Block, Inc. (NYSE: XYZ), the publicly traded parent of Cash App, Square, Afterpay, and TIDAL, discloses in its own privacy notice that it shares site-use data such as IP addresses with third-party analytics and advertising partners including Google Analytics, Facebook, BugSnag, and Crashlytics. The company's corporate structure and segment reporting are disclosed in detail through SEC filings and investor materials, while its regulatory record includes a 2022 Cash App Investing data breach disclosure, a January 2025 CFPB consent order, an April 2025 NYDFS settlement, and a July 2026 multistate attorneys general settlement, each concerning fraud handling, compliance, or data security practices rather than a specific privacy-policy violation. Overall, Block's privacy documentation follows conventional fintech disclosure patterns, while its track record shows a pattern of repeated regulatory findings related to consumer protection and compliance program deficiencies at its Cash App subsidiary.
TRACK RECORD
3 ENFORCEMENT ACTIONS
[2026-07-08]
On July 8, 2026, Block, Inc. entered a multistate consent judgment with 46 state attorneys general, led by Oregon and Texas, agreeing to pay $45 million and to reform Cash App customer-support and fraud-response practices, resolving allegations that the company misled consumers about the platform's safety and fraud protections.
On April 10, 2025, the New York State Department of Financial Services issued a consent order against Block, Inc. imposing a $40 million penalty for deficiencies in its Bank Secrecy Act, anti-money-laundering, and virtual-currency compliance programs, including inadequate oversight of Cash App's 'restricted' accounts that allowed denylisted users to re-enter the platform.
On January 16, 2025, the Consumer Financial Protection Bureau issued a consent order against Block, Inc. requiring it to pay up to $120 million in consumer redress and a $55 million penalty, finding that the company's Cash App fraud-dispute investigations were inadequate and that it employed weak security protocols.
Block's privacy notice for users of Square services who do not sign up for an account states that the company keeps user information for as long as necessary for the purposes identified in the notice, including legal compliance, fraud detection, fee collection, and dispute resolution.
Block, Inc.'s SEC Form 10-K for fiscal year 2022 discloses that the company changed its corporate name from Square, Inc. to Block, Inc. in December 2021, and describes its reportable business segments and subsidiary businesses including Cash App, TIDAL, and TBD.
The privacy notice discloses that Block may disclose site-use information, including IP addresses, to its analytics providers and other service providers who use the information to analyze how users engage with its online services.
In an April 2022 SEC filing and confirmed by the company, Block disclosed that a former employee downloaded internal Cash App Investing reports containing customer names, brokerage account numbers, and one day of trading activity for approximately 8.2 million current and former customers, after the employee's access should have ended.
On January 16, 2025, the Consumer Financial Protection Bureau issued a consent order against Block, Inc. requiring it to pay up to $120 million in consumer redress and a $55 million penalty, finding that the company's Cash App fraud-dispute investigations were inadequate and that it employed weak security protocols.
In January 2025, Block agreed to pay an $80 million penalty to a coalition of state financial regulators, coordinated through the Conference of State Bank Supervisors, over allegations that Cash App's money-transfer service had insufficient protocols to flag illicit transactions.
On April 10, 2025, the New York State Department of Financial Services issued a consent order against Block, Inc. imposing a $40 million penalty for deficiencies in its Bank Secrecy Act, anti-money-laundering, and virtual-currency compliance programs, including inadequate oversight of Cash App's 'restricted' accounts that allowed denylisted users to re-enter the platform.
On July 8, 2026, Block, Inc. entered a multistate consent judgment with 46 state attorneys general, led by Oregon and Texas, agreeing to pay $45 million and to reform Cash App customer-support and fraud-response practices, resolving allegations that the company misled consumers about the platform's safety and fraud protections.
The privacy notice discloses that Block's analytics partners — named as Google Analytics, Facebook, BugSnag, and Crashlytics — use tracking technologies to analyze how users interact with its online services.