Skip to content
Apply for a loan
How can we help you today?

Find the college or grad school tools
and resources you need.

Easy scholarships Financial aid Loan options Grad school

Sallie State Privacy Notice

Effective Date: 9/30/2026

This State Privacy Notice (“State Privacy Notice”) contains details about how the operating subsidiaries of SLM Corporation, including SLM Education Services, LLC and Sallie Mae Bank (collectively, “we,” “us,” or “Sallie”), collect, use, store, disclose, and otherwise process certain information, including your personal information.

This State Privacy Notice supplements our Privacy Policy and applies to residents of those states with privacy laws that are applicable to certain of our businesses, including California (each a “State Privacy Law,” and collectively, the “State Privacy Laws”). In the event of a conflict between the Privacy Policy and the State Privacy Notice, this State Privacy Notice will prevail.

In this State Privacy Notice, the term “personal information” refers to information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household, as well as to information defined as “personal information,” “personal data,” and other similar terms under State Privacy Laws. Capitalized terms used but not defined herein will have the meanings given to them in the Privacy Policy.

We may modify this State Privacy Notice from time to time, in which case we will update the “Effective Date” above. If we make material changes to the way in which we use or disclose personal information we collect, we will notify you as described in the “Updates” section of our Privacy Policy. If you do not agree to any updates to this State Privacy Notice, please do not continue using or accessing the Services.

Section A of this State Privacy Notice covers our collection, use, and disclosure of personal information. Section B describes your rights under State Privacy Laws and explains how to exercise those rights. Section C describes certain additional rights for California residents. Section D provides information on how to contact us in relation to our privacy practices.

This State Privacy Notice does not apply to our collection and processing of personal information related to consumer financial products and services, including private student loans, deposit accounts, and applications for such products and services. For information regarding our collection and processing of such personal information, please see the Sallie Consumer Privacy Notice.

This State Privacy Notice also does not apply to any third-party websites, services, products, or mobile applications maintained by other companies or entities, which may be linked from our Services, and are governed by their own privacy notices, or to personal information relating to our job applicants, current employees, former employees, or independent contractors. For California residents in those roles, such information is governed by the California Employee Privacy Notice.

A. Processing of Personal Information

In the preceding 12 months, we may have collected the categories of personal information indicated in the table below and may have disclosed such personal information for a business purpose as indicated below.

Certain of our businesses may “sell” or “share” personal information or process personal information for “targeted advertising,” as those terms are defined by State Privacy Laws, and over the preceding 12 months may have sold or shared the categories of personal information identified below for:

  • advertising and marketing purposes, including to serve targeted advertising or cross-context behavioral advertising; and
  • the business purposes of advertisers, business customers, and other third-party partners.

The specific business or commercial purposes for which we collect and disclose your personal information and the categories of sources from which we collect your personal information are described in the sections of our Privacy Policy titled “Sources of Personal Information,” “How Do We Use Your Personal Information,” and “To Whom Do We Disclose Your Personal Information.” The criteria we use to determine how long to retain your personal information is described in the section of our Privacy Policy titled “Retention of Personal Information.”

Categories of Personal Information Disclosed for a Business Purpose

We may collect and disclose the following categories of personal information for a business purpose to other members of our corporate organization; service providers that help us provide our products and services; third-party partners and business customers (such as those we work with to provide contests and scholarships); third-party platforms, sites, and services, including ad networks; universities and other educational institutions or programs; and third-party technology companies (such as those that offer digital advertising or other marketing services, communication services, fraud-prevention or security services, and data analytics, amongst others):

  • Identifiers and contact information;
  • Personal Records;
  • Protected Characteristics;
  • Transaction/Commercial Information;
  • Internet or other Electronic Network Activity/Usage Information;
  • Geolocation Information;
  • Audiovisual and Similar Information;
  • Non-public Education Records;
  • Professional or Employment Information;
  • Inferences from Personal Information; and
  • Sensitive Personal Information (limited to personal information of consumers under 16 years of age, government-issued identification numbers, biometric information, and account login information and password).

