Venmo, a peer-to-peer payments service operated by PayPal, Inc., discloses in its privacy statement and user agreement that it collects broad categories of financial and personal data and may share information with payment partners, merchants, and platform integrators such as Apple. By default, Venmo publishes every peer-to-peer transaction, a feature shown by researchers to reveal sensitive details about users' lives, and in 2018 the company settled FTC charges alleging related privacy and security violations. Corporate ownership is disclosed clearly and consistently across Venmo's legal documents, while the company's track record includes one federal consent order, two documented public-data scraping incidents, and a settlement involving a third-party account-linking vendor.
TRACK RECORD
2 ENFORCEMENT ACTIONS
[2018-05-24]
On May 24, 2018, the FTC granted final approval to its settlement with PayPal over Venmo, requiring the company to obtain biennial third-party compliance assessments for ten years.
On February 27, 2018, the FTC's complaint alleged that Venmo misrepresented its security practices, including a statement that it used "bank-grade security systems," and that the disclosure requirements of the Gramm-Leach-Bliley Act's Privacy Rule were violated.
Venmo's privacy statement discloses that, for California residents, it must specify the business purpose for which each category of personal information — including "sensitive personal information" as defined under the CCPA — is used.
An academic privacy analysis of Venmo's policy found that Venmo collects a wide range of personal data categories, including financial account information, government identification numbers, and location data.
Venmo's user agreement (dated February 2025) reiterates that the contract governing use of Venmo accounts and services is between the user and PayPal, Inc.
Venmo's privacy statement discloses that it may disclose personal information to partners and merchants to enable their use of Venmo's services to facilitate transactions, and that such shared data is then subject to those partners' own privacy policies.
As assessed by Common Sense Privacy on 2024-04-16, Venmo's terms state the company does not sell data but may share personal information with third parties for promotional purposes.
On February 27, 2018, the FTC's complaint alleged that Venmo misrepresented its security practices, including a statement that it used "bank-grade security systems," and that the disclosure requirements of the Gramm-Leach-Bliley Act's Privacy Rule were violated.
On May 24, 2018, the FTC granted final approval to its settlement with PayPal over Venmo, requiring the company to obtain biennial third-party compliance assessments for ten years.
In 2018, a researcher used Venmo's public API to download approximately 207 million public transactions, demonstrating the exposure created by Venmo's public-by-default transaction settings.
In 2022, a federal court granted final approval to a $58 million class-action settlement involving Plaid, a third-party bank-account-linking vendor used by Venmo and other fintech apps, resolving claims that Plaid obtained and used consumers' banking credentials and financial data without adequate consent.
As assessed by Common Sense Privacy on 2024-04-16, Venmo's policy permits the company and its business partners and vendors to use cookies and other tracking technologies to recognize users and display targeted advertising.