Live data from Hacker News

Plaid settled $58M lawsuit over alleged consumer data sharing

finledger.com

131–140 of 156 posts

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#131
Can we, for a moment, talk about how evil the very concept of Plaid is? We are literally TRAINING people to turn OFF 2FA on their bank accounts and give someone else their passwords! Yes, you read that right!

And then we wonder why phishing works so well, and why 2FA is not widely used...

I already advised everyone I know against Plaid, and am working with my bank's local branch to disable any and all access from their IPs, and force anyone whose passwords have been compromised (make no mistake, giving your password away is a compromise) to change their passwords and enable 2FA.

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#132
post #2

It is particularly sad how common scenarios this are for users, especially in the US. I have known how terrible applications like Plaid (and alternatives) were, but at various points have been required to use them to do something like pay my rent (this is also a very common theme in my life: I strongly dislike a certain company or app, but find myself required to use them regardless, even knowing that my usage and in…

Required to use to pay your rent? Don’t think that is enforceable, is it?

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#133
post #29

I actually mentioned in a thread about Plaid in 2018 that they sold transaction history to third parties, and the cofounder came onto HN to explicitly deny that [1]. I actually felt convinced they didn't afterwards, as I couldn't imagine such a direct and clear refutation if it were true. [1] https://news.ycombinator.com/item?id=18655417

Hey, CTO from Plaid here. We don’t, and have not, sold data. https://plaid.com/legal/#consumer-support As someone who has overseen our consumer privacy team over the past few years building out products like Plaid Link and Plaid Portal, I can attest this is a foremost priority for the company. FWIIW, I don’t agree with the allegations, and you can read our POV on this blog post. https://plaid.com/blog/plaids-commitme…

I see a lot of suspicion in thread below, which I very much understand.

I'd like to take a minute though to express my frustration with the banks that refuse to supply any sort of limited APIs. How is it 2021 and I still can't give my tax person read only access to a specific year of transactions? Plaid and others trust issue would be so much easier if the banks had any sort of control over sharing aside from none or authorized to do anything.

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#134
post #128

Earlier quoted context omitted.

I replied in a few other threads on this. We don't make the user's data accessible via API outside of the app the user connected. Your personal data is not sold or rented or given away or bartered to parties that are not Plaid, your bank, or the connected app. We talk about all of this in our privacy policy, including ways that data could be used — for example, with data processors/service providers (like AWS which h…

I don't think the policy helps much. For example, > We share your End User Information for a number of business purposes: > - With the developer of the application you are using and as directed by that developer (such as with another third party if directed by you); > - With our data processors and other service providers, partners, or contractors in connection with the services they perform for us or developers; Thi…

>What Plaid lawyers will argue it means when pressed is a further question.

And thanks to Plaid settling, their lawyers won't be pressed.

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#135
post #72

Earlier quoted context omitted.

IANAL and have no affiliations to Plaid. My takeaway from the article and [0] is that Plaid violated privacy laws because they provided insufficient disclosure with respect to the collected data, not that they are selling data to third parties. Edit: Update [0] to source [0] https://newmedialaw.proskauer.com/2021/05/11/plaid-federal-e...

(IANAL either) I understand and agree that part of the issue is that they, allegedly, underhandedly collected this data. My question is focused around the potential selling of that data, which took place according to the lawsuit and was likely the reason to collect the data. From the article you linked: > Plaid would retain access to their credentials and use them to mine, aggregate and then sell users’ financial tra…

> My question is focused around the potential selling of that data, which took place according to the lawsuit and was likely the reason to collect the data.

They would kind of have to be idiots to do so, to be quite frank.

Up until like a year ago, their baseline product was $500 / mo plus $x / user after 100 users (iirc) with a 12 month contract.

Plaid has basically no competition, is worth billions and was almost acquired if not for an anti-trust suit.

I am not sure how Plaid or its founders would benefit financially by betraying the trust of their customers and their customers' customers by getting a few cents per record out of it.

> Plaid would retain access to their credentials and use them to mine, aggregate and then sell users’ financial transaction data to third parties (including to the fintech apps that use its services) for purposes unrelated to the plaintiffs’ use of the fintech payment apps.

