10 ms·

Co-founder of Plaid here. This is not true, we do not sell transactional data to third parties. We make 100% of our money by letting developers build financial

Co-founder of Plaid here. This is not true, we do not sell transactional data to third parties. We make 100% of our money by letting developers build financial applications[1]. [1] - https://plaid.com/pricing/ https://plaid.com/pricing/

mwexler 8y ago
And just to point out, there are others that do sell this as part of their business model, so kudos to Plaid for trying to find another way. https://www.forbes.com/sites/petercohan/2018/07/22/mastercard-amex-and-envestnet-profit-from-400m-business-of-selling-transaction-data/ https://www.forbes.com/sites/petercohan/2018/07/22/mastercar... (Another "Forbes Contributor" article, so grain of salt on the details)
alehul 8y ago
Thanks William, and sorry for the wrong accusation. Super embarrassed; I read so many comments on that thread I must've conflated two.
- jka 8y ago
  Thanks for speaking up alehul; for what it's worth, I think it can often be interesting to later reflect on these moments of apparent shame and embarrassment, especially in the context of attempting to speak truth to power. Accountability and transparency is important long-term; as is questioning possible abuse or misuse of power. Don't be afraid to continue to do so! Also, always use Hanlon's razor, but it's getting harder and harder to tell genuine conversations from stage-managed ones online, unfortunately. It's the logical extreme of pg's article 'The Submarine'[0]. [0] - http://paulgraham.com/submarine.html http://paulgraham.com/submarine.html
- ryanackley 8y ago
  Here is one discussion from a so-called whistleblower I was involved in. I will let you decide on the ethics[1]. I'm in the ACH space and I personally know a merchant who planned on using them for account verification for point of sale ACH payments. This merchant also planned on grabbing transaction history while they were in there for I don't know what. Analytics maybe? I have no idea if they ever went through with their plan. [1]https://news.ycombinator.com/item?id=17692291 https://news.ycombinator.com/item?id=17692291
  - bdcravens 8y ago
    This was the merchant, and not Plaid. While Plaid gives such merchants a lot of power, I don't think the ethics issue lies with Plaid (though you could make a good argument that they should grant limited access, and full API access only on a more restricted whitelist basis)
    - galvanizer 8y ago
      So according to you Facebook is not responsible for Cambridge Analytica scandal.
EADGBE 8y ago
Yeah, the pricing tiers make me think they're/you're not trying to get CPM-type residuals (ad-based revenue). Pretty cool product, considered using it for my property rental's payment portal.
jka 8y ago
Hi William, This may be true - but you do still normalize users to the practice of entering their banking login credentials into a web form which is sent to a third party (i.e. yourselves). In addition I believe the developer gains access to the users' bank transaction history - not just for the duration of their login session, but long-term, which is likely something that users aren't fully aware of in most cases. Am I mistaken about those? That is not 'selling' in the historically-used sense of the word, but we are now in a world where 'personal cost' means something different - especially when it comes to services which harvest personal data.
- rco8786 8y ago
  I have my own issues with Plaid, but I think you’re reaching a bit here. Everything Plaid does is opt in by the end user. They’re not selling data unbeknownst to the user (assuming co-founder above is being genuine), the user is giving another service permission to use their data. As for bank logins...that’s been around since long before Plaid. But I agree there must be a better way. Though I don’t have any great practical ideas.
  - jka 8y ago
    It's possible I'm overreaching, yep, but I think the past decade has shown - is showing - that simply 'assuming the best' of what will happen with rapid adoption of new technology isn't the most effective strategy. Daemons will come home to roost over time. Even if users are technically opting in, and even if everything is documented in the privacy policy, a potential end-game here is that startup companies have access to all bank transactions for the people who need to use Plaid - likely people on the ground in the sharing economy who rely on it for payments - and the more fortunate/wealthier folks continue to have financial privacy by virtue of not needing to use it. That would be a really unfair world to live in.
  - darkerside 8y ago
    Do users have any idea exactly what they're giving up here though? Do they have fine-grained permissions to allow read-only vs write access, and to choose between transaction and account level data? And is there anything that prevents those second-party developers from then turning around and selling data to third parties (besides their own TOS with Plaid)?
pmart123 8y ago
I do think these aggregated services are a net benefit to the fintech ecosystem overall. However, any service that uses a Plaid type service still could be selling transaction data to third-parties. For instance, Acorns: https://www.acorns.com/privacy/ https://www.acorns.com/privacy/ >>> Acorns uses Plaid Inc. (“Plaid”) to gather your data from financial institutions... >>> Acorns and Empyr will use transaction information from your Acorns debit card in connection with the Found Money Plus program as follows: ... to provide participating merchants or Empyr aggregated and anonymized information relating specifically to registered card activity solely to allow participating merchants and Empyr to assess the results of their campaign(s);
