Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Plaid settled $58M lawsuit over alleged consumer data sharing

finledger.com

Post reply on HN
Print view View original

71–80 of 156 posts

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#71

Post by dreyfan »

jeandenis wrote: post #59
meowtimemania wrote: post #45

I’ve used Plaid to login to my bank account. How do I delete all my data from Plaid??

(Plaid CTO here) You can use the Plaid Portal ( https://my.plaid.com ) to view what types of data are being shared, to revoke access (to both the apps and Plaid) and delete data stored in Plaid’s systems. You can also put a data deletion request through support. Not as per my comment above that we don’t, and have not, sold data. https://plaid.com/legal/#consumer-support

Why did you settle for $58M in fines when Yodlee does the same thing but they very blatantly sell customer data, and as of yet, remain untouchable?

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#72

Post by akarma »

archenary wrote: post #66
akarma wrote: post #58

Earlier quoted context omitted.

Thank you for the response — I know you're likely very restricted in what you can say here, but: You just settled a claim that you sold customer transaction histories, and from the article linked, the plaintiffs' lawyers claim that you have agreed to implement meaningful business practice changes to remediate these issues. (1) If you've never sold transaction histories, why settle a lawsuit alleging that you sold tra…

IANAL and have no affiliations to Plaid. My takeaway from the article and [0] is that Plaid violated privacy laws because they provided insufficient disclosure with respect to the collected data, not that they are selling data to third parties. Edit: Update [0] to source [0] https://newmedialaw.proskauer.com/2021/05/11/plaid-federal-e...

(IANAL either) I understand and agree that part of the issue is that they, allegedly, underhandedly collected this data. My question is focused around the potential selling of that data, which took place according to the lawsuit and was likely the reason to collect the data.

From the article you linked:

> Plaid would retain access to their credentials and use them to mine, aggregate and then sell users’ financial transaction data to third parties (including to the fintech apps that use its services) for purposes unrelated to the plaintiffs’ use of the fintech payment apps.

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#73

Post by a-priori »

ac29 wrote: post #65
a-priori wrote: post #60

I just read the settlement document, and it looks like this is being reported incorrectly or at least ambiguously. The allegation is NOT that they shared/sold data to any third parties but that their Plaid Link user interface, where people enter their banking information to add it to Plaid, looks like the customer's financial institution (i.e, uses the bank's branding colours and logo). Because of this branding, peop…

Looks like there is some other deceptive stuff going on as well - for example, they apparently collected and stored transaction data even when developers didnt request it (at least, they are agreeing to delete this data now, so it must have been collected in some cases).

Again, I don't see anything shady there. There's two things I see in the settlement about that:

1. They proactively retrieved transaction data when you connect an account. This sounds like an assumption that almost always people are going to want transaction data, so they just do it by default, presumably to improve the first-time user experience so the data's already there when you later request it. This is going to be changed to only retrieve transaction data on demand.

2. If Plaid's connection is broken (e.g. the user changes their password) then Plaid deactivates the connection but keeps the data. They've agreed to delete the data in this case. The drawback of this change is that since many connectivity issues are going to be temporary, this means that in those cases they'll need to delete the data, then retrieve it again when the user reconnects.

Basically it sounds like they optimized a little too hard on user experience, especially when connecting a new account, and in the process they overstepped user consent. I don't see any bad intent there personally, it sounds like they were just a bit overzealous trying to make the experience super slick.

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#74

Post by themacguffinman »

wheaties wrote: post #56
jeandenis wrote: post #52

Earlier quoted context omitted.

Hey, CTO from Plaid here. We don’t, and have not, sold data. https://plaid.com/legal/#consumer-support As someone who has overseen our consumer privacy team over the past few years building out products like Plaid Link and Plaid Portal, I can attest this is a foremost priority for the company. FWIIW, I don’t agree with the allegations, and you can read our POV on this blog post. https://plaid.com/blog/plaids-commitme…

I don't have the time to read and research exactly what happened. I see you settled for a large sum. Thus, I don't believe you. We've all been burned by companies that claim one thing and do the exact opposite. It doesn't matter if legally they are stating things accurately. What matters is how we, a mere human, would believe the plain English phrases used to be construed. Hope you have success and I have no ill will…

A legal settlement over a lawsuit is the epitome of "if legally they are stating things accurately", how can you possibly conclude that their settlement relates to how you, a mere human, believe the English phrases to be constructed. One explanation is dismissed because it touches on supposedly irrelevant legal details yet your belief is based entirely on another legal detail. It sounds like you've made up your mind already regardless of what the "plain English" circumstances could be.

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#75

Post by lutorm »

ve55 wrote: post #2

It is particularly sad how common scenarios this are for users, especially in the US. I have known how terrible applications like Plaid (and alternatives) were, but at various points have been required to use them to do something like pay my rent (this is also a very common theme in my life: I strongly dislike a certain company or app, but find myself required to use them regardless, even knowing that my usage and in…

Isn't giving your credentials to a third party also a violation of the terms of service with your bank? It seems, at the very least, the bank will just tell you "too bad" if there's a breach and someone drains your bank account using the credentials you gave Plaid. You'd be left suing Plaid.

