Hacker News Reader

Comment by cameldrv | Hacker News Reader

They are selling the data to marketing companies to build a dossier on you, and this could be used for any number of purposes once it is in the hands of data brokers.

They're tricking people into handing over the information, and then they're using it for purposes that may harm the victim, so like I said, it's hard to draw a line.

View on HN

I don't think this is true, and Plaid makes pretty explicit claims that they do not do this, i.e.:

- https://news.ycombinator.com/item?id=18655417

- https://plaid.com/how-we-handle-data/

They do not make such an explicit claim in their privacy policy. There is a carve-out for "affiliates", although what constitutes an affiliate is not defined. They also say:

"We may collect, use, and share End User Information in an aggregated, de-identified, or anonymized manner (that does not identify you personally) for any purpose permitted under applicable law. This includes creating or using aggregated, de-identified, or anonymized data based on the collected information to develop new services and to facilitate research."

This is a cop-out used by a lot of services these days. De-identified data can be and is routinely re-identified. For financial transaction data this is fairly easy. For example, if you buy location data, it's trivial to determine where someone's home is, and therefore their likely identity.

Once you have a set of locations a person visited, you can correlate them with financial transactions. Even just a couple of retail transactions are often unique. You were probably the only person who was at your neighborhood Starbucks on Monday at 6:37am and also at Starbucks on Friday at 7:32am. Your credit card transactions provide a time and a location for every retail transaction.

That was 2018 though when they were barely setting up.

And still the case from what I've heard.

Plaid can very well not use the data in this way, but any company using Plaid's APIs and gaining access to the end-user bank account can do whatever they want with the data. There are no restrictions on potential bad actors who will do this, and no consumer protections.

Sure, and that would be true however a partner collected this data. It’s true whenever you apply for a credit card or a mortgage.

I believe that Plaid doesn’t work with just anyone, and they do attempt to put some limited controls in place to block bad actors - just like any other platform in the world.

All that said, the parent were suggesting that Plaid itself bundled and resold data for marketing purposes which it does not do (though I believe some of its competitors might).

You should hold their feet to the fire for real issues (potential for misuse by companies that use Plaid to gather info, security concerns), not imaginary ones

Dont worry, visa, amex and MasterCard already do it directly

Doing it on purpose vs via black/grey market trickery is often treated as separate matters. Even if the legal mode is still full of moral issues that society has yet to fully confront.

Phishing people's bank credentials has been fully established as a computer crime (not even just bad within civil law).

I adore the idea of the Plaid founders, and everyone else deemed complicit in a court of law (I think this should likely include investors), going to fuck-you-in-the-ass prison instead of becoming billionaires.

Alas, I've lived in Silicon Valley too long to believe that anything moral will ever occur when there's money to be made.

It makes me sad that people actually admire this place for anything other than the geography.

Do you think Plaid founders are going to jail?

No. He specifically implied that they would become billionaires instead of going to jail.

It's sad that we award unscrupulous behavior.

That's true, and perhaps the real reason this really is a very valid anti-trust action is that Visa would be removing their only real competitor for providing this type of data.

Reply on news.ycombinator.com