, and Mastercard's direct consumer-facing terms are program-specific); (3) Click to Pay Terms of Use — https://www.mastercard.com/global/click-to-pay/en-ca/terms-of-use.html, 'Last updated September, 2024', applies to the United States and listed countries. The explicit 'we do not sell your Personal Information' statements were verified only via search-result snippets from mastercard.com program notices (Click to Pay privacy notice en-ae) and a staging mirror PDF of the U.S. Privacy Addendum — not full reads. An older mastercard.us PDF snapshot (mc-global-privacy.pdf) was located but not fully read; not relied upon for quotes. Mastercard does not issue cards directly — most consumers' contract is with their card issuer, so Mastercard's direct terms (and the arbitration clause) apply mainly to optional services like Click to Pay and developer/API programs, narrowing their practical reach.
These notes come from the original draft and are not independent verification.