In fact, this seems like a _terrible_ liability for them. I guess they're hoping it won't happen and if it does then they'll just go bankrupt anyway?

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#76

Post by mikeiz404 »

jeandenis wrote: post #52
akarma wrote: post #29

I actually mentioned in a thread about Plaid in 2018 that they sold transaction history to third parties, and the cofounder came onto HN to explicitly deny that [1]. I actually felt convinced they didn't afterwards, as I couldn't imagine such a direct and clear refutation if it were true. [1] https://news.ycombinator.com/item?id=18655417

Hey, CTO from Plaid here. We don’t, and have not, sold data. https://plaid.com/legal/#consumer-support As someone who has overseen our consumer privacy team over the past few years building out products like Plaid Link and Plaid Portal, I can attest this is a foremost priority for the company. FWIIW, I don’t agree with the allegations, and you can read our POV on this blog post. https://plaid.com/blog/plaids-commitme…

I’m guessing this is the relevant section stating that summarized anonymized data is shared.

We may collect, use, and share End User Information in an aggregated, de-identified, or anonymized manner (that does not identify you personally) for any purpose permitted under applicable law. This includes creating or using aggregated, de-identified, or anonymized data based on the collected information to develop new services and to facilitate research.

We do not sell or rent personal information that we collect.

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#77

Post by newfonewhodis »

wheaties wrote: post #56
jeandenis wrote: post #52

Earlier quoted context omitted.

Hey, CTO from Plaid here. We don’t, and have not, sold data. https://plaid.com/legal/#consumer-support As someone who has overseen our consumer privacy team over the past few years building out products like Plaid Link and Plaid Portal, I can attest this is a foremost priority for the company. FWIIW, I don’t agree with the allegations, and you can read our POV on this blog post. https://plaid.com/blog/plaids-commitme…

I don't have the time to read and research exactly what happened. I see you settled for a large sum. Thus, I don't believe you. We've all been burned by companies that claim one thing and do the exact opposite. It doesn't matter if legally they are stating things accurately. What matters is how we, a mere human, would believe the plain English phrases used to be construed. Hope you have success and I have no ill will…

No company would settle for such a large sum unless they were guilty or afraid of going through discovery.

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#78

Post by stefan_ »

jeandenis wrote: post #52
akarma wrote: post #29

I actually mentioned in a thread about Plaid in 2018 that they sold transaction history to third parties, and the cofounder came onto HN to explicitly deny that [1]. I actually felt convinced they didn't afterwards, as I couldn't imagine such a direct and clear refutation if it were true. [1] https://news.ycombinator.com/item?id=18655417

Hey, CTO from Plaid here. We don’t, and have not, sold data. https://plaid.com/legal/#consumer-support As someone who has overseen our consumer privacy team over the past few years building out products like Plaid Link and Plaid Portal, I can attest this is a foremost priority for the company. FWIIW, I don’t agree with the allegations, and you can read our POV on this blog post. https://plaid.com/blog/plaids-commitme…

The old overly specific denial. Never did sell the data, but collected and stored it just in case you ever changed your mind about that.

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#79

Post by ac29 »

a-priori wrote: post #73
ac29 wrote: post #65

Earlier quoted context omitted.

Looks like there is some other deceptive stuff going on as well - for example, they apparently collected and stored transaction data even when developers didnt request it (at least, they are agreeing to delete this data now, so it must have been collected in some cases).

Again, I don't see anything shady there. There's two things I see in the settlement about that: 1. They proactively retrieved transaction data when you connect an account. This sounds like an assumption that almost always people are going to want transaction data, so they just do it by default, presumably to improve the first-time user experience so the data's already there when you later request it. This is going to…

Optimizing away user consent for collection and storage of highly sensitive banking transaction data certainly meets my bar for "shady".

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#80

Post by briffle »

wheaties wrote: post #56
jeandenis wrote: post #52

Earlier quoted context omitted.

Hey, CTO from Plaid here. We don’t, and have not, sold data. https://plaid.com/legal/#consumer-support As someone who has overseen our consumer privacy team over the past few years building out products like Plaid Link and Plaid Portal, I can attest this is a foremost priority for the company. FWIIW, I don’t agree with the allegations, and you can read our POV on this blog post. https://plaid.com/blog/plaids-commitme…

I don't have the time to read and research exactly what happened. I see you settled for a large sum. Thus, I don't believe you. We've all been burned by companies that claim one thing and do the exact opposite. It doesn't matter if legally they are stating things accurately. What matters is how we, a mere human, would believe the plain English phrases used to be construed. Hope you have success and I have no ill will…

Yep, its right up there on the 'corporate-speak' next to "we're taking these alegations very seriously"
Post reply on HN