Snapshot of the source text at fetch time, not a live mirror of the policy page.
Plain-English summary
LastPass transfers data to countries that may not offer adequate data protection and may disclose personal data to public authorities (risk_flags-1, risk_flags-2). They record support calls (risk_flags-3) and collect mobile numbers for SMS account recovery (data_use-1), which implies consent to autodialed messages. LastPass also collects data about you from third-party sources and combines it with your provided data to infer information (data_use-2). Furthermore, they share personal data with third-party social media and advertising networks to show personalized ads (data_use-3, data_use-4).
85% confidence
Ask Verbaterm
Follow up on findings with grounded answers from this review. Not legal advice.
Risk Flags
3 findings
These findings are material hard-to-reverse harms that are often not consumer-friendly.
medium95% confidence
Data transferred to countries without adequate data protection
Data collected and maintained by LastPass will be transferred to and processed in the United States and other countries around the world, which may not provide the same level of data protection as required by some jurisdictions.
Why it matters: Your personal data may be transferred to and processed in countries that are deemed not to provide the same level of data protection as your home jurisdiction.
Data that we collect and maintain will be transferred to and processed in the United States and other countries around the world. In cases of a transfer to “third countries,” which may be deemed to not provide the same level of data protection required by the European Commission or your applicable jurisdiction, LastPass applies additional safeguards, in accordance with applicable legal requirements, to ensure that the recipient provides an adequate level of data protection.
Cross Border Data Transfers, paragraph 1 · Citation strength: strong
medium90% confidence
Disclosure of personal data to public authorities
LastPass may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
Why it matters: Your personal data may be disclosed to public authorities for national security or law enforcement purposes.
In certain situations, LastPass may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
Data Privacy Framework Notice, paragraph 3 · Citation strength: strong
low85% confidence
Recording of support calls
LastPass processes personal data, including recording calls or chats, if you contact them for support.
Why it matters: Your support calls or chats may be recorded when you contact LastPass for assistance.
We process your personal data, including recording calls or chats, if you contact us for support (via email, phone, social media, chatbots) to assist with responding to your inquiries and use of the Services; to address technical or security issues; and for training, quality assurance, and administrative purposes and to improve sales operations and customer engagement
How We Use Your Data and Legal Basis, paragraph 2 · Citation strength: strong
Data Use
4 findings
These findings are about how your data is collected, used, and shared.
medium85% confidence
Collection of mobile phone numbers for SMS account recovery
You may provide your mobile phone number for two-factor authentication and/or opt-in to SMS account recovery, consenting to receive autodialed text messages.
Why it matters: By opting into SMS account recovery, you consent to receive autodialed text messages from LastPass.
You may provide us with your mobile phone number if you set up two-factor authentication and/or opt-in to our SMS account recovery feature. By opting in to SMS account recovery, you consent to receiving autodialed text messages, including SMS messages, that may be sent by or on behalf of LastPass at the mobile phone number you provide us. Message and data rates may apply.
Data We Collect Directly From You, paragraph 2 · Citation strength: strong
medium90% confidence
Data collected from third-party sources and combined for inferences
LastPass collects data about you from third-party partners and publicly available sources, including identity breach monitoring data, and may combine this data with your provided personal data to draw inferences or make assumptions.
Why it matters: Information about you, including identity breach monitoring data and professional details, can be collected from third-parties and combined with your directly provided data to make inferences or assumptions about you.
In some circumstances, we work with third-party partners and service providers that provide us with data about you. We also collect publicly available data about you from other third-party sources. This data from third-party sources includes identity breach monitoring data (e.g., for dark web monitoring) and other information that may help us detect potential fraud, or information to identify leads and prospects for marketing purposes. This data may contain personal data such as personal identifiers, professional or employment-related information, business contact information, internet activity information, social media profiles, LinkedIn URLs, and custom profiles.
Data We Collect From Other Sources, paragraph 1 · Citation strength: strong
medium85% confidence
Sharing of personal data with third-party social media and advertising networks
LastPass shares personal data with third-party social media and advertising networks to advertise on those platforms and measure advertisement effectiveness.
Why it matters: Your personal data is shared with social media and advertising networks to facilitate advertising for LastPass and to measure how effective these ads are.
With third-party social media and advertising networks so that LastPass can advertise on those platforms and measure advertisement effectiveness;
Who We Share Your Personal Data With, paragraph 2 · Citation strength: strong
medium85% confidence
Personal data used for personalized advertisements and content
LastPass processes personal data to understand how you use their websites and what you like and dislike, in order to display personalized advertisements and content based on your interests.
Why it matters: Your personal data is used to tailor advertisements and content you see on LastPass websites based on your usage and preferences.
We process personal data to understand how you use our websites and what you like and dislike to display personalized advertisements and content based upon your interests
How We Use Your Data and Legal Basis, paragraph 2 · Citation strength: strong
Cancellation and Renewal
All clear
These findings are about subscriptions, cancellations, and renewals.
✓
Looking good
No billing surprises spotted
Verbaterm only flags concerns it can cite. No cancellation, auto-renewal, or refund terms needed attention here.
Gotchas
2 findings
These findings are about less-than-ideal terms which are usually reversible, but may require effort or cause inconvenience.
low90% confidence
Privacy Notice does not apply when LastPass processes data as a service provider
This Privacy Notice does not apply when LastPass processes personal data on behalf of its customers as a processor or service provider; in such cases, your use is subject to the customer's privacy and security practices.
Why it matters: If a LastPass customer provides you access to their services, the customer's privacy practices, not LastPass's, will govern your data.
This Privacy Notice does not apply in situations where we process personal data on behalf of our customers as a processor or service provider. If our customer provides you with access to our Services, your use is subject to our customer’s privacy and security practices.
Who We Are and Scope Of This Privacy Notice, paragraph 2 · Citation strength: strong
low85% confidence
Feedback may be used as described in Terms of Service
LastPass may use feedback provided by users as described in their Terms of Service.
Why it matters: The feedback you provide to LastPass may be used in ways outlined in their Terms of Service.
We may also use feedback as described in the [Terms of Service](https://www.lastpass.com/legal-center/terms-of-service/personal).
Data We Collect Directly From You, paragraph 3 · Citation strength: strong
Protections
1 finding
These findings highlight commitments that benefit you as a user.
Protection95% confidence
Vault data is zero-knowledge encrypted
Vault data, including customer content like usernames and passwords, is encrypted locally at the device level before syncing to LastPass servers, meaning only the user can decrypt it with their master password.
Why it helps: Your most sensitive data stored in the vault, such as passwords and secure notes, is encrypted on your device, and LastPass states that no one at LastPass can access or decrypt it without your master password.
**LastPass is designed to keep your most sensitive data safe using a local-only**, [zero knowledge security model](https://www.lastpass.com/security/zero-knowledge-security).
Data We Collect Directly From You, paragraph 2 · Citation strength: strong
Report an issue
Flag a citation problem, stale policy text, or incorrect company match.
Verbaterm boundaries
This public review is informational only and is not legal advice. Verbaterm shows only findings tied to the cited source snapshot above.