Affirm is a US buy-now-pay-later (BNPL) lender operated by Affirm, Inc. and affiliates under public parent Affirm Holdings, Inc. (Nasdaq: AFRM). Its app, website, and browser extension offer point-of-sale installment loans, the Affirm Card, and shopping features. Affirm's privacy notice describes collecting identity data (including Social Security number and ITIN), bank account login details and transaction history, purchase information, device data, and opt-in precise geolocation, with much of this treated as nonpublic personal information under the Gramm-Leach-Bliley Act. The notice discloses use of cookies, pixels, and online advertising partners that may constitute "sale" or "sharing" for cross-context behavioral advertising under the CCPA, with opt-outs including Global Privacy Control. Affirm discloses information to merchants (including for merchant marketing, by default), service providers, partner banks, and credit bureaus; since April 2025 it reports all pay-over-time loans, including Pay-in-4, to Experian. The CFPB has monitored the BNPL market, naming Affirm among five firms ordered to provide data in 2021, and Affirm Card user data was exposed in the 2024 Evolve Bank & Trust breach.
TRACK RECORD
3 ENFORCEMENT ACTIONS
[2024-07-01]
In July 2024 Affirm disclosed that personal information of Affirm Card users was believed compromised in the cybersecurity incident at its card-issuing bank partner Evolve Bank & Trust; Affirm stated its own information systems were not compromised and that it notified law enforcement and all Affirm Card users.
In May 2024 the CFPB issued an interpretive rule confirming that BNPL lenders are credit card providers, obligating BNPL lenders industry-wide - including Affirm - to provide dispute-investigation and refund protections to consumers.
In December 2021 the CFPB issued market-monitoring orders to five BNPL providers - Affirm, Afterpay, Klarna, PayPal, and Zip - citing concerns including data harvesting; this was an industry-wide information-gathering inquiry, not an enforcement action against Affirm.
Affirm's Apple App Store privacy label declares that purchases (purchase history), financial info, contact info, and identifiers may be collected and linked to the user's identity, including for the developer's advertising or marketing purposes.
In its September 2022 market report based on data from the five BNPL firms that received its market-monitoring orders (including Affirm), the CFPB found BNPL lenders' business models increasingly rely on proprietary apps that build digital profiles of users' shopping behavior.
Affirm's privacy notice states that at account opening or use of its services it may collect identity data including full name, date of birth, Social Security number and ITIN, plus financial information including bank account online login information, bank account numbers, bank transaction history, and linked debit and credit card numbers.
Affirm Holdings, Inc. is a publicly traded Delaware corporation (Nasdaq: AFRM) that files audited annual reports with the SEC; its fiscal 2025 Form 10-K discloses a dual-class structure in which Class B common stock carries 15 votes per share versus one vote for Class A, with Class B holders collectively controlling matters submitted to stockholders.
Affirm's privacy notice identifies the operating corporate family covered by the policy: Affirm, Inc. and its affiliates Affirm Loan Services, LLC, Affirm Financial Solutions, LLC, and Affirm Payments, LLC.
Affirm disclosed in an SEC filing that it shares the personal information of Affirm Card users with Evolve Bank & Trust, the third-party bank that issues the Affirm Card, to facilitate card issuance and servicing.
As of April 1, 2025, Affirm reports all of its pay-over-time loan products, including Pay-in-4, to the credit bureau Experian; Affirm and Experian frame the furnishing as increasing BNPL transparency and helping consumers build credit histories.
Affirm's privacy notice states that by accepting the notice and using the services, users consent to Affirm disclosing their information to merchants they interact with so those merchants can market to them; an opt-out is provided. The notice also lists disclosures to service providers, fraud and risk vendors, partner banks, and credit bureaus.
In December 2021 the CFPB issued market-monitoring orders to five BNPL providers - Affirm, Afterpay, Klarna, PayPal, and Zip - citing concerns including data harvesting; this was an industry-wide information-gathering inquiry, not an enforcement action against Affirm.
In May 2024 the CFPB issued an interpretive rule confirming that BNPL lenders are credit card providers, obligating BNPL lenders industry-wide - including Affirm - to provide dispute-investigation and refund protections to consumers.
In July 2024 Affirm disclosed that personal information of Affirm Card users was believed compromised in the cybersecurity incident at its card-issuing bank partner Evolve Bank & Trust; Affirm stated its own information systems were not compromised and that it notified law enforcement and all Affirm Card users.
Affirm's Apple App Store privacy label discloses that Contact Info and Identifiers may be used to track users across apps and websites owned by other companies.
Affirm's privacy notice states that it works with online advertising partners that use tracking technologies on user browsing activity, and that this may constitute the "sale" or "sharing" of personal information for cross-context behavioral advertising under the CCPA; Affirm offers cookie/pixel opt-outs and honors Global Privacy Control signals.