Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Plaid settled $58M lawsuit over alleged consumer data sharing

finledger.com

Post reply on HN
Print view View original

91–100 of 156 posts

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#91

Post by oh_sigh »

jeandenis wrote: post #82
wheaties wrote: post #56

Earlier quoted context omitted.

I don't have the time to read and research exactly what happened. I see you settled for a large sum. Thus, I don't believe you. We've all been burned by companies that claim one thing and do the exact opposite. It doesn't matter if legally they are stating things accurately. What matters is how we, a mere human, would believe the plain English phrases used to be construed. Hope you have success and I have no ill will…

I understand your point (and yes we are all mere humans who like plain language). Your data goes from your bank to the app that you authorized, via Plaid. It is not sold to anybody.

Not to be nit-picky, but is that data(or derivatives of the data) gifted, given, bartered for, or otherwise sent to parties that are not (plaid, user bank, connected app)?

Neither here nor there, but I just used Plaid for the first time yesterday to pay for the downpayment on my Tesla. It was a really nice, seamless experience.

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#92

Post by RileyJames »

jeandenis wrote: post #52
akarma wrote: post #29

I actually mentioned in a thread about Plaid in 2018 that they sold transaction history to third parties, and the cofounder came onto HN to explicitly deny that [1]. I actually felt convinced they didn't afterwards, as I couldn't imagine such a direct and clear refutation if it were true. [1] https://news.ycombinator.com/item?id=18655417

Hey, CTO from Plaid here. We don’t, and have not, sold data. https://plaid.com/legal/#consumer-support As someone who has overseen our consumer privacy team over the past few years building out products like Plaid Link and Plaid Portal, I can attest this is a foremost priority for the company. FWIIW, I don’t agree with the allegations, and you can read our POV on this blog post. https://plaid.com/blog/plaids-commitme…

Based on this, and the blog post, they clearly take issue with the term ‘sold’. Making the users data accessible via api to customers who’ve paid for access to said data does not constitute ‘being sold’, as far as their lawyers are concerned. The fact that 98 million users disagree is unfortunate...

The product was sold as infrastructure, and used as data collection, and 98 million users were not aware of that.

If you’re unable to reconcile why users of square cash would be confused when they hear their data is accessible through some service called ‘plaid’ for which they’ve never signed up, or given their data, then maybe you could start with defining terms as they would, rather than how you’d prefer they sound.

Having data in a database doesn’t make it yours, it’s the users. It was when it was in their bank, it is when you move it to your service and it remains when you provide it to someone else.

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#93

Post by nemothekid »

majormajor wrote: post #62
collectedparts wrote: post #49

Earlier quoted context omitted.

The cofounder was telling the truth (or, at least, nothing in the lawsuit implies that he was not). The plaintiffs in this case are claiming that when they linked their bank accounts to PayPal/Venmo/etc using Plaid they didn't realize what they were doing, or that it's somehow unfair that Paypal/Venmo/etc got their banking data (despite knowingly inputting their credentials into Paypal/Venmo/etc). Paypal/Venmo/etc is…

The "using Plaid" part of what you're saying confuses me. My reading is that the plaintiffs are claiming that they signed up for Paypal or Venmo directly, linked their banks account, and were unaware that behind the scenes this meant their data went to Plaid, and that then Plaid both gathered data from this and sold the data. If that's accurate - if the plaintiffs were just trying to use Paypal + their bank account,…

>then any data being captured and stored by Plaid does sound extremely fishy

I've integrated with Plaid's API (a long time ago), and this doesn't sound fishy. Plaid's API is pretty comprehensive and it would have PayPal's job to unlink the connection after the verification took place. Plaid gives you a "token" representing the user that can be used to further look up information in their account - such as new transactions. If PayPal had naively enabled the usage of those APIs, then it's not surprising Plaid stored that data.

For example, if you (the API client) didn't want to store any information except for a user token (similar how you might store tokens with Stripe's API), then every time you needed to lookup the client's account number you would call Plaid's API to retrieve that data (which, by definition, they would be storing).

