Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Plaid settled $58M lawsuit over alleged consumer data sharing

finledger.com

Post reply on HN
Print view View original

101–110 of 156 posts

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#101

Post by lancesells »

jjulius wrote: post #85
mikeiz404 wrote: post #76

Earlier quoted context omitted.

I’m guessing this is the relevant section stating that summarized anonymized data is shared. We may collect, use, and share End User Information in an aggregated, de-identified, or anonymized manner (that does not identify you personally) for any purpose permitted under applicable law. This includes creating or using aggregated, de-identified, or anonymized data based on the collected information to develop new servi…

>We do not... rent personal information that we collect. Forgive my ignorance here, but how exactly would one "rent" personal information?

Access through something like an API and then losing access once you stop paying your monthly fee?

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#102

Post by sodality2 »

jjulius wrote: post #85
mikeiz404 wrote: post #76

Earlier quoted context omitted.

I’m guessing this is the relevant section stating that summarized anonymized data is shared. We may collect, use, and share End User Information in an aggregated, de-identified, or anonymized manner (that does not identify you personally) for any purpose permitted under applicable law. This includes creating or using aggregated, de-identified, or anonymized data based on the collected information to develop new servi…

>We do not... rent personal information that we collect. Forgive my ignorance here, but how exactly would one "rent" personal information?

Sell a subscription to access current transactional data. Like if Verizon charged $x/mo to have access to call logs, and was sold to advertisers

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#103

Post by kodah »

newfonewhodis wrote: post #77
wheaties wrote: post #56

Earlier quoted context omitted.

I don't have the time to read and research exactly what happened. I see you settled for a large sum. Thus, I don't believe you. We've all been burned by companies that claim one thing and do the exact opposite. It doesn't matter if legally they are stating things accurately. What matters is how we, a mere human, would believe the plain English phrases used to be construed. Hope you have success and I have no ill will…

No company would settle for such a large sum unless they were guilty or afraid of going through discovery.

As an engineer that's had to advise corporate legal on how to look at various things I can assure you that most of it is just risk mitigation and reward. From lawsuits to contracts, it's all the same stuff. That's just how legal people think. I don't think it goes any deeper than that.

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#104

Post by ahzhou »

akarma wrote: post #54
collectedparts wrote: post #49

Earlier quoted context omitted.

The cofounder was telling the truth (or, at least, nothing in the lawsuit implies that he was not). The plaintiffs in this case are claiming that when they linked their bank accounts to PayPal/Venmo/etc using Plaid they didn't realize what they were doing, or that it's somehow unfair that Paypal/Venmo/etc got their banking data (despite knowingly inputting their credentials into Paypal/Venmo/etc). Paypal/Venmo/etc is…

The link mentions third party firms: > Plaid has settled a $58 million class action lawsuit over claims that the fintech firm passed on personal banking data to third party firms without user consent. and selling transaction histories: > the plaintiffs alleged that Plaid has “exploited its position as middleman” to obtain app users’ banking login credentials and use that information to gain access to and sell their t…

Here's the actual suit. https://www.classaction.org/media/cottle-et-al-v-plaid-inc.p....

I wrote a post above on my take but TL;DR - I think that the suit is mostly alleging that Plaid doesn't do enough disclosure of what's happening behind the scenes. It suggests that Plaid might sell the data to unrelated third parties, but doesn't support it with any proof. It does support itself with proof that Plaid "sells" data to the app that is being connected to the bank.

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#105

Post by ahzhou »

a-priori wrote: post #60

I just read the settlement document, and it looks like this is being reported incorrectly or at least ambiguously. The allegation is NOT that they shared/sold data to any third parties but that their Plaid Link user interface, where people enter their banking information to add it to Plaid, looks like the customer's financial institution (i.e, uses the bank's branding colours and logo). Because of this branding, peop…

+1. Bad reporting here. This seems to be mostly about consumer disclosure, not that what's happening under-the-hood is different that what your average security-conscious developer might expect after reading that Plaid doesn't sell your data.

That said I think the suit makes a compelling argument that the disclosures should be better.

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#106

Post by infogulch »

oh_sigh wrote: post #91
jeandenis wrote: post #82

Earlier quoted context omitted.

I understand your point (and yes we are all mere humans who like plain language). Your data goes from your bank to the app that you authorized, via Plaid. It is not sold to anybody.