People's hatred / mistrust of Plaid stems for a misunderstanding of what Plaid is.

Yes, Plaid does """sell""" that information... to the app that you willfully gave permission to, information like cash flow, debt, types of debt, etc.

Oh, also, if people are so terrified of Plaid, they should write to the Congresspeople and ask them to write a bill to force banks to write & provide REST APIs. The lack of banking APIs is the only reason Plaid exists and has to resort to scraping or storing banking information.

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#136
post #72

Earlier quoted context omitted.

(IANAL either) I understand and agree that part of the issue is that they, allegedly, underhandedly collected this data. My question is focused around the potential selling of that data, which took place according to the lawsuit and was likely the reason to collect the data. From the article you linked: > Plaid would retain access to their credentials and use them to mine, aggregate and then sell users’ financial tra…

I haven't used Plaid and I haven't read the litigation, but it seems the following scenario may have happened: 1) Users use Plaid to buy/sell with a variety of vendors and banks 2) Vendors and banks were aware that specific users were buying /selling because they were buying/selling their products 3) Users consented to #2 because they were buying/selling their products 4) Plaid provided aggregated reports that said "…

[deleted]

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#137

Earlier quoted context omitted.

Hey, CTO from Plaid here. We don’t, and have not, sold data. https://plaid.com/legal/#consumer-support As someone who has overseen our consumer privacy team over the past few years building out products like Plaid Link and Plaid Portal, I can attest this is a foremost priority for the company. FWIIW, I don’t agree with the allegations, and you can read our POV on this blog post. https://plaid.com/blog/plaids-commitme…

I don't understand something. Please, help me understand: "According to the lawsuit, filed Thursday in California federal court, the plaintiffs alleged that Plaid has “exploited its position as middleman” to obtain app users’ banking login credentials and use that information to gain access to and sell their transaction histories. Allegedly, these actions occurred without users knowing about Plaid’s role is a varianc…

Here's my dumb explanation:

Ever seen Fight Club and that recall equation?

Yeah, that's why. It would cost them more time, bad PR and money to fight than it would be to just settle and take the lumps even if it is untrue.

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#138
post #130

Earlier quoted context omitted.

Part of the challenge is there is no great way to easily get my data out of banks and accessible in one place. Business model aside, they do solve a real problem in a space where there are no real incentives for banks to provide their own solution. I'd love to see a subscription-based, privacy-focused option with API access targeting the consumer personal finance crowd. I think Tiller may get some of the way there, b…

Isn't there a standard API used in the US? GNU cash talks about it some in their documentation but I've never tried using it.

Nope!

US banks seem to have zero interest in doing so because it doesn't bring them money and Congress isn't interested in forcing them to. EU though is working on a solution between themselves. [0]

US banks solutions range between "screw off, no scraping allowed even on your account" to (probably) "here's an undocumented SOAP API last touched in 1998"

[0]: https://www.americanbanker.com/opinion/europes-new-api-rules...

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#139

Earlier quoted context omitted.

I don't understand something. Please, help me understand: "According to the lawsuit, filed Thursday in California federal court, the plaintiffs alleged that Plaid has “exploited its position as middleman” to obtain app users’ banking login credentials and use that information to gain access to and sell their transaction histories. Allegedly, these actions occurred without users knowing about Plaid’s role is a varianc…

Here's my dumb explanation: Ever seen Fight Club and that recall equation? Yeah, that's why. It would cost them more time, bad PR and money to fight than it would be to just settle and take the lumps even if it is untrue.

$58M?

In this case, you ask to dismiss the case for lack of evidence. That is, if you are innocent and there really is no evidence.

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#140
post #71

Earlier quoted context omitted.

(Plaid CTO here) You can use the Plaid Portal ( https://my.plaid.com ) to view what types of data are being shared, to revoke access (to both the apps and Plaid) and delete data stored in Plaid’s systems. You can also put a data deletion request through support. Not as per my comment above that we don’t, and have not, sold data. https://plaid.com/legal/#consumer-support

Why did you settle for $58M in fines when Yodlee does the same thing but they very blatantly sell customer data, and as of yet, remain untouchable?

Visibility in my opinion.

Plaid is a financially juicy target that has a lot of customers.

Post reply on HN