Categories of Personal Information Sold or Shared

We do not “sell” or “share” (as those terms are defined under applicable state privacy laws) most categories of personal information. In the preceding twelve (12) months, we may have sold or shared only the following categories:

  • Identifiers and contact information;
  • Personal Records;
  • Transaction/Commercial Information;
  • Internet or other Electronic Network Activity/Usage Information;
  • Geolocation Information; and
  • Inferences from Personal Information.

We sold or shared each of these categories to the same two categories of third parties: third-party technology companies and third-party partners and business customers.

We do not sell or share Protected Characteristics, Audiovisual and Similar Information, Non-public Education Records, or any Sensitive Personal Information.

We may also de-identify or aggregate personal information. Where we process de-identified information, we maintain and use it in de-identified form and do not attempt to re-identify the information, except in accordance with applicable State Privacy Laws.

Notice of Financial Incentive

We offer certain programs, benefits, and other offerings that may be deemed a “financial incentive” under applicable U.S. Privacy Laws. Examples of the programs that we offer include sweepstakes, scholarships, contests, promotions, and email/text message alert programs. These offerings may involve the collection of the following categories of personal information from individuals who participate: identifiers, personal records, personal characteristics or traits, education information, transaction/commercial information, and Internet usage information. Participation in these programs is voluntary and no purchase is required.

While we cannot calculate the precise value of your information, the value of each financial incentive is generally related to the value of your data, including as applicable: the benefit and insights that we realize and expect to realize from your participation in our programs (such as your preferences); the quantity and quality of information that you provide to us through your participation; sales directly or indirectly generated from your participation in the program; and any increased goodwill towards us. Participation in these programs is governed by our Privacy Policy, this State Privacy Notice, the official terms and conditions governing the program in question that are posted on our website, and our Terms of Use. You may opt in at the time the applicable program, benefit, or offering and a financial incentive is presented to you. Enrollment details and terms will be provided at that time. You may withdraw your participation in these programs by following the instructions in the email, text message notification, or applicable rules, or contacting us using the information below in the “Contact Us” section.

Please note that if you make a request to delete your personal information, we may no longer be able to provide you with financial incentive benefits because we will have no way to tie you to the benefits to which you are entitled or to contact you regarding the benefits.

Children and Minors

Our Services are for general audiences. We do not knowingly collect any personal information (as defined by the federal Children’s Online Privacy Protection Act [“COPPA”]) from children younger than the age of 13. If you are under a certain threshold age (18 in most states), you should use our Services only with the permission and guidance of your parent or guardian. If you are under the age of 13, you should not use our Services. If we learn that we have inadvertently collected personal information from a child younger than 13, we will make commercially reasonable efforts to delete such personal information.

To the extent permitted by State Privacy Laws applicable to us, we may sell or share, or use for targeted advertising (each as defined under applicable State Privacy Laws), the personal information of “minors” who are at least 13 years of age, but under 16 years of age (or such other definition of “minors” under applicable State Privacy Laws). Certain applicable State Privacy Laws require us to obtain the affirmative authorization of those consumers in order to sell or share such personal information or use it for targeted advertising. Consumers who provide such affirmative authorization may withdraw it at any time by visiting our “Your Privacy Choices” page (click here for sallie.com or here for salliemae.com).

If you think we may have unknowingly sold or shared personal information or used personal information for targeted advertising in violation of applicable State Privacy Law, please notify us as described in the “Contact Us” section below.

B. Privacy Rights

Requests to Exercise Privacy Rights

Depending on your state of residence, you may have certain rights regarding your personal information, which are described below. These rights are not absolute, and in certain cases we may decline your request as permitted by law. For example, these rights are not available in relation to personal information that is exempt from State Privacy Laws. As a reminder, neither this State Privacy Notice nor the rights described below apply to personal information related to accounts for financial products and services used for personal, family, or household purposes (for example, private student loans and deposit accounts) and applications for such accounts.

In some instances, you may be able to access or correct your personal information by logging into your account.