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#94

Post by jeandenis »

briffle wrote: post #86
jeandenis wrote: post #59

Earlier quoted context omitted.

(Plaid CTO here) You can use the Plaid Portal ( https://my.plaid.com ) to view what types of data are being shared, to revoke access (to both the apps and Plaid) and delete data stored in Plaid’s systems. You can also put a data deletion request through support. Not as per my comment above that we don’t, and have not, sold data. https://plaid.com/legal/#consumer-support

I have tried to login to this site, registered my phone number, and it says it can't find any accounts of mine. yet I know YNAB uses plaid as its backend, and has links to my banks, credit card companies, and even my mortgage. Is this a bug, or are those of use that use certain 3rd parties not able to see our data?

Would love to help with this. YNAB hasn't always been a Plaid customer, so it might have been a historical connection -- either way, please contact our support team to help you figure this out ASAP https://my.plaid.com/help

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#95

Post by majormajor »

nemothekid wrote: post #93
majormajor wrote: post #62

Earlier quoted context omitted.

The "using Plaid" part of what you're saying confuses me. My reading is that the plaintiffs are claiming that they signed up for Paypal or Venmo directly, linked their banks account, and were unaware that behind the scenes this meant their data went to Plaid, and that then Plaid both gathered data from this and sold the data. If that's accurate - if the plaintiffs were just trying to use Paypal + their bank account,…

> then any data being captured and stored by Plaid does sound extremely fishy I've integrated with Plaid's API (a long time ago), and this doesn't sound fishy. Plaid's API is pretty comprehensive and it would have PayPal's job to unlink the connection after the verification took place. Plaid gives you a "token" representing the user that can be used to further look up information in their account - such as new transa…

As a customer, though, that still sounds very dismaying to me.

If I'm linking my bank to paypal to send money back and forth, I don't want: (a) paypal getting transaction history, (b) a third party company hanging on to those credentials, (c) that third party company getting any view of transactions either. I just want Paypal to send/retrieve money.

I thought Plaid just translated "different bank acount APIs" to a dev-friendly one. If they're using that to collect a lot of data THEMSELVES from customers who just wanted bank interop... that's bad. Nobody "using" Plaid is intended to give this intermediary company all that info.

I'm linking my account to Paypal because I (thought that) I trusted Paypal. I never knew I was actually giving all this shit to this other company too.

(In my case, I've used routing number/checking number because they seemed to require handing over less privileges than my full password, and this certainly seems to reinforce my skepticism about using the "sign in to your bank" password auth for linkage.)

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#96

Post by sorry_outta_gas »

jeandenis wrote: post #52
akarma wrote: post #29

I actually mentioned in a thread about Plaid in 2018 that they sold transaction history to third parties, and the cofounder came onto HN to explicitly deny that [1]. I actually felt convinced they didn't afterwards, as I couldn't imagine such a direct and clear refutation if it were true. [1] https://news.ycombinator.com/item?id=18655417

Hey, CTO from Plaid here. We don’t, and have not, sold data. https://plaid.com/legal/#consumer-support As someone who has overseen our consumer privacy team over the past few years building out products like Plaid Link and Plaid Portal, I can attest this is a foremost priority for the company. FWIIW, I don’t agree with the allegations, and you can read our POV on this blog post. https://plaid.com/blog/plaids-commitme…

You should be ashamed of yourselves, period

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#97

Post by SevenSigs »

jeandenis wrote: post #94
briffle wrote: post #86

Earlier quoted context omitted.

I have tried to login to this site, registered my phone number, and it says it can't find any accounts of mine. yet I know YNAB uses plaid as its backend, and has links to my banks, credit card companies, and even my mortgage. Is this a bug, or are those of use that use certain 3rd parties not able to see our data?

Would love to help with this. YNAB hasn't always been a Plaid customer, so it might have been a historical connection -- either way, please contact our support team to help you figure this out ASAP https://my.plaid.com/help

You have customers that use consumer data and they don't have to pay for it? Where can I get this free data?

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#98

Post by xtracto »

ceejayoz wrote: post #31
Gh0stRAT wrote: post #15

Earlier quoted context omitted.