- astura 8y ago
  That means they are only sharing data from your Acorns debit card, not your external bank accounts. The Plaid part is separate from the debit card/Found Money Plus part. You also omitted a key quote: >when you activate your Acorns debit card, you will be asked to enroll in Found Money Plus, a card-linked offer program offered in partnership with Empyr. The Found Money Plus program is only for transactions on the Acorns debit card, and it is small bonuses for specific spending, for example, 10% cash back at Starbucks. It looks like a company called Empyr organizes these campaigns for the card link offers. The Acrons debit card is also optional. If you're getting cash back on a transaction you know the price is sharing your purchases, this concept isn't really new.
ryanackley 8y ago
You may not sell the data but you give developer's access to bank balance, transaction history, and income streams. Essentially some of the most private aspects of a person's life. Seems legitimately useful for personal finance tools or loan providers. However, I know your API is being used by point of sale systems. Seems super unethical for point of sale systems to access any info beyond, is this the right account, does it have enough money. I just hope you're enforcing some kind of restrictions or at the very least warning consumers what they're giving the merchant permission to access.
- bdcravens 8y ago
  They do outline everything pretty well at https://plaid.com/legal/ https://plaid.com/legal/, but I don't know that those terms are linked to from the login widget.
  - ryanackley 8y ago
    I can't tell if this is sarcasm. As long as you're transparent about it in a 30 page ToS then it's all good. Because when you go to checkout at a cash register, you're going to stop and hold the line for an hour or more and read that page. Not an exaggeration btw, my print dialog estimates that page to be 27 pages printed.
root_axis 8y ago
The product is obviously amazing, and I know for a fact that it's creating credit opportunities for consumers with credit history that may not accurately reflect their current financial status, but there is an insidious aspect to the product: the 6 months of future access to transactions and banking information. Most consumers don't realize they're giving this up when they use your product and I believe they would be much less likely to use it if they were aware.
- astura 8y ago
  > the 6 months of future access to transactions and banking information. Most consumers don't realize they're giving this up when they use your product and I believe they would be much less likely to use it if they were aware. Can I ask what makes you believe that? Why would someone be A-OK with sharing the previous six months of account transactions but balk at sharing the next six months of account transactions?
  - root_axis 8y ago
    Because they have a mental model of what is inside the previous 6 months and can make a judgement regarding whether or not they are comfortable revealing that information, whereas the future 6 months could include purchases that they may not want to reveal for various reasons. I also think many consumers would simply be creeped out by the idea that these companies can continue to maintain access to their bank statement for 6 months into the future, especially in cases where the consumer has a dispute or negative experience with the company. There are also some underwriting arrangements where companies could leverage future Plaid data to make decisions about how to treat a customer (e.g. monitoring bank balances so that rebilling a delinquent customer can be automatically rescheduled after a deposit)
Quanttek 8y ago
Hi William, how does your statement fit with the fact that one of your products is literally selling transactional data? https://plaid.com/products/transactions https://plaid.com/products/transactions While I'll assume this is only of the customers of a particular product, it is still worrying as many customers may not understand that fact as you are not transparent about your role and the access granted.
- bdcravens 8y ago
  It fits 100% in what he's saying. The API grants the developer of the application access to the account history of whoever's logged in. This in no way establishes they are selling anything to any third-parties.
  - kerryfalk 8y ago
    The developer pays for that access. The developer is a third party. They're buying transaction data. It's explicitly stated within their sales page and directly contradictory to the statement he made above.
    - ceejayoz 8y ago
      That's a silly framing. The developer is purchasing the technological infrastructure to deliver the data a single specific user has opted to provide to them. Claiming the developer is a third party is like claiming I'm a third party when I order off Amazon, and that the USPS is the actual customer.
      - SquishyPanda23 8y ago
        When you enter into a transaction using your bank, someone who is not a party to that transaction can see it, and they pay for that access. Under any framing, that's a third party paying for access to your transaction data. The user hasn't opted-in if the co-founder of the company is telling people it doesn't happen. It's only opt-in if the user knows it's happening and agrees to it.

