MoneyLion is a U.S. fintech "super-app" (credit-builder loans, cash advances, investing, a debit card, and a lending marketplace) previously run by publicly traded MoneyLion Inc. (NYSE: ML). On April 17, 2025, MoneyLion completed a merger and became a wholly owned subsidiary of Gen Digital Inc. (the Norton/Avast/LifeLock parent), per MoneyLion's own SEC Form 8-K. MoneyLion's privacy policy discloses broad collection (financial, employment, biometric identity-verification data, and location via a driving-behavior partner), fingerprinting and session-replay tracking, and a CCPA "share" (not "sell") relationship covering cross-context behavioral advertising with corporate affiliates and lookalike-audience partners such as Facebook and Taboola. Ownership since the Gen Digital merger is cleanly traceable through SEC filings. Track record includes a CFPB federal lawsuit (filed September 2022) alleging Military Lending Act overcharges of servicemembers and deceptive membership-cancellation practices; the case SETTLED on November 24, 2025, when the court entered a jointly proposed stipulated final judgment requiring $1.75 million in consumer redress — a consent resolution with no civil money penalty assessed, per the CFPB's own action page and legal analyses of the order.
TRACK RECORD
2 ENFORCEMENT ACTIONS
[2025-11-24]
The CFPB's own enforcement-action page states that on November 21, 2025 'the Bureau and all defendants jointly filed a proposed stipulated final judgment and order to resolve the Bureau's claims, which the court entered on November 24, 2025,' and that the order 'requires the defendants to pay $1.75 million in consumer redress' -- resolving the Bureau's September 2022 Military Lending Act and Consumer Financial Protection Act lawsuit against MoneyLion Technologies Inc., ML Plus, LLC, and 37 lending subsidiaries (S.D.N.Y. No. 1:22-cv-08308; status listed as Post Order/Post Judgment).
The CFPB's federal complaint, filed September 29, 2022 against MoneyLion Technologies Inc. and 37 state lending subsidiaries, alleges the companies overcharged U.S. servicemembers and their dependents in violation of the Military Lending Act's 36% MAPR cap, and separately alleges deceptive practices that trapped consumers in a loan-linked 'membership' program they could not cancel; the CFPB filed a second amended complaint in April 2025, and on November 24, 2025 the court entered a jointly proposed stipulated final judgment and order resolving the Bureau's claims, requiring $1.75 million in consumer redress with no civil money penalty assessed.
MoneyLion's App Store privacy label (self-reported by MoneyLion Inc.) lists an extensive set of data categories collected and linked to the user's identity — including Financial Info, Credit Info, Contact Info, User Content, Identifiers, and Device ID — used for purposes including Third-Party Advertising, Analytics, and Product Personalization.
MoneyLion's privacy policy states that its identity-verification partners, Incode Technologies and Onfido, may collect biometric identifiers such as faceprints from selfies or government ID photos submitted during account verification.
MoneyLion Inc.'s Form 8-K, filed with the SEC on April 17, 2025, discloses that pursuant to a Merger Agreement dated December 10, 2024 among MoneyLion Inc., Gen Digital Inc., and Gen Digital's merger subsidiary, the merger subsidiary merged into MoneyLion, leaving MoneyLion as a wholly owned subsidiary of Gen Digital Inc., and that MoneyLion requested NYSE delisting of its Class A common stock and warrants the same day.
MoneyLion's App Store privacy label lists a distinct 'Developer's Advertising or Marketing' purpose using Financial Info, Credit Info, Contact Info, and Identifiers linked to the user's identity, separate from the Third-Party Advertising category.
MoneyLion's state-privacy-rights notice states it does not sell Personal Information but does 'share' it as defined under California law, and its main privacy policy separately describes disclosing Personal Information for cross-context behavioral advertising to its corporate parent/affiliate entities and to 'Lookalike Audience' partners including Facebook and Taboola.
The CFPB's federal complaint, filed September 29, 2022 against MoneyLion Technologies Inc. and 37 state lending subsidiaries, alleges the companies overcharged U.S. servicemembers and their dependents in violation of the Military Lending Act's 36% MAPR cap, and separately alleges deceptive practices that trapped consumers in a loan-linked 'membership' program they could not cancel; the CFPB filed a second amended complaint in April 2025, and on November 24, 2025 the court entered a jointly proposed stipulated final judgment and order resolving the Bureau's claims, requiring $1.75 million in consumer redress with no civil money penalty assessed.
The CFPB's own enforcement-action page states that on November 21, 2025 'the Bureau and all defendants jointly filed a proposed stipulated final judgment and order to resolve the Bureau's claims, which the court entered on November 24, 2025,' and that the order 'requires the defendants to pay $1.75 million in consumer redress' -- resolving the Bureau's September 2022 Military Lending Act and Consumer Financial Protection Act lawsuit against MoneyLion Technologies Inc., ML Plus, LLC, and 37 lending subsidiaries (S.D.N.Y. No. 1:22-cv-08308; status listed as Post Order/Post Judgment).
A Hinshaw & Culbertson LLP analysis of the settlement notes that in CFPB v. MoneyLion Technologies, No. 1:22-cv-08308 (S.D.N.Y.), 'the Bureau did not assess any civil money penalties, and the settlement order permits MoneyLion to exclude its annual membership fee from the Military Annual Percentage Rate ("MAPR")' -- the $1.75 million paid under the court-entered stipulated final judgment is consumer restitution, not a penalty.
MoneyLion's App Store privacy label discloses that Contact Info and Identifiers 'may be used to track you across apps and websites owned by other companies' — Apple's cross-app/site tracking category.
MoneyLion's privacy policy discloses that it uses cookies, web beacons, device fingerprinting, and session-replay technologies for analytics and interest-based advertising, and separately states the Site does not respond to 'Do Not Track' browser signals.