# Mailchimp privacy rating

Email marketing platform owned by Intuit for building mailing lists, sending newsletters and automated campaigns, and tracking opens and clicks.

## Summary

Mailchimp scores 34 out of 100 (grade F) on the newsletter platforms criteria. It meets 1 of 8 criteria: TLS configuration. It partly meets no ads or data sales, independent audit, transparency report and tells users about requests. It does not meet open source, no trackers or telemetry and security headers. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade C+.

- Website: https://mailchimp.com
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Platforms: Android, iOS, Web
- Home page trackers: OneTrust (not scored), Optimizely
- Category: [Newsletter platforms](https://privacyratings.com/newsletters/)
- Also rated: [Mailchimp Transactional](https://privacyratings.com/email-sending/mailchimp-transactional/) (Email sending services)
- Grade: F (34/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | No | The Intuit privacy statement covers advertising cookies, pixels and session-replay tools, and campaigns track opens and clicks by default. | https://www.intuit.com/privacy/statement/ |
| No ads or data sales | Partial | Funded by subscriptions and states data is not sold, but personal information is shared with advertising networks for targeted ads unless users opt out. | https://www.intuit.com/privacy/statement/ |
| Independent audit | Partial | SOC 2 and ISO 27001 audits are done, but the reports are only available through the Intuit compliance portal. | https://mailchimp.com/about/security/ |
| Transparency report | Partial | Publishes how it accepts legal process from governments, but no request counts. | https://mailchimp.com/legal/service-of-legal-process/ |
| Tells users about requests | Partial | Mailchimp reserves the right to notify customers of legal process, and some customer agreements require notice unless prohibited. | https://mailchimp.com/legal/service-of-legal-process/ |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=mailchimp.com&hideResults=on |
| Security headers | No | Grade C+ (60/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=mailchimp.com |
| Modern web standards | Not tested yet | Not tested yet. |  |

Source: https://privacyratings.com/newsletters/mailchimp/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/newsletters/mailchimp.md