Klarna is a Swedish-founded buy-now-pay-later lender and shopping app operated by Klarna Bank AB, whose parent Klarna Group plc (incorporated in England and Wales) listed on the NYSE under "KLAR" in September 2025. Beyond installment lending, Klarna runs an advertising and retail-media business (Klarna Ads Manager) built on shopper data, and its SEC prospectus reports advertising revenue grew from roughly $13 million in 2020 to $184 million in the twelve months ended June 2025. Its US privacy policy describes collecting identifiers, geolocation, financial data, browsing and purchase history, and inferences, and its California disclosures state it has sold or shared email addresses, device IDs, and IP addresses with marketing and advertising partners. Klarna furnishes BNPL payment data to UK credit reference agencies and US Term Loan data to TransUnion. In 2022 Sweden's data protection authority fined Klarna SEK 7.5 million for privacy-notice deficiencies (upheld on appeal in 2024), and a May 2021 caching bug briefly exposed some users' account information to other users, which Klarna documented in public postmortems.
TRACK RECORD
1 ENFORCEMENT ACTION
[2022-03-31]
In March 2022 the Swedish Authority for Privacy Protection (IMY) fined Klarna Bank AB SEK 7,500,000 after finding its website privacy information violated several GDPR rules, including incomplete and misleading information about recipients of personal data shared with Swedish and foreign credit information companies.
Klarna's US privacy policy states that it collects personal information including name, contact details, device identifiers, IP addresses, geolocation information, and financial account information such as credit or debit card numbers.
The CFPB's September 2022 market report -- based on December 2021 market-monitoring orders to five BNPL firms including Klarna -- identified industry-wide "data harvesting" at the intersection of digital commerce, content, and lending as one of BNPL's largest consumer risks. This was market monitoring across the industry, not an enforcement action against Klarna.
Klarna's SEC prospectus states its advertising business is built on consumer and merchant data, and reports advertising revenue grew from approximately $13 million in 2020 to $184 million in the twelve months ended June 30, 2025.
Klarna's US privacy policy identifies its corporate affiliates by name -- companies carrying the Klarna, PriceRunner, or Prisguiden brands, and financial companies such as Klarna Bank AB -- in its federal privacy notice describing affiliate data sharing.
After the May 2021 incident, Klarna published a detailed public postmortem documenting the root cause (a CDN cache misconfiguration), a minute-by-minute timeline, and remediation steps -- an above-average level of voluntary incident transparency for a consumer fintech.
Klarna Group plc, incorporated in England and Wales, completed a US initial public offering in September 2025 and was approved to list its ordinary shares on the New York Stock Exchange under the symbol "KLAR," placing its ownership structure under SEC disclosure requirements.
Klarna's California privacy disclosures state that in the prior 12 months it sold and shared personal identifiers -- specifically email addresses, Device IDs, and IP addresses -- with marketing or advertising partners, as those terms are defined by applicable state privacy laws.
Klarna announced that from 1 June 2022 it reports UK consumers' BNPL payment behavior -- purchases paid on time, late payments, and unpaid purchases for Pay in 30 and Pay in 3 orders -- to the credit reference agencies Experian and TransUnion.
Klarna operates Ads Manager, a self-service retail-media advertising platform that lets retailers target Klarna's stated audience of 150 million shoppers; Klarna's announcement frames consumer data sharing as the basis for personalized shopping and ad targeting.
Klarna announced that starting November 1, 2024 it shares loan and repayment activity for its US Term Loan product with the credit bureau TransUnion; the same notice states that Pay in 4, Pay Later in 30 Days, and Pay Now activity is not shared with credit bureaus.
On May 27, 2021, a faulty cache configuration caused some Klarna app users to see subsets of other users' information for about 31 minutes. Klarna's own incident report counts roughly 90,000 users who saw others' data (Groups 1a and 1b) and about 15,000 users whose identifiable information was shown to others; Klarna reported the incident under the GDPR and stated card and bank details remained masked.
In March 2022 the Swedish Authority for Privacy Protection (IMY) fined Klarna Bank AB SEK 7,500,000 after finding its website privacy information violated several GDPR rules, including incomplete and misleading information about recipients of personal data shared with Swedish and foreign credit information companies.
In March 2024, Sweden's Administrative Court of Appeal upheld the full SEK 7.5 million (about $733,000) fine against Klarna, ruling that Klarna had given clients insufficient and unclear information about how it would store their personal data; the notices at issue dated from 2020 and had since been updated.
Klarna's Checkout cookie statement commits to using cookies and similar tracking technologies in the Klarna Checkout product only for purposes strictly necessary to operate the service -- a narrower posture than the broader advertising-oriented tracking described in its general privacy policy.
Klarna's US privacy policy discloses that when users click out to a store from the Klarna app they are routed through an "affiliate network" that may place a tracking technology on the user's device recording the click; the policy also describes use of cookies, Clear GIFs, web beacons, and mobile analytics in its websites and apps.
Klarna's Apple App Store privacy label (self-reported by developer Klarna Bank AB) declares that Identifiers and Usage Data may be used to track users across other companies' apps and websites, and lists Purchase History, Device ID, and Product Interaction data as linked to identity for Third-Party Advertising purposes.