Not to be nit-picky, but is that data(or derivatives of the data) gifted, given, bartered for, or otherwise sent to parties that are not (plaid, user bank, connected app)? Neither here nor there, but I just used Plaid for the first time yesterday to pay for the downpayment on my Tesla. It was a really nice, seamless experience.

I would also like to see the (notably, very carefully followed) 'data is not sold' line strengthened to include all other forms of transmission.

Also a happy user of a service enabled by plaid tech.

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#107

Post by Graffur »

g_p wrote: post #9
cmer wrote: post #5

It is absolutely crazy that in 2021, banks still don't have proper secure APIs for other software to interface with. Plaid is a major disaster waiting to happen. Are there any banks moving in that direction? I know of exactly zero in Canada.

The UK and EU have both adopted effectively what you describe under PSD2 - the UK banks in particular were forced by their competition and markets regulator (CMA) to adopt open interoperable APIs. The end result, now it's available, is that you have 2 levels of API access. One is for access to account information (I tend to think of this as read-only access), and the other is to allow for "payment initiation" (think…

From my view, PSD2 has been slowly and terribly introduced. Would love to hear from some people who are AISPs or PISPs though.

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#108

Post by jeandenis »

phyzome wrote: post #67
jeandenis wrote: post #52

Earlier quoted context omitted.

Hey, CTO from Plaid here. We don’t, and have not, sold data. https://plaid.com/legal/#consumer-support As someone who has overseen our consumer privacy team over the past few years building out products like Plaid Link and Plaid Portal, I can attest this is a foremost priority for the company. FWIIW, I don’t agree with the allegations, and you can read our POV on this blog post. https://plaid.com/blog/plaids-commitme…

Facebook claimed repeatedly that they had never sold user data, and it turns out this was true: Instead, they had bartered user data for increased access or other privileges elsewhere. I'd like to hear a broader statement on the specific phrasing in this article: « the fintech firm passed on personal banking data to third party firms without user consent ».

No, your personal data is not sold or rented or given away or bartered to parties that are not Plaid, your bank, or the connected app. We talk about all of this in our privacy policy, including ways that data could be used — for example, with data processors/service providers (like AWS which hosts our services) for the purposes of running Plaid’s services or for a user’s connected app to provide their services.

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#109

Post by owenversteeg »

ahzhou wrote: post #100
majormajor wrote: post #62

Earlier quoted context omitted.

The "using Plaid" part of what you're saying confuses me. My reading is that the plaintiffs are claiming that they signed up for Paypal or Venmo directly, linked their banks account, and were unaware that behind the scenes this meant their data went to Plaid, and that then Plaid both gathered data from this and sold the data. If that's accurate - if the plaintiffs were just trying to use Paypal + their bank account,…

Check the source material. Here's the suit: https://www.classaction.org/media/cottle-et-al-v-plaid-inc.p... . The relevant section is on pg 16, under the heading "Plaid Sells and Otherwise Exploits the Unlawfully-Obtained Private Data". The suit alleges that "Plaid has admitted that it routinely sells the consumer banking data it collects. At a minimum, Plaid sells the data it obtains from consumers’ accounts back to…

So, in other words, they're selling my data, just not to third parties. So when I go to click "connect to Plaid", now whoever I'm connecting to suddenly has every single transaction from my bank/credit card/whatever I just connected.

So still a privacy nightmare, just a slightly different one.

What's so hard about not selling my data at all, and not collecting any data except for what's absolutely necessary to connect A to B?

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#110

Post by jeandenis »

infogulch wrote: post #106
oh_sigh wrote: post #91

Earlier quoted context omitted.

Not to be nit-picky, but is that data(or derivatives of the data) gifted, given, bartered for, or otherwise sent to parties that are not (plaid, user bank, connected app)? Neither here nor there, but I just used Plaid for the first time yesterday to pay for the downpayment on my Tesla. It was a really nice, seamless experience.

I would also like to see the (notably, very carefully followed) 'data is not sold' line strengthened to include all other forms of transmission. Also a happy user of a service enabled by plaid tech.

I replied in some other thread. Copy-pasta:

No, your personal data is not sold or rented or given away or bartered to parties that are not Plaid, your bank, or the connected app. We talk about all of this in our privacy policy, including ways that data could be used — for example, with data processors/service providers (like AWS which hosts our services) for the purposes of running Plaid’s services or for a user’s connected app to provide their services.

Post reply on HN