mwexler 8y ago

And just to point out, there are others that do sell this as part of their business model, so kudos to Plaid for trying to find another way. https://www.forbes.com/sites/petercohan/2018/07/22/mastercard-amex-and-envestnet-profit-from-400m-business-of-selling-transaction-data/ https://www.forbes.com/sites/petercohan/2018/07/22/mastercar... (Another "Forbes Contributor" article, so grain of salt on the details)

alehul 8y ago

Thanks William, and sorry for the wrong accusation. Super embarrassed; I read so many comments on that thread I must've conflated two.

jka 8y ago
Thanks for speaking up alehul; for what it's worth, I think it can often be interesting to later reflect on these moments of apparent shame and embarrassment, especially in the context of attempting to speak truth to power. Accountability and transparency is important long-term; as is questioning possible abuse or misuse of power. Don't be afraid to continue to do so! Also, always use Hanlon's razor, but it's getting harder and harder to tell genuine conversations from stage-managed ones online, unfortunately. It's the logical extreme of pg's article 'The Submarine'[0]. [0] - http://paulgraham.com/submarine.html http://paulgraham.com/submarine.html
ryanackley 8y ago
Here is one discussion from a so-called whistleblower I was involved in. I will let you decide on the ethics[1]. I'm in the ACH space and I personally know a merchant who planned on using them for account verification for point of sale ACH payments. This merchant also planned on grabbing transaction history while they were in there for I don't know what. Analytics maybe? I have no idea if they ever went through with their plan. [1]https://news.ycombinator.com/item?id=17692291 https://news.ycombinator.com/item?id=17692291
- bdcravens 8y ago
  This was the merchant, and not Plaid. While Plaid gives such merchants a lot of power, I don't think the ethics issue lies with Plaid (though you could make a good argument that they should grant limited access, and full API access only on a more restricted whitelist basis)
  - galvanizer 8y ago
    So according to you Facebook is not responsible for Cambridge Analytica scandal.

EADGBE 8y ago

Yeah, the pricing tiers make me think they're/you're not trying to get CPM-type residuals (ad-based revenue). Pretty cool product, considered using it for my property rental's payment portal.

jka 8y ago

Hi William, This may be true - but you do still normalize users to the practice of entering their banking login credentials into a web form which is sent to a third party (i.e. yourselves). In addition I believe the developer gains access to the users' bank transaction history - not just for the duration of their login session, but long-term, which is likely something that users aren't fully aware of in most cases. Am I mistaken about those? That is not 'selling' in the historically-used sense of the word, but we are now in a world where 'personal cost' means something different - especially when it comes to services which harvest personal data.

rco8786 8y ago
I have my own issues with Plaid, but I think you’re reaching a bit here. Everything Plaid does is opt in by the end user. They’re not selling data unbeknownst to the user (assuming co-founder above is being genuine), the user is giving another service permission to use their data. As for bank logins...that’s been around since long before Plaid. But I agree there must be a better way. Though I don’t have any great practical ideas.
- jka 8y ago
  It's possible I'm overreaching, yep, but I think the past decade has shown - is showing - that simply 'assuming the best' of what will happen with rapid adoption of new technology isn't the most effective strategy. Daemons will come home to roost over time. Even if users are technically opting in, and even if everything is documented in the privacy policy, a potential end-game here is that startup companies have access to all bank transactions for the people who need to use Plaid - likely people on the ground in the sharing economy who rely on it for payments - and the more fortunate/wealthier folks continue to have financial privacy by virtue of not needing to use it. That would be a really unfair world to live in.
- darkerside 8y ago
  Do users have any idea exactly what they're giving up here though? Do they have fine-grained permissions to allow read-only vs write access, and to choose between transaction and account level data? And is there anything that prevents those second-party developers from then turning around and selling data to third parties (besides their own TOS with Plaid)?

