MoneyLion (ML Plus / MoneyLion Technologies; Gen Digital subsidiary)

MoneyLion settled the CFPB's Military Lending Act suit in November 2025 for $1.75 million in restitution and no civil penalty, without admitting wrongdoing - and the deal let it keep leaving $19.99-$29/month 'membership' fees out of the 36% military rate cap if disclosed and cancellable after two months. The harder exposure is now at the state and local level: the New York Attorney General (usury and fraud, filed April 2025), the City of Baltimore, and a Pennsylvania county prosecutor have all sued over its 'Instacash' advances, and two private MLA/TILA class actions survived motions to dismiss and to compel arbitration (on appeal to the Second Circuit). Gen Digital (Norton/Avast/LifeLock parent) bought MoneyLion in April 2025 for about $1 billion.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-10-16

Primary source. www.hinshawlaw.com/en/insights/blogs/consumer-crossroads-where-financial-services-and-litigation-intersect/lenders-should-approach-the-recent-cfpbmoneylion-military-lending-act-settlement-with-caution — Unverified - heuristic first draft.

Arbitration

Yes - Terms (updated June 2026) incorporate a separate Agreement for Resolving Disputes: individual arbitration administered by National Arbitration and Mediation (NAM), class-action waiver ('ONLY INDIVIDUAL RELIEF IS AVAILABLE'), small-claims carve-out, and a mass-arbitration protocol for 25+ coordinated claimants (10+10 bellwethers, global mediation, then batches of 100); if a court strikes the mass-arbitration section, the whole arbitration agreement is void. Note: two S.D.N.Y. courts denied MoneyLion's motions to compel arbitration in MLA cases (MLA bars arbitration for covered borrowers); on appeal.

Data sharing

Privacy policy (updated June 2026) says MoneyLion does not 'sell' but does 'share' personal information as defined under California law (cross-context behavioral advertising via cookies/pixels; lookalike audiences with Facebook and Taboola). Linked bank-account data (balances, activity, direct-deposit and spending data) may be shared 'with our affiliates and marketplace partners to better personalize your offers' where permissions exist. Precise location for its Driver Score feature is collected by an auto-insurance partner (Zendrive). Affiliate marketing is disclosed; the policy does not name Gen Digital. GLBA-covered data sits under a separate Financial Privacy Notice (not reviewed this pass). Now that MoneyLion sits inside a consumer-security conglomerate, cross-use of financial-distress data with Gen's identity/antivirus customer base is a structural question to watch (tracker inference). No MoneyLion data breach located this pass.

Contacts

Privacy contact. Data Rights Request Form at moneylion.com/privacy-notice/ccpa/; 1-888-704-6970 (rights requests); 1-844-224-0087 (privacy questions)

Legal notice. MoneyLion Legal, 60 E Rio Salado Pkwy #1000, Tempe, AZ 85281 (Terms and Privacy Policy, June 2026). Privacy rights requests may also be mailed to Legal Department, 249 West 17th Street, 4th Floor, New York, NY 10011. Corporate HQ not separately verified this pass.

Mailing address. Not recorded.