Chase is the only big US bank I'm aware of which lets you give Oauth tokens with limited permissions to third parties.

Capital One and Citi both have OAuth APIs that permit different levels of permissions.

And the Capital One flow was utter crap the last time I had to program against it. A past company I was in used a Plaid competitor that suddenly had to implement Capital One flow, which was utter shit, including their (Capital One) Sandbox environments that basically didn't work.

Banks are so held in last century technology...

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#99

Post by mdoms »

jeandenis wrote: post #52
akarma wrote: post #29

I actually mentioned in a thread about Plaid in 2018 that they sold transaction history to third parties, and the cofounder came onto HN to explicitly deny that [1]. I actually felt convinced they didn't afterwards, as I couldn't imagine such a direct and clear refutation if it were true. [1] https://news.ycombinator.com/item?id=18655417

Hey, CTO from Plaid here. We don’t, and have not, sold data. https://plaid.com/legal/#consumer-support As someone who has overseen our consumer privacy team over the past few years building out products like Plaid Link and Plaid Portal, I can attest this is a foremost priority for the company. FWIIW, I don’t agree with the allegations, and you can read our POV on this blog post. https://plaid.com/blog/plaids-commitme…

Hmmmm could have saved yourself a cool $58 million if what you're saying is true.

Re: Plaid settled $58M lawsuit over alleged consumer data sharing

#100

Post by ahzhou »

majormajor wrote: post #62
collectedparts wrote: post #49

Earlier quoted context omitted.

The cofounder was telling the truth (or, at least, nothing in the lawsuit implies that he was not). The plaintiffs in this case are claiming that when they linked their bank accounts to PayPal/Venmo/etc using Plaid they didn't realize what they were doing, or that it's somehow unfair that Paypal/Venmo/etc got their banking data (despite knowingly inputting their credentials into Paypal/Venmo/etc). Paypal/Venmo/etc is…

The "using Plaid" part of what you're saying confuses me. My reading is that the plaintiffs are claiming that they signed up for Paypal or Venmo directly, linked their banks account, and were unaware that behind the scenes this meant their data went to Plaid, and that then Plaid both gathered data from this and sold the data. If that's accurate - if the plaintiffs were just trying to use Paypal + their bank account,…

Check the source material. Here's the suit: https://www.classaction.org/media/cottle-et-al-v-plaid-inc.p....

The relevant section is on pg 16, under the heading "Plaid Sells and Otherwise Exploits the Unlawfully-Obtained Private Data".

The suit alleges that "Plaid has admitted that it routinely sells the consumer banking data it collects. At a minimum, Plaid sells the data it obtains from consumers’ accounts back to the very app providers, including the Participating Apps, who use its services. [40] Plaid calibrates its prices based on the type of information being sold. [41]".

Footnotes 40 and 41 are, respectively:

[40] See Feb. 21, 2017 Response by Plaid to CFPB’s RFI, https://plaid.com/documents/PlaidConsumer-Data-Access-RFI-Te... (Plaid acknowledges to CFPB that it sells data to party “permissioned” by consumer).

[41] See Feb. 2019 interview with Zach Perret, https://www.saastr.com/build-a-platformecosystem/.

-----

IANAL. The suit alleges that Plaid sells the data, with the specific proof that Plaid sells data to the authorized app (Paypal or Venmo in your example above). The plaintiffs do provide proof in the suit that Plaid sells the data to third parties, but suggest that Plaid might, since they already sell the data to the app that users authorized.

At risk of misrepresenting their argument, the suit seems to claim that Plaid doesn't do enough to give consumers (think average non-tech savvy person) enough of a heads up on what's happening behind the scenes. According to the suit, a consumer using Plaid doesn't understand that they give banking credentials to a third party (Plaid), which uses the credentials and "sells" data to the app that is being connected to the bank.

The above seems consistent to what the Plaid CTO wrote. I haven't seen anything that indicates Plaid sells your data to unrelated third parties. That said, I agree with the suit - Plaid should do a better job of making it clear exactly how your banking information is going to be used.

Post reply on HN