Venmo (PayPal)

In 2018, the FTC said Venmo misled consumers about how far they could control the privacy of their transactions, which were public by default. The same year, a researcher's 'Public by Default' project pulled about 208 MILLION public Venmo transactions from 2017 straight from the app's own public API, showing what that default exposed. On top of that: a 2022 proposed class action (Al-Ramahi v. PayPal, N.D. Cal.) alleges PayPal has a 'secret policy' of not reimbursing Venmo fraud losses, in violation of the federal Electronic Fund Transfer Act — meaning scam victims who report fraud promptly can still be denied reimbursement.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Primary source. None recorded — Unverified - heuristic first draft.

Arbitration

Standard mandatory binding arbitration + class action waiver; Venmo's current User Agreement allows opt-out only by sending a written notice postmarked no later than 30 DAYS after first accepting the agreement (a narrow window a 2023 Consumer Reports multi-app review is also reported to have highlighted; that report was not retrieved) — a recurring pattern also found at Cash App and Zelle (see below), while Apple Cash allows NO opt-out at all.

Data sharing

2018 FTC SETTLEMENT (Section 5 FTC Act + Gramm-Leach-Bliley Act violations): the FTC said Venmo misled consumers about the extent to which they could control the privacy of their transactions (limiting the default audience for future transactions did not make them private unless a second setting was also changed, and the other party to a transaction could make a 'private' transaction public) and about 'bank-grade' security, and failed to comply with the GLBA Privacy and Safeguards Rules (settlement imposed biennial third-party assessments for ten years); in 2018 researcher Hang Do Thi Duc's 'Public by Default' project pulled about 208 MILLION public Venmo transactions from 2017 through Venmo's public API, demonstrating the real-world exposure created by public-by-default settings; Venmo's third-party bank-linking partner Plaid separately paid a $58 MILLION settlement for collecting more banking data (transaction history, investment data, salary info) than necessary when users entered bank credentials through Venmo's Plaid-powered login screen; as of 2026, Venmo reportedly still shares data with third parties for marketing, ignores Do Not Track signals, and states it will keep sharing data even after account closure.

Contacts

Privacy contact. Not recorded.

Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.

Mailing address. Not recorded.