Co-founder of Plaid here. This is not true, we do not sell transactional data to third parties. We make 100% of our money by letting developers build financial applications[1].
https://www.acorns.com/privacy/
>>> Acorns uses Plaid Inc. (“Plaid”) to gather your data from financial institutions...
>>> Acorns and Empyr will use transaction information from your Acorns debit card in connection with the Found Money Plus program as follows:
... to provide participating merchants or Empyr aggregated and anonymized information relating specifically to registered card activity solely to allow participating merchants and Empyr to assess the results of their campaign(s);
You also omitted a key quote:
>when you activate your Acorns debit card, you will be asked to enroll in Found Money Plus, a card-linked offer program offered in partnership with Empyr.
The Found Money Plus program is only for transactions on the Acorns debit card, and it is small bonuses for specific spending, for example, 10% cash back at Starbucks. It looks like a company called Empyr organizes these campaigns for the card link offers.
The Acrons debit card is also optional.
If you're getting cash back on a transaction you know the price is sharing your purchases, this concept isn't really new.
Seems legitimately useful for personal finance tools or loan providers.
However, I know your API is being used by point of sale systems. Seems super unethical for point of sale systems to access any info beyond, is this the right account, does it have enough money. I just hope you're enforcing some kind of restrictions or at the very least warning consumers what they're giving the merchant permission to access.
As long as you're transparent about it in a 30 page ToS then it's all good. Because when you go to checkout at a cash register, you're going to stop and hold the line for an hour or more and read that page.
Not an exaggeration btw, my print dialog estimates that page to be 27 pages printed.
how does your statement fit with the fact that one of your products is literally selling transactional data? https://plaid.com/products/transactions
While I'll assume this is only of the customers of a particular product, it is still worrying as many customers may not understand that fact as you are not transparent about your role and the access granted.
It's explicitly stated within their sales page and directly contradictory to the statement he made above.
The developer is purchasing the technological infrastructure to deliver the data a single specific user has opted to provide to them.
Claiming the developer is a third party is like claiming I'm a third party when I order off Amazon, and that the USPS is the actual customer.
Under any framing, that's a third party paying for access to your transaction data.
The user hasn't opted-in if the co-founder of the company is telling people it doesn't happen. It's only opt-in if the user knows it's happening and agrees to it.
Then ask yourself why the founding team goes around and tells people they don't do that.
"Are you aware that connecting app Foo to your bank account gives app Foo access to your transactions?" is likely to be met with a resounding "no shit, that's the point..."
And your claim is that the point of the user signing up to Robinhood or Venmo is to give Robinhood or Venmo their entire bank account history for the last two years?
I find this implausible. You have an empirical claim. You're welcome to test it.
I understand what you're saying, but I think it would be less confusing to keep the idea I described above and what Plaid is doing (AFAIU) distinct.
More specifically I understand it as: If I engage with some entity/company/developer and give them the permission and secrets necessary to access my account, they can pay Plaid to make use of them on my behalf in the process of doing whatever it is I gave them that access for.
This activity is, and always has been to me, completely distinct from the activity of "selling my data", although it could result in the one I authorized to access my data through Plaid turning around and selling my data.
Accountability and transparency is important long-term; as is questioning possible abuse or misuse of power. Don't be afraid to continue to do so!
Also, always use Hanlon's razor, but it's getting harder and harder to tell genuine conversations from stage-managed ones online, unfortunately. It's the logical extreme of pg's article 'The Submarine'[0].
I'm in the ACH space and I personally know a merchant who planned on using them for account verification for point of sale ACH payments. This merchant also planned on grabbing transaction history while they were in there for I don't know what. Analytics maybe? I have no idea if they ever went through with their plan.
This may be true - but you do still normalize users to the practice of entering their banking login credentials into a web form which is sent to a third party (i.e. yourselves).
In addition I believe the developer gains access to the users' bank transaction history - not just for the duration of their login session, but long-term, which is likely something that users aren't fully aware of in most cases.
Am I mistaken about those?
That is not 'selling' in the historically-used sense of the word, but we are now in a world where 'personal cost' means something different - especially when it comes to services which harvest personal data.
As for bank logins...that’s been around since long before Plaid. But I agree there must be a better way. Though I don’t have any great practical ideas.
Even if users are technically opting in, and even if everything is documented in the privacy policy, a potential end-game here is that startup companies have access to all bank transactions for the people who need to use Plaid - likely people on the ground in the sharing economy who rely on it for payments - and the more fortunate/wealthier folks continue to have financial privacy by virtue of not needing to use it.
That would be a really unfair world to live in.
Obviously this is a hugely sensitive service, I’m not denying that. But there’s a way to do it right and it seems that Plaid is attempting to do that. So I’m not ready to declare them evil before they actually do anything evil.
Unfortunately the current approach of the major aggregation players is the only way to motivate the banks to give customers access to their own data through more reliable means.
Sure, but the developer using Plaid's services doesn't.
Isn't this a clear parallel to the Google "Don't be evil" approach that gets discarded as soon as the opportunity cost becomes too large to ignore?
Can I ask what makes you believe that? Why would someone be A-OK with sharing the previous six months of account transactions but balk at sharing the next six months of account transactions?
I also think many consumers would simply be creeped out by the idea that these companies can continue to maintain access to their bank statement for 6 months into the future, especially in cases where the consumer has a dispute or negative experience with the company. There are also some underwriting arrangements where companies could leverage future Plaid data to make decisions about how to treat a customer (e.g. monitoring bank balances so that rebilling a delinquent customer can be automatically rescheduled after a deposit)
Pretty cool product, considered using it for my property rental's payment portal.