Dave is a U.S. cash-advance and banking app operated by Dave Inc. (Nasdaq: DAVE), which went public via SPAC merger in January 2022. Its privacy policy discloses collection of government ID, biometric facial imagery (via third-party vendors), full bank-account data pulled through Plaid, geolocation, and device identifiers, and states this information is shared with affiliate partners, issuing financial institutions, payment networks and service providers, while affirming it does not currently sell or share data for cross-context behavioral advertising under the CCPA. Its App Store privacy label confirms coarse location and financial data are used for Analytics and linked to identity. Ownership is fully traceable via SEC filings: Dave Inc./DE (CIK 0001841408), formerly VPC Impact Acquisition Holdings III, Inc., trades on the Nasdaq Global Market. Track record includes a June 2020 breach cataloged by Have I Been Pwned as affecting approximately 2,964,182 accounts, with exposed data including names, dates of birth, phone numbers, physical addresses, passwords, and Social Security numbers, and an FTC federal-court complaint (November 2024) alleging deceptive marketing, hidden fees and non-consensual 'tip' charges, referred to the DOJ in December 2024 with an amended complaint naming CEO Jason Wilk; as of the most recent reporting found, the case remains in litigation (motion practice through spring 2025) with no settlement or judgment located.
TRACK RECORD
1 BREACH · 2 ENFORCEMENT ACTIONS
BREACH LEDGER
[2020-06-28] · BREACH
Have I Been Pwned lists a breach record for Dave: "Dave".
Approximately 2,964,182 accounts affected, per HIBP.
Exposed: Dates of birth, Email addresses, Names, Passwords, Phone numbers, Physical addresses, Social security numbers.
The FTC's December 30, 2024 press release states the FTC referred its case against Dave Inc. to the U.S. Department of Justice, which filed an amended complaint naming Dave CEO Jason Wilk as a defendant and seeking civil penalties for deceiving consumers and charging undisclosed fees.
The FTC's November 5, 2024 press release announced a federal court complaint against Dave, alleging the company deceived consumers about cash advance amounts, charged consumers undisclosed fees, and charged so-called "tips" without consent, and quoted the FTC's Bureau of Consumer Protection director stating Dave 'lured in consumers living paycheck-to-paycheck with false claims of big-dollar advances, then reached into their pockets to give itself a so-called tip.'
Dave's privacy policy states it receives biometric information, such as facial imagery for identity verification purposes, with user consent, and processes that biometric information through third-party vendors rather than storing it on Dave's own systems.
Dave Inc.'s Form 10-K for fiscal year 2025 (filed with the SEC on 2026-03-02) states that on January 5, 2022 the company (formerly VPC Impact Acquisition Holdings III, Inc.) consummated its merger with Legacy Dave, and that its Class A Common Stock is listed on The Nasdaq Global Market under the symbol "DAVE."
Dave's CCPA disclosure table lists personal identifiers, financial information, geolocation information, and device information among the categories of personal information collected and shared in the prior 12 months, naming affiliate partners, issuing financial institutions, payment networks, payment card associations, and service providers as the parties with whom that information may be shared.
Have I Been Pwned's breach catalog lists the "Dave" incident (dave.com), breach date 2020-06-28, affecting approximately 2,964,182 accounts. Data classes exposed per HIBP: Dates of birth, Email addresses, Names, Passwords, Phone numbers, Physical addresses, Social security numbers. Source: Have I Been Pwned (haveibeenpwned.com), CC BY 4.0.
The FTC's November 5, 2024 press release announced a federal court complaint against Dave, alleging the company deceived consumers about cash advance amounts, charged consumers undisclosed fees, and charged so-called "tips" without consent, and quoted the FTC's Bureau of Consumer Protection director stating Dave 'lured in consumers living paycheck-to-paycheck with false claims of big-dollar advances, then reached into their pockets to give itself a so-called tip.'
The FTC's December 30, 2024 press release states the FTC referred its case against Dave Inc. to the U.S. Department of Justice, which filed an amended complaint naming Dave CEO Jason Wilk as a defendant and seeking civil penalties for deceiving consumers and charging undisclosed fees.
Dave's privacy policy discloses that its mobile application may include third-party software development kits (SDKs) that let Dave and its service providers collect usage information, and that some mobile devices carry a resettable identifier used to identify the device over time for marketing purposes.
The Dave App Store privacy label (self-reported by Dave, Inc.) discloses that Financial Info (Payment Info, Other Financial Info) and Location (Coarse Location) are collected, linked to the user's identity, and used for the Analytics purpose.