Plaid settled $58M lawsuit over alleged consumer data sharing

The product was sold as infrastructure, and used as data collection, and 98 million users were not aware of that.

If you’re unable to reconcile why users of square cash would be confused when they hear their data is accessible through some service called ‘plaid’ for which they’ve never signed up, or given their data, then maybe you could start with defining terms as they would, rather than how you’d prefer they sound.

Having data in a database doesn’t make it yours, it’s the users. It was when it was in their bank, it is when you move it to your service and it remains when you provide it to someone else.

You just settled a claim that you sold customer transaction histories, and from the article linked, the plaintiffs' lawyers claim that you have agreed to implement meaningful business practice changes to remediate these issues.

(1) If you've never sold transaction histories, why settle a lawsuit alleging that you sold transaction histories?

(2) What meaningful business practice changes could you be making if there's no issue to begin with?

(I'm relying on the article here as a source of truth).

Hope you have success and I have no ill will towards you.

I don't know the details of this case so I have no strong opinions, but this response makes me trust you less, not more.

We may collect, use, and share End User Information in an aggregated, de-identified, or anonymized manner (that does not identify you personally) for any purpose permitted under applicable law. This includes creating or using aggregated, de-identified, or anonymized data based on the collected information to develop new services and to facilitate research.

We do not sell or rent personal information that we collect.

I'd like to take a minute though to express my frustration with the banks that refuse to supply any sort of limited APIs. How is it 2021 and I still can't give my tax person read only access to a specific year of transactions? Plaid and others trust issue would be so much easier if the banks had any sort of control over sharing aside from none or authorized to do anything.

I'd like to hear a broader statement on the specific phrasing in this article: « the fintech firm passed on personal banking data to third party firms without user consent ».

"According to the lawsuit, filed Thursday in California federal court, the plaintiffs alleged that Plaid has “exploited its position as middleman” to obtain app users’ banking login credentials and use that information to gain access to and sell their transaction histories. Allegedly, these actions occurred without users knowing about Plaid’s role is a variance of “deceptive tactics.”"

So, the lawsuit is for selling the transaction histories and you say you never did it.

Why do you settle for $58M if you never did it rather than go to court so that they present proofs that, according to your explanation, must be false?

I am not convinced.

Or, the simpler explanation you just lie here to us because you can. But you settle to not go to court because you know you can't lie yourself out of loosing.

The plaintiffs in this case are claiming that when they linked their bank accounts to PayPal/Venmo/etc using Plaid they didn't realize what they were doing, or that it's somehow unfair that Paypal/Venmo/etc got their banking data (despite knowingly inputting their credentials into Paypal/Venmo/etc).

Paypal/Venmo/etc is not a third party in that case. They're the party that the customer was knowingly interacting with.

A third party would be an unknown / unrelated data broker. Ie, the cofounder is claiming that they don't turn around and resell data to anyone other than the app that the customer was deliberately using.

1. They proactively retrieved transaction data when you connect an account. This sounds like an assumption that almost always people are going to want transaction data, so they just do it by default, presumably to improve the first-time user experience so the data's already there when you later request it. This is going to be changed to only retrieve transaction data on demand.

2. If Plaid's connection is broken (e.g. the user changes their password) then Plaid deactivates the connection but keeps the data. They've agreed to delete the data in this case. The drawback of this change is that since many connectivity issues are going to be temporary, this means that in those cases they'll need to delete the data, then retrieve it again when the user reconnects.

Basically it sounds like they optimized a little too hard on user experience, especially when connecting a new account, and in the process they overstepped user consent. I don't see any bad intent there personally, it sounds like they were just a bit overzealous trying to make the experience super slick.

At least if the bank implements some sort of API that means some thought was probably given toward using tokens instead username/password, and some thought was given toward scoping the APIs - at least into read-only and read-write capable access.

Although if you read between the lines in some of the service descriptions and backend documentation, a lot of what Plaid (and Yodlee, and others) do is now a mix of scraping and private APIs the banks provide, but those APIs are only available to commercial entities they've signed a relationship with.

Obviously the ideal is public standardized APIs all banks provide with established security-focused practices and read-only limited data access as an option. But proprietary per-bank APIs available to the general public would be a good step forward.

Is this a bug, or are those of use that use certain 3rd parties not able to see our data?