PayPal, operated by publicly traded PayPal Holdings, Inc., maintains a detailed privacy statement disclosing collection of financial and identity data (including from data brokers and connected bank accounts) and broad third-party sharing for advertising, credit assessment, and business-transfer purposes. The company shares personal information collected after November 27, 2024 for personalized shopping experiences in the United States unless a user opts out or consent is otherwise required, a default-sharing design that has drawn press scrutiny. The company's regulatory record includes a 2018 FTC settlement over Venmo's privacy and security disclosures, a December 2022 credential-stuffing breach affecting tens of thousands of accounts, and a 2025 New York regulator fine tied to that incident.
TRACK RECORD
3 ENFORCEMENT ACTIONS
[2025-01-23]
On January 23, 2025, the New York State Department of Financial Services issued a Consent Order fining PayPal, Inc. $2 million for cybersecurity regulation violations connected to the exposure of unredacted Social Security numbers and dates of birth on customer 1099-K tax forms during the 2022 incident.
In its Form 10-Q, PayPal disclosed that on February 27, 2018 it entered a Consent Order with the FTC settling allegations arising from Venmo services between 2013 and 2017; the order did not include a monetary penalty but required changes to Venmo's disclosures and business practices, and was approved by the FTC on May 24, 2018.
In February 2018, the FTC settled administrative charges against PayPal, Inc. alleging that its Venmo service engaged in deceptive practices and violated the Gramm-Leach-Bliley Act's Safeguards and Privacy Rules, including misrepresenting Venmo's use of "bank-grade security systems."
PayPal's privacy statement discloses that it collects categories of personal data from third parties, including identity verification vendors, data brokers, fraud-detection vendors, banks, merchants, and other third-party platforms a user engages with.
As assessed by PrivacySpy on 2020-12-07 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the service collect personal data from third parties? — Yes, but for critical data only.
As assessed by PrivacySpy on 2020-12-07 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy outline the service's general security practices? — Yes.
PayPal's EU/UK privacy statement discloses that the terms "PayPal," "we," "us," and "PayPal Companies" refer to PayPal (Europe) S.à r.l. et Cie, S.C.A. and the group of companies each directly or indirectly controlling, controlled by, or under common ownership with it — disclosing the corporate group structure within the policy itself.
PayPal's Privacy Principles page states that the company shares personal information with third parties such as affiliates, merchants, partners, credit reporting agencies, and service providers.
As assessed by PrivacySpy on 2020-12-07 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy allow personally-targeted or behavioral marketing? — No.
The current U.S. privacy statement discloses that, unless consent is legally required, PayPal shares personal information collected after November 27, 2024 (or earlier with consent) with participating stores for personalized-shopping purposes, and this sharing setting has been reported as enabled by default for most U.S. users.
In its Form 10-Q, PayPal disclosed that on February 27, 2018 it entered a Consent Order with the FTC settling allegations arising from Venmo services between 2013 and 2017; the order did not include a monetary penalty but required changes to Venmo's disclosures and business practices, and was approved by the FTC on May 24, 2018.
In February 2018, the FTC settled administrative charges against PayPal, Inc. alleging that its Venmo service engaged in deceptive practices and violated the Gramm-Leach-Bliley Act's Safeguards and Privacy Rules, including misrepresenting Venmo's use of "bank-grade security systems."
As assessed by PrivacySpy on 2020-12-07 (see PrivacySpy's rubric entry for this product for the per-claim citation): Does the policy require users to be notified in case of a data breach? — Yes, eventually.
PayPal disclosed a data breach in which a credential-stuffing attack between December 6–8, 2022 resulted in unauthorized third parties accessing 34,942 user accounts, exposing names, addresses, dates of birth, Social Security numbers, and tax identification numbers.
On January 23, 2025, the New York State Department of Financial Services issued a Consent Order fining PayPal, Inc. $2 million for cybersecurity regulation violations connected to the exposure of unredacted Social Security numbers and dates of birth on customer 1099-K tax forms during the 2022 incident.
PayPal's privacy statement discloses use of Google's reCAPTCHA on its mobile application to prevent misuse of its services, meaning Google's own privacy policy governs data processed through that embedded technology.