Fintech Company Plaid Hit With Privacy Suit Over Database of Transactional Data
"If consumers don't know that Plaid exists, they certainly cannot consent to Plaid taking their data," wrote attorneys from Robins Kaplan in a lawsuit alleging that Plaid Inc. illegally tracks millions of consumers' financial data.
June 25, 2020 at 10:18 PM
5 minute read
Correction: An earlier version of this story characterized Visa's pending acquisition of Plaid as final.
Venmo and Cash App users are suing a financial technology company for allegedly creating one of the largest databases of transactional data in history "through a decade-long campaign of lies and deceit," according to a lawsuit in California federal court.
In a class action complaint filed in the U.S. District Court for the Northern District of California Thursday, attorneys from Robins Kaplan assert that Plaid Inc., a service that connects payment apps to banks, has violated the privacy rights of millions of consumers.
"Imagine there is a company that knows every dollar you deposit or withdraw, every dollar you charge or pay to your credit card, and every dollar you put away for retirement, within hours after you make the transaction," wrote a team of Robbins Kaplan attorneys led by Michael Ram in Mountain View, California. "Imagine that, as far as you know, you never provided your username and password to this company or otherwise authorized it to access your online accounts. Imagine you never heard of this company at all. That company exists. It is called Plaid. And this is exactly what it does."
Plaid, which Visa announced plans to acquire in January, said in an email statement that the lawsuit is baseless and the company plans to vigorously defend itself.
"Plaid does not sell and has never sold consumers' personal information or data," said a spokesperson for Plaid. "Consumer data is obtained and used with consumer consent. We believe strongly that consumers should have permission-based access to and control over their financial data, and embody these principles in our practices."
The complaint contends that, after connecting consumers' payment apps to their banks, Plaid stores their credentials and uses them to collect five years worth of transactional data and continues to track users' data going forward. Plaintiffs claim that the data-gathering scheme is not incidental to the company's business model, and in fact, it is Plaid's "very purpose."
"Plaid's scheme is a bait and switch—a sophisticated imitation of the logos and branding of major financial institutions, designed to fool users into thinking that they are interacting directly with their banks when in fact they are interacting only with Plaid," the lawsuit asserts. "After Plaid has gathered reams of a user's sensitive personal data, Plaid aggregates the data with that of millions of other users, chops it up,and sells it to the highest bidder."
In addition to damages, the payment app users are asking the court to order Plaid to stop illegally downloading consumers' financial information and disgorge users credentials and profits acquired from its data gathering.
The complaint brings 10 causes of action against Plaid, including common law invasion of privacy, violation of the Stored Communications Act and negligence.
A key tool in its ability to deceptively get hold of the credentials, the lawyers wrote, is the company's version of OAuth, the tech industry's standard verification process that asks users to give permission for a platform to funnel information to another website or app without storing login data. Plaid's version, "Managed OAuth," does not use a separate dialogue box disclosing the permissions and it does store usernames and passwords, according to the complaint.
"Plaid achieves this fraud by erecting a sophisticated edifice of deceit to trick users into thinking that they are logging into their financial institutions, when in fact they are turning over their credentials to Plaid," plaintiffs allege in the complaint.
Payment app users also argue that they suffered economic damages from loss of control of valuable information. Visa announced a deal to acquire the fintech company in January for $5.3 billion, "based in no small part on the universe of consumers that Plaid has accumulated," the suit states.
Lawyers for the plaintiff did not immediately respond to a request for comment. The complaint called into question any consent that Plaid received from users, since most consumers do not realize Plaid is involved in their use of the finance apps, they allege.
"If consumers don't know that Plaid exists, they certainly cannot consent to Plaid taking their data," they wrote.
Sign up for Law.com's Legal Radar to keep up with the latest news and lawsuits in a free, personalized news feed. Track class actions and who's getting the work by industry, practice area, law firm, company and region.
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllAs AI-Generated Fraud Rises, Financial Companies Face a Long Cybersecurity Battle
Visa CLO-Turned-Vice Chair Seeing Payoff From Expanded Role
Law Firms Mentioned
Trending Stories
Who Got The Work
Michael G. Bongiorno, Andrew Scott Dulberg and Elizabeth E. Driscoll from Wilmer Cutler Pickering Hale and Dorr have stepped in to represent Symbotic Inc., an A.I.-enabled technology platform that focuses on increasing supply chain efficiency, and other defendants in a pending shareholder derivative lawsuit. The case, filed Oct. 2 in Massachusetts District Court by the Brown Law Firm on behalf of Stephen Austen, accuses certain officers and directors of misleading investors in regard to Symbotic's potential for margin growth by failing to disclose that the company was not equipped to timely deploy its systems or manage expenses through project delays. The case, assigned to U.S. District Judge Nathaniel M. Gorton, is 1:24-cv-12522, Austen v. Cohen et al.
Who Got The Work
Edmund Polubinski and Marie Killmond of Davis Polk & Wardwell have entered appearances for data platform software development company MongoDB and other defendants in a pending shareholder derivative lawsuit. The action, filed Oct. 7 in New York Southern District Court by the Brown Law Firm, accuses the company's directors and/or officers of falsely expressing confidence in the company’s restructuring of its sales incentive plan and downplaying the severity of decreases in its upfront commitments. The case is 1:24-cv-07594, Roy v. Ittycheria et al.
Who Got The Work
Amy O. Bruchs and Kurt F. Ellison of Michael Best & Friedrich have entered appearances for Epic Systems Corp. in a pending employment discrimination lawsuit. The suit was filed Sept. 7 in Wisconsin Western District Court by Levine Eisberner LLC and Siri & Glimstad on behalf of a project manager who claims that he was wrongfully terminated after applying for a religious exemption to the defendant's COVID-19 vaccine mandate. The case, assigned to U.S. Magistrate Judge Anita Marie Boor, is 3:24-cv-00630, Secker, Nathan v. Epic Systems Corporation.
Who Got The Work
David X. Sullivan, Thomas J. Finn and Gregory A. Hall from McCarter & English have entered appearances for Sunrun Installation Services in a pending civil rights lawsuit. The complaint was filed Sept. 4 in Connecticut District Court by attorney Robert M. Berke on behalf of former employee George Edward Steins, who was arrested and charged with employing an unregistered home improvement salesperson. The complaint alleges that had Sunrun informed the Connecticut Department of Consumer Protection that the plaintiff's employment had ended in 2017 and that he no longer held Sunrun's home improvement contractor license, he would not have been hit with charges, which were dismissed in May 2024. The case, assigned to U.S. District Judge Jeffrey A. Meyer, is 3:24-cv-01423, Steins v. Sunrun, Inc. et al.
Who Got The Work
Greenberg Traurig shareholder Joshua L. Raskin has entered an appearance for boohoo.com UK Ltd. in a pending patent infringement lawsuit. The suit, filed Sept. 3 in Texas Eastern District Court by Rozier Hardt McDonough on behalf of Alto Dynamics, asserts five patents related to an online shopping platform. The case, assigned to U.S. District Judge Rodney Gilstrap, is 2:24-cv-00719, Alto Dynamics, LLC v. boohoo.com UK Limited.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250