8 ms·

I actually mentioned in a thread about Plaid in 2018 that they sold transaction history to third parties, and the cofounder came onto HN to explicitly deny that

by akarma 5y ago

I actually mentioned in a thread about Plaid in 2018 that they sold transaction history to third parties, and the cofounder came onto HN to explicitly deny that [1]. I actually felt convinced they didn't afterwards, as I couldn't imagine such a direct and clear refutation if it were true. [1] https://news.ycombinator.com/item?id=18655417 https://news.ycombinator.com/item?id=18655417

tartoran 5y ago
So the cofounder was not telling the truth then?
- edoceo 5y ago
  Correct.
- collectedparts 5y ago
  The cofounder was telling the truth (or, at least, nothing in the lawsuit implies that he was not). The plaintiffs in this case are claiming that when they linked their bank accounts to PayPal/Venmo/etc using Plaid they didn't realize what they were doing, or that it's somehow unfair that Paypal/Venmo/etc got their banking data (despite knowingly inputting their credentials into Paypal/Venmo/etc). Paypal/Venmo/etc is not a third party in that case. They're the party that the customer was knowingly interacting with. A third party would be an unknown / unrelated data broker. Ie, the cofounder is claiming that they don't turn around and resell data to anyone other than the app that the customer was deliberately using.
  - akarma 5y ago
    The link mentions third party firms: > Plaid has settled a $58 million class action lawsuit over claims that the fintech firm passed on personal banking data to third party firms without user consent. and selling transaction histories: > the plaintiffs alleged that Plaid has “exploited its position as middleman” to obtain app users’ banking login credentials and use that information to gain access to and sell their transaction histories. For what it's worth I haven't read the actual lawsuit yet, but would love a link if it refutes the article.
    - ahzhou 5y ago
      Here's the actual suit. https://www.classaction.org/media/cottle-et-al-v-plaid-inc.pdf https://www.classaction.org/media/cottle-et-al-v-plaid-inc.p.... I wrote a post above on my take but TL;DR - I think that the suit is mostly alleging that Plaid doesn't do enough disclosure of what's happening behind the scenes. It suggests that Plaid might sell the data to unrelated third parties, but doesn't support it with any proof. It does support itself with proof that Plaid "sells" data to the app that is being connected to the bank.
  - majormajor 5y ago
    The "using Plaid" part of what you're saying confuses me. My reading is that the plaintiffs are claiming that they signed up for Paypal or Venmo directly, linked their banks account, and were unaware that behind the scenes this meant their data went to Plaid, and that then Plaid both gathered data from this and sold the data. If that's accurate - if the plaintiffs were just trying to use Paypal + their bank account, and only coincidentally using Plaid because Paypal used Plaid - then any data being captured and stored by Plaid does sound extremely fishy. I'd want them to just be a bridge to let info flow between the bank and Paypal, not store any of that themselves too. That part seems sketchy even if they never sold it - I still don't think they should keep it in the first place.
    - nemothekid 5y ago
      >then any data being captured and stored by Plaid does sound extremely fishy I've integrated with Plaid's API (a long time ago), and this doesn't sound fishy. Plaid's API is pretty comprehensive and it would have PayPal's job to unlink the connection after the verification took place. Plaid gives you a "token" representing the user that can be used to further look up information in their account - such as new transactions. If PayPal had naively enabled the usage of those APIs, then it's not surprising Plaid stored that data. For example, if you (the API client) didn't want to store any information except for a user token (similar how you might store tokens with Stripe's API), then every time you needed to lookup the client's account number you would call Plaid's API to retrieve that data (which, by definition, they would be storing).
