Cash App, operated by Block, Inc. (formerly Square, Inc.), publishes a privacy notice disclosing collection of extensive identity, biometric, and financial data for account verification and fraud-prevention purposes, and discloses sharing of information within its 'family of companies' and, starting February 2026, with outside brands through a commerce media network for personalized advertising. The company's regulatory record includes a January 2025 CFPB consent order requiring $175 million in penalties and consumer redress for fraud-protection and customer-service failures, a 2021 insider data breach affecting roughly 8.2 million Cash App Investing customers, and a related $15 million class-action settlement, alongside clearly disclosed public-company ownership under Block, Inc.'s dual-class share structure.
TRACK RECORD
1 ENFORCEMENT ACTION
[2025-01-16]
On January 16, 2025, the CFPB ordered Block, the operator of Cash App, to refund consumers up to $120 million and pay a $55 million penalty for failing to protect consumers from fraud in violation of the Consumer Financial Protection Act and the Electronic Fund Transfer Act.
Cash App's privacy notice discloses collection of Financial Information, including bank account and payment card numbers added to a user's account, as well as Cash App Card numbers, and Contacts Information related to payment recipients.
Cash App's privacy notice states it collects 'Additional Identification Information' including full mailing address, date of birth, government-issued identification such as Social Security number, passport, or driver's license, and photographs, facial scan, and biometric information extracted from such images for verification purposes.
Cash App's own privacy notice identifies Block, Inc. (formerly known as 'Square, Inc.') and its affiliates as the entity that operates Cash App and processes user information.
Secondary reporting drawing on Block's SEC filings and proxy statement describes Block, Inc. as a publicly traded company on the New York Stock Exchange with a dual-class share structure that gives CEO Jack Dorsey significant voting control despite a minority economic stake.
Cash App's privacy notice states that user information may be shared with other people the user transacts with, within Block's 'family of companies' (such as Square and Afterpay), and with service providers who help run the services.
Cash App's privacy notice discloses that, starting on or after February 9, 2026, the company may use data such as shopping history, app browsing behavior, card transactions, and general location information to show personalized advertisements for other brands outside of Cash App through a 'commerce media network,' with an opt-out available in account privacy settings.
Block disclosed in an April 2022 SEC filing that a former employee downloaded reports containing customer data from Cash App Investing after their employment ended, an incident discovered in December 2021 that potentially affected approximately 8.2 million current and former customers; the breach was limited to the Cash App Investing product and did not affect the peer-to-peer payments product.
On January 15, 2025, Block agreed to pay an $80 million fine imposed by a group of 48 state financial regulators over allegations of insufficient policing of money laundering through Cash App under the Bank Secrecy Act and related anti-money-laundering laws.
On January 16, 2025, the CFPB ordered Block, the operator of Cash App, to refund consumers up to $120 million and pay a $55 million penalty for failing to protect consumers from fraud in violation of the Consumer Financial Protection Act and the Electronic Fund Transfer Act.
A consolidated class action (Salinas et al. v. Block, Inc. and Cash App Investing, LLC) alleging inadequate data security related to the 2021-2023 breaches resulted in a $15 million settlement, which received final court approval on March 27, 2025; Block and Cash App Investing denied wrongdoing.
A third-party privacy policy analysis describes Cash App as collecting data through cookies, web beacons, and other tracking technologies in addition to information provided directly by users.