SoFi Technologies (NASDAQ: SOFI) is a publicly traded digital bank and lender operating through nationally chartered SoFi Bank, N.A. Its GLBA notice (rev. 08/2025) lists collection of Social Security numbers, income, credit scores, and transaction history, and answers "Yes" to every federal sharing category, including joint marketing and nonaffiliate marketing (the latter with an opt-out). Its privacy policy (June 2026) discloses biometric ID-verification data, precise geolocation, third-party ad cookies and pixels, and sale/sharing of identity, contact, and online-activity data for cross-context behavioral advertising, with account toggles and Global Privacy Control honored. SoFi owns Galileo, a B2B payments platform processing accounts for other fintechs. Track record: a 2018 FTC consent order, a 2021 SEC order against SoFi Wealth, and a 2026 vendor breach at its Hong Kong subsidiary.
TRACK RECORD
2 ENFORCEMENT ACTIONS
[2021-08-19]
On August 19, 2021, the SEC instituted settled charges against robo-adviser SoFi Wealth, LLC for breaching fiduciary duties by moving approximately 20,000 client accounts into proprietary SoFi-sponsored ETFs in April 2019 without disclosing conflicts of interest; SoFi Wealth agreed to a cease-and-desist order, censure, and a $300,000 penalty.
On October 29, 2018, the FTC announced that Social Finance, Inc. and SoFi Lending Corp. agreed to settle charges that SoFi deceptively advertised inflated average student-loan refinancing savings; the final consent order, approved in February 2019, prohibits SoFi from misrepresenting savings without competent and reliable evidence.
SoFi's legal terms for its credit score monitoring service state that enrolled users authorize SoFi to obtain their full credit reporting information from a credit reporting agency on a recurring basis, and its Insights connected-accounts feature requires linking external financial accounts through the aggregator Plaid.
SoFi's U.S. Consumer Privacy Notice (GLBA notice, rev. 08/2025) states the personal information it collects and shares can include Social Security number, employment information, credit scores, income, payment and credit history, transaction history, assets, account balances, and insurance claim history, and that SoFi also collects personal information from credit bureaus, affiliates, and other companies.
SoFi's Privacy Policy (last updated June 5, 2026) discloses collection of biometric information from government IDs and images for identity verification, and, with consent, precise geolocation data (within a 1,850-foot radius) to help users locate ATMs.
SoFi announced on April 7, 2020 that it agreed to acquire Galileo Financial Technologies, a financial services API and payments platform, for $1.2 billion; Galileo provides banking infrastructure to other companies, meaning SoFi owns a platform that processes account and payments data for other fintechs' customers.
SoFi Technologies, Inc.'s Annual Report on Form 10-K for fiscal year 2024 (filed with the SEC on February 24, 2025) discloses that SoFi Technologies is a bank holding company and that SoFi Bank is a nationally chartered association subject to regulatory capital rules of the Federal Reserve, OCC, and FDIC, with subsidiaries listed in the filing.
SoFi publishes an annual CCPA requests report inside its Privacy Policy, disclosing the number of California consumer privacy requests (access, deletion, opt-out) it received and responded to during calendar year 2025.
SoFi's GLBA notice (rev. 08/2025) answers "Yes" to every federal sharing category, including joint marketing with other financial companies and sharing with nonaffiliates to market to you (opt-out available for nonaffiliate and affiliate marketing); it defines the nonaffiliates it shares with to include advertisers, and states sharing continues after the customer relationship ends.
SoFi's Privacy Policy CCPA disclosures (June 5, 2026) state that SoFi shares identity, profile, contact, online-activity, and limited financial data with social media platforms and marketing/advertising companies for interest-based advertising; registered users can opt out of this sale/sharing via an account toggle, and SoFi treats Global Privacy Control browser signals as valid opt-out requests.
On October 29, 2018, the FTC announced that Social Finance, Inc. and SoFi Lending Corp. agreed to settle charges that SoFi deceptively advertised inflated average student-loan refinancing savings; the final consent order, approved in February 2019, prohibits SoFi from misrepresenting savings without competent and reliable evidence.
On August 19, 2021, the SEC instituted settled charges against robo-adviser SoFi Wealth, LLC for breaching fiduciary duties by moving approximately 20,000 client accounts into proprietary SoFi-sponsored ETFs in April 2019 without disclosing conflicts of interest; SoFi Wealth agreed to a cease-and-desist order, censure, and a $300,000 penalty.
SoFi disclosed to customers that on April 30, 2026 it discovered unauthorized access to a database of SoFi Securities (Hong Kong) Limited through a third-party vendor; as of BleepingComputer's June 8, 2026 report, SoFi said the scope of the incident and the categories of personal data involved were not yet known.
SoFi's Privacy Policy (last updated June 5, 2026) discloses use of cookies, pixels/web beacons, and local storage, and states that its third-party advertising providers collect information about users' interactions with SoFi's website and communications to serve interest-based ads; it lists opt-out settings at Google, Bing, Facebook, and TikTok.