      - majormajor 5y ago
        As a customer, though, that still sounds very dismaying to me. If I'm linking my bank to paypal to send money back and forth, I don't want: (a) paypal getting transaction history, (b) a third party company hanging on to those credentials, (c) that third party company getting any view of transactions either. I just want Paypal to send/retrieve money. I thought Plaid just translated "different bank acount APIs" to a dev-friendly one. If they're using that to collect a lot of data THEMSELVES from customers who just wanted bank interop... that's bad. Nobody "using" Plaid is intended to give this intermediary company all that info. I'm linking my account to Paypal because I (thought that) I trusted Paypal. I never knew I was actually giving all this shit to this other company too. (In my case, I've used routing number/checking number because they seemed to require handing over less privileges than my full password, and this certainly seems to reinforce my skepticism about using the "sign in to your bank" password auth for linkage.)
Justin_K 5y ago
Unreal... straight up lies and fraud if you ask me.
NicoJuicy 5y ago
Let's see if @whockey has the balls to come explain him. But, we're not in Japan. So i doubt he will.
newfonewhodis 5y ago
Wow what a jerk. Very, very explicit lie: > Plaid used consumers’ banking login credentials to gather and distribute detailed financial data without prior consent > Allegedly, these actions occurred without users knowing about Plaid’s role is a variance of “deceptive tactics.” And for all this: > If all 98 million people were to file a claim, each would receive just 60 cents. > The San-Francisco based platform raised a $425 million funding round in April The current capitalistic system is broken beyond repair. We need stricter corporate regulation (especially in fintech but more broadly) very urgently.
- cowpig 5y ago
  dude you can't just drop a hard R like that on HN
908087 5y ago
Archived: https://archive.fo/kWPJk https://archive.fo/kWPJk https://web.archive.org/web/20210816190158/https://news.ycombinator.com/item?id=18655417 https://web.archive.org/web/20210816190158/https://news.ycom...
jeandenis 5y ago
Hey, CTO from Plaid here. We don’t, and have not, sold data. https://plaid.com/legal/#consumer-support https://plaid.com/legal/#consumer-support As someone who has overseen our consumer privacy team over the past few years building out products like Plaid Link and Plaid Portal, I can attest this is a foremost priority for the company. FWIIW, I don’t agree with the allegations, and you can read our POV on this blog post. https://plaid.com/blog/plaids-commitment-to-consumer-privacy/ https://plaid.com/blog/plaids-commitment-to-consumer-privacy...
- deleted 5y ago
  [deleted]
- wheaties 5y ago
  I don't have the time to read and research exactly what happened. I see you settled for a large sum. Thus, I don't believe you. We've all been burned by companies that claim one thing and do the exact opposite. It doesn't matter if legally they are stating things accurately. What matters is how we, a mere human, would believe the plain English phrases used to be construed. Hope you have success and I have no ill will towards you.
  - themacguffinman 5y ago
    A legal settlement over a lawsuit is the epitome of "if legally they are stating things accurately", how can you possibly conclude that their settlement relates to how you, a mere human, believe the English phrases to be constructed. One explanation is dismissed because it touches on supposedly irrelevant legal details yet your belief is based entirely on another legal detail. It sounds like you've made up your mind already regardless of what the "plain English" circumstances could be.
  - newfonewhodis 5y ago
    No company would settle for such a large sum unless they were guilty or afraid of going through discovery.
    - 5y ago