pmart123 8y ago

I do think these aggregated services are a net benefit to the fintech ecosystem overall. However, any service that uses a Plaid type service still could be selling transaction data to third-parties. For instance, Acorns: https://www.acorns.com/privacy/ https://www.acorns.com/privacy/ >>> Acorns uses Plaid Inc. (“Plaid”) to gather your data from financial institutions... >>> Acorns and Empyr will use transaction information from your Acorns debit card in connection with the Found Money Plus program as follows: ... to provide participating merchants or Empyr aggregated and anonymized information relating specifically to registered card activity solely to allow participating merchants and Empyr to assess the results of their campaign(s);

astura 8y ago
That means they are only sharing data from your Acorns debit card, not your external bank accounts. The Plaid part is separate from the debit card/Found Money Plus part. You also omitted a key quote: >when you activate your Acorns debit card, you will be asked to enroll in Found Money Plus, a card-linked offer program offered in partnership with Empyr. The Found Money Plus program is only for transactions on the Acorns debit card, and it is small bonuses for specific spending, for example, 10% cash back at Starbucks. It looks like a company called Empyr organizes these campaigns for the card link offers. The Acrons debit card is also optional. If you're getting cash back on a transaction you know the price is sharing your purchases, this concept isn't really new.

ryanackley 8y ago

You may not sell the data but you give developer's access to bank balance, transaction history, and income streams. Essentially some of the most private aspects of a person's life. Seems legitimately useful for personal finance tools or loan providers. However, I know your API is being used by point of sale systems. Seems super unethical for point of sale systems to access any info beyond, is this the right account, does it have enough money. I just hope you're enforcing some kind of restrictions or at the very least warning consumers what they're giving the merchant permission to access.

bdcravens 8y ago
They do outline everything pretty well at https://plaid.com/legal/ https://plaid.com/legal/, but I don't know that those terms are linked to from the login widget.
- ryanackley 8y ago
  I can't tell if this is sarcasm. As long as you're transparent about it in a 30 page ToS then it's all good. Because when you go to checkout at a cash register, you're going to stop and hold the line for an hour or more and read that page. Not an exaggeration btw, my print dialog estimates that page to be 27 pages printed.

root_axis 8y ago

The product is obviously amazing, and I know for a fact that it's creating credit opportunities for consumers with credit history that may not accurately reflect their current financial status, but there is an insidious aspect to the product: the 6 months of future access to transactions and banking information. Most consumers don't realize they're giving this up when they use your product and I believe they would be much less likely to use it if they were aware.

astura 8y ago
> the 6 months of future access to transactions and banking information. Most consumers don't realize they're giving this up when they use your product and I believe they would be much less likely to use it if they were aware. Can I ask what makes you believe that? Why would someone be A-OK with sharing the previous six months of account transactions but balk at sharing the next six months of account transactions?
- root_axis 8y ago
  Because they have a mental model of what is inside the previous 6 months and can make a judgement regarding whether or not they are comfortable revealing that information, whereas the future 6 months could include purchases that they may not want to reveal for various reasons. I also think many consumers would simply be creeped out by the idea that these companies can continue to maintain access to their bank statement for 6 months into the future, especially in cases where the consumer has a dispute or negative experience with the company. There are also some underwriting arrangements where companies could leverage future Plaid data to make decisions about how to treat a customer (e.g. monitoring bank balances so that rebilling a delinquent customer can be automatically rescheduled after a deposit)

Quanttek 8y ago

Hi William, how does your statement fit with the fact that one of your products is literally selling transactional data? https://plaid.com/products/transactions https://plaid.com/products/transactions While I'll assume this is only of the customers of a particular product, it is still worrying as many customers may not understand that fact as you are not transparent about your role and the access granted.

bdcravens 8y ago
It fits 100% in what he's saying. The API grants the developer of the application access to the account history of whoever's logged in. This in no way establishes they are selling anything to any third-parties.
- kerryfalk 8y ago
  The developer pays for that access. The developer is a third party. They're buying transaction data. It's explicitly stated within their sales page and directly contradictory to the statement he made above.
  - ceejayoz 8y ago
    That's a silly framing. The developer is purchasing the technological infrastructure to deliver the data a single specific user has opted to provide to them. Claiming the developer is a third party is like claiming I'm a third party when I order off Amazon, and that the USPS is the actual customer.
    - SquishyPanda23 8y ago
      When you enter into a transaction using your bank, someone who is not a party to that transaction can see it, and they pay for that access. Under any framing, that's a third party paying for access to your transaction data. The user hasn't opted-in if the co-founder of the company is telling people it doesn't happen. It's only opt-in if the user knows it's happening and agrees to it.