Making a Request and Scope of Requests

As permitted by the State Privacy Laws, certain requests you submit to us are subject to an identity verification process (“Verifiable Consumer Request”) as described below in the “Verification of Requests” section. We will not fulfill such requests unless you have provided sufficient information for us to reasonably verify you are the consumer about whom we collected personal information.

To request to exercise these rights, please submit a request using our Privacy Rights Request Form (click here for sallie.com or here for salliemae.com) or call us at 855-582-1928.

Description of Privacy Rights

Right to Know/Access. You may have the right to request certain information about our collection, use, and disclosure of your personal information, including:

  • whether we are processing your personal information;
  • the categories of personal information we have collected, disclosed for a business purpose, sold, or shared;
  • the categories of sources from which we collected personal information;
  • the business or commercial purposes for collecting, selling, and sharing personal information;
  • the categories of third parties to whom the personal information was disclosed for a business purpose, sold, or shared; and
  • the specific pieces of personal information we have collected about you.

Right to Delete. You may have the right to request that we delete personal information we maintain about you.

Right to Correct. You may have the right to request that we correct inaccurate personal information we maintain about you.

Right to Request List of Third Parties. Depending on your state of residence, you may have the right to request information about the third parties to whom we have disclosed or sold your personal information. To exercise this right, please contact us at privacy@sallie.com.

Right to Opt-Out of the Sale, Sharing or Processing for Targeted Advertising of Your Personal Information. Under State Privacy Laws applicable to us, you may have the right to opt out of (1) the sale of your personal information or (2) the sharing or processing of your personal information for targeted advertising purposes. If you exercise your opt-out right, we will no longer sell or share your personal information or process your personal information for targeted advertising, as applicable under State Privacy Laws.

Opt-out for non-cookie personal information. If you want to opt out of the sale of your personal information that was not collected by cookies and other tracking technologies (e.g., your email address), or opt out of the sharing or processing of such data for targeted advertising, make an opt-out request by visiting our “Your Privacy Choices” page (click here for sallie.com or here for salliemae.com). We refer to this personal information as “non-cookie personal information.”

Opt-out for cookie personal information. If you want to opt out of the sale of your personal information collected by cookies and other tracking technologies (referred to as “cookie personal information”), or opt out of the sharing or processing of such cookie personal information for targeted advertising, you need to exercise a separate opt-out request by selecting Manage Preferences at the bottom of this page. This is because we have to use different technologies to apply your opt-out of cookie personal information and non-cookie personal information. Our consent management tool enables you to exercise such an opt-out request for cookie personal information. You must exercise your preferences on each of our Services you visit, from each browser and device you use. Since your opt-out is designated by a cookie, if you clear or block cookies, your preferences will no longer be effective and you will need to enable them again via our consent management tool.

Global Privacy Control. You may use a signal called a Global Privacy Control (“GPC”) signal to opt out of certain sales, sharing, and processing for targeted advertising. Due to technical limitations, GPC signals apply only to sales, sharing, and targeted advertising involving cookie personal information that is automatically collected by third-party technology companies on our Services (as described in our Privacy Policy). You may use alternative opt-out mechanisms described above to exercise opt-outs in other contexts (e.g., to opt out of sales, sharing, and targeted advertising involving non-cookie personal information). Requests sent using the GPC will apply to the device and browser from which they are submitted. After using the GPC, if you clear your cookies in your browser or your device, you may need to use the GPC again for us to process your opt-out request for that browser or device. For more information about the GPC, please visit https://globalprivacycontrol.org. We do not respond to legacy browser-based “Do Not Track” (DNT).

Right to Limit the Processing of Sensitive Personal Information. California residents have a right to direct us to limit our use and/or disclosure of sensitive personal information to only what is necessary to perform services or for other internal business purposes. Where applicable, we will treat such an opt-out request as a revocation of any consent that you may have provided to your processing of sensitive personal information.

Automated Decision-Making and Profiling. State Privacy Laws provide for a right to opt out from “profiling” to support automated decisions that utilize your personal information and produce legal or similarly significant effects, such as the provision or denial of financial or lending services, or education enrollment or opportunities. We do not engage in profiling or use automated decision-making technology to make such decisions as defined by these laws, so we do not offer an opt out from this type of profiling.