by akarma 5y ago

tartoran 5y ago

So the cofounder was not telling the truth then?

edoceo 5y ago
Correct.
collectedparts 5y ago
The cofounder was telling the truth (or, at least, nothing in the lawsuit implies that he was not). The plaintiffs in this case are claiming that when they linked their bank accounts to PayPal/Venmo/etc using Plaid they didn't realize what they were doing, or that it's somehow unfair that Paypal/Venmo/etc got their banking data (despite knowingly inputting their credentials into Paypal/Venmo/etc). Paypal/Venmo/etc is not a third party in that case. They're the party that the customer was knowingly interacting with. A third party would be an unknown / unrelated data broker. Ie, the cofounder is claiming that they don't turn around and resell data to anyone other than the app that the customer was deliberately using.
- akarma 5y ago
  The link mentions third party firms: > Plaid has settled a $58 million class action lawsuit over claims that the fintech firm passed on personal banking data to third party firms without user consent. and selling transaction histories: > the plaintiffs alleged that Plaid has “exploited its position as middleman” to obtain app users’ banking login credentials and use that information to gain access to and sell their transaction histories. For what it's worth I haven't read the actual lawsuit yet, but would love a link if it refutes the article.
  - ahzhou 5y ago
    Here's the actual suit. https://www.classaction.org/media/cottle-et-al-v-plaid-inc.pdf https://www.classaction.org/media/cottle-et-al-v-plaid-inc.p.... I wrote a post above on my take but TL;DR - I think that the suit is mostly alleging that Plaid doesn't do enough disclosure of what's happening behind the scenes. It suggests that Plaid might sell the data to unrelated third parties, but doesn't support it with any proof. It does support itself with proof that Plaid "sells" data to the app that is being connected to the bank.
- majormajor 5y ago
  The "using Plaid" part of what you're saying confuses me. My reading is that the plaintiffs are claiming that they signed up for Paypal or Venmo directly, linked their banks account, and were unaware that behind the scenes this meant their data went to Plaid, and that then Plaid both gathered data from this and sold the data. If that's accurate - if the plaintiffs were just trying to use Paypal + their bank account, and only coincidentally using Plaid because Paypal used Plaid - then any data being captured and stored by Plaid does sound extremely fishy. I'd want them to just be a bridge to let info flow between the bank and Paypal, not store any of that themselves too. That part seems sketchy even if they never sold it - I still don't think they should keep it in the first place.
  - nemothekid 5y ago
    >then any data being captured and stored by Plaid does sound extremely fishy I've integrated with Plaid's API (a long time ago), and this doesn't sound fishy. Plaid's API is pretty comprehensive and it would have PayPal's job to unlink the connection after the verification took place. Plaid gives you a "token" representing the user that can be used to further look up information in their account - such as new transactions. If PayPal had naively enabled the usage of those APIs, then it's not surprising Plaid stored that data. For example, if you (the API client) didn't want to store any information except for a user token (similar how you might store tokens with Stripe's API), then every time you needed to lookup the client's account number you would call Plaid's API to retrieve that data (which, by definition, they would be storing).
    - majormajor 5y ago
      As a customer, though, that still sounds very dismaying to me. If I'm linking my bank to paypal to send money back and forth, I don't want: (a) paypal getting transaction history, (b) a third party company hanging on to those credentials, (c) that third party company getting any view of transactions either. I just want Paypal to send/retrieve money. I thought Plaid just translated "different bank acount APIs" to a dev-friendly one. If they're using that to collect a lot of data THEMSELVES from customers who just wanted bank interop... that's bad. Nobody "using" Plaid is intended to give this intermediary company all that info. I'm linking my account to Paypal because I (thought that) I trusted Paypal. I never knew I was actually giving all this shit to this other company too. (In my case, I've used routing number/checking number because they seemed to require handing over less privileges than my full password, and this certainly seems to reinforce my skepticism about using the "sign in to your bank" password auth for linkage.)

Justin_K 5y ago

Unreal... straight up lies and fraud if you ask me.

NicoJuicy 5y ago

Let's see if @whockey has the balls to come explain him. But, we're not in Japan. So i doubt he will.

newfonewhodis 5y ago

Wow what a jerk. Very, very explicit lie: > Plaid used consumers’ banking login credentials to gather and distribute detailed financial data without prior consent > Allegedly, these actions occurred without users knowing about Plaid’s role is a variance of “deceptive tactics.” And for all this: > If all 98 million people were to file a claim, each would receive just 60 cents. > The San-Francisco based platform raised a $425 million funding round in April The current capitalistic system is broken beyond repair. We need stricter corporate regulation (especially in fintech but more broadly) very urgently.

cowpig 5y ago
dude you can't just drop a hard R like that on HN

908087 5y ago

Archived: https://archive.fo/kWPJk https://archive.fo/kWPJk https://web.archive.org/web/20210816190158/https://news.ycombinator.com/item?id=18655417 https://web.archive.org/web/20210816190158/https://news.ycom...

jeandenis 5y ago

Hey, CTO from Plaid here. We don’t, and have not, sold data. https://plaid.com/legal/#consumer-support https://plaid.com/legal/#consumer-support As someone who has overseen our consumer privacy team over the past few years building out products like Plaid Link and Plaid Portal, I can attest this is a foremost priority for the company. FWIIW, I don’t agree with the allegations, and you can read our POV on this blog post. https://plaid.com/blog/plaids-commitment-to-consumer-privacy/ https://plaid.com/blog/plaids-commitment-to-consumer-privacy...

deleted 5y ago
[deleted]
wheaties 5y ago
I don't have the time to read and research exactly what happened. I see you settled for a large sum. Thus, I don't believe you. We've all been burned by companies that claim one thing and do the exact opposite. It doesn't matter if legally they are stating things accurately. What matters is how we, a mere human, would believe the plain English phrases used to be construed. Hope you have success and I have no ill will towards you.
- themacguffinman 5y ago
  A legal settlement over a lawsuit is the epitome of "if legally they are stating things accurately", how can you possibly conclude that their settlement relates to how you, a mere human, believe the English phrases to be constructed. One explanation is dismissed because it touches on supposedly irrelevant legal details yet your belief is based entirely on another legal detail. It sounds like you've made up your mind already regardless of what the "plain English" circumstances could be.
- newfonewhodis 5y ago
  No company would settle for such a large sum unless they were guilty or afraid of going through discovery.
  - 5y ago