Right to Non-Discrimination. You have the right to be free from discrimination and retaliation for exercising any of the rights described above.

Revocation of Consent. In certain contexts where required by State Privacy Laws or other laws, we may seek the consent of certain consumers to process, sell, or share their personal information or sensitive personal information. Consumers can revoke the consent they have provided (if any) by visiting our “Your Privacy Choices” page (click here for sallie.com or here for salliemae.com) or calling us at 855-582-1928.

Verification of Requests

To help protect your privacy and maintain security, we may need to collect information from you to verify your identity, such as your email address, full name, account information, or other personal information, before providing a response to the request.

We will review the information provided as part of your request and may ask you to provide additional information via email or other means as part of this verification process. We will not fulfill your Right to Know/Access, Right to Delete, Right to Correct, or Right to Request List of Third Parties unless you have provided sufficient information for us to reasonably verify you are the consumer about whom we collected personal information. The same verification process does not apply to requests to opt out of selling, sharing, or use for targeted advertising and requests to limit the processing of sensitive personal information, but we may apply some verification measures if we suspect fraud.

Our verification standards vary by type of request and sensitivity. We may verify your Right to Know requests and certain Right to Delete and Right to Correct requests by requiring matching of data you provide with data we maintain. For certain requests, we may apply a higher verification standard, which may include obtaining a signed declaration from you, under penalty of perjury, that you are the individual whose personal information is the subject of the request.

Some personal information we maintain about you is not sufficiently associated with enough of your other personal information for us to be able to verify that it is your particular personal information (e.g., certain clickstream data). We do not include such information in response to rights requests that require verification of your identity.

Authorized Agents

You may designate an authorized agent to submit a request on your behalf. If you are an authorized agent who would like to make a request, State Privacy Laws require that we ensure that a request made by an agent is verified (except do not sell/share requests) and allow us to request further information to ensure that the consumer has authorized you to make the request on their behalf. Generally, we will request that an agent provide proof that the consumer gave the agent signed permission to submit the request, and, as permitted under State Privacy Laws, we also may require the consumer to either verify their own identity or directly confirm with us that they provided the agent permission to submit the request. To make a request as an authorized agent on behalf of a consumer, please contact us using the information provided in the “Contact Us” section below.

Appeals

If we deny your request to exercise one of the rights listed above, you may have the right to appeal our decision. You may do so by following the instructions in our response to your initial request or contacting us via the information provided in the “Contact Us” section below.

C. Additional Disclosures for California Residents

The California “Shine the Light” law permits California residents to request certain details about how their “personal information” (as defined in California Civil Code Section 1798.83) is shared with third parties for their direct marketing purposes. We may from time to time elect to share certain personal information about you with third parties for those third parties’ direct marketing purposes. If you are a California resident, you may have the right to request that we provide you with (1) a list of certain categories of personal information we have disclosed to third parties for their direct marketing purposes during the immediately preceding calendar year and (2) the identity of those third parties. To make such a request, please contact us using the information listed in the “Contact Us” section below, label the request “Shine the Light Request,” and state that you are a California resident. Please note that we are only required to respond to one request per individual each year.

Any California residents under the age of eighteen (18) who have registered to use the Services and who have posted content or information on the Services can request that such information be removed from the Services by contacting us at the email or address set forth in the “Contact Us” section below. Such request must state that they personally posted such content or information and detail where the content or information is posted. We will make reasonably good faith efforts to remove the post from prospective public view or anonymize it so the individual cannot be individually identified. This removal process cannot ensure complete or comprehensive removal. For instance, third parties may have republished the post, and archived copies of it may be stored by search engines and other parties that we do not control.

D. Contact Us

If you have any questions about our Privacy Policy, this State Privacy Notice, or practices described in it, you may contact us at:

Sallie Customer Privacy
P.O. Box 3319
Wilmington, DE 19804-4319
855-582-1928

You may also contact us via email at: privacy@sallie.com.