PayPal Settles FTC Charges that Venmo Failed to Disclose Information to Consumers About the Ability to Transfer Funds and Privacy Settings; Violated Gramm-Leach-Bliley Act

The Federal Trade Commission has reached a settlement with PayPal, Inc. over allegations that the company told users of its Venmo peer-to-peer payment service that money credited to their Venmo balances could be transferred to external bank accounts without adequately disclosing that the transactions were still subject to review and that funds could be frozen or removed.

In its complaint, the FTC also charges that Venmo misled consumers about the extent to which they could control the privacy of their transactions. In addition, Venmo misrepresented the extent to which consumers’ financial accounts were protected by “bank grade security systems,” and violated the Gramm-Leach-Bliley Act’s Safeguards and Privacy Rules, the complaint alleges.

According to the complaint, Venmo sent its users notifications that money had been credited to their Venmo balances and was available for transfer to an external bank account. However, the FTC says that Venmo failed to disclose that these funds could be frozen or removed based on the results of Venmo’s review of the underlying transaction. As a result, consumers complained that at times, Venmo delayed the withdrawal of funds or reversed the underlying transactions after initially notifying them that the funds were available.

The FTC alleges that many consumers said they experienced financial hardships, such as being unable to pay their rent or other bills, because they could not transfer the money as promised by Venmo. Other consumers who used Venmo to receive payment for event tickets or other valuable items relied on the notifications that money had been credited to their Venmo account, delivered the item to the purchaser, and consequently incurred a financial loss when Venmo removed the funds.

“Consumers suffered real harm when Venmo did not live up to the promises it made to users about the availability of their money,” said Acting FTC Chairman Maureen K. Ohlhausen. “The payment service also misled consumers about how to keep their transaction information private. This case sends a strong message that financial institutions like Venmo need to focus on privacy and security from day one.”

The FTC also alleges that Venmo misled consumers about the extent to which they could keep transactions private. By default, some information about transactions between users is displayed on Venmo’s social news feed. Venmo offers privacy settings that enable consumers to limit who can view such transactions, but Venmo misled consumers about how those settings work.

According to the complaint, a Venmo consumer who limits their “default audience” for “future transactions” has not ensured that their transactions will remain private unless they also change a second setting. Unless the consumer changes both settings, certain transactions may still be shared publicly. Also, unless that second setting is changed, where a consumer has specifically chosen to keep a particular transaction private, the other participant in the transaction can override the consumer’s privacy choices and retroactively make a private transaction public. According to the complaint, Venmo at times misrepresented what steps were necessary to keep transactions private and in any case failed to adequately disclose these facts to consumers.

The FTC also alleges that, until at least March 2015, Venmo misrepresented the extent of security it provided to consumer financial accounts, claiming that it utilized “bank-grade security systems.” The FTC alleges, however, that through at least August 2014, Venmo did not have a written information security program. Until at least March 2015, Venmo failed to notify users when their password or email address had been changed, or when a new device had been added to their account. As a result, unauthorized users were able to withdraw funds from consumer accounts – without Venmo notifying consumers. In addition, Venmo lacked adequate customer support to respond to consumer complaints about these incidents.

In addition, the Commission alleges that Venmo violated the Gramm-Leach-Bliley Act’s Safeguards Rule, which requires financial institutions to implement safeguards to protect the security, confidentiality, and integrity of customer information, and Privacy Rule, which requires financial institutions to deliver privacy notices to customers.

As part of the proposed settlement with the FTC, Venmo is prohibited from misrepresenting any material restrictions on the use of its service, the extent of control provided by any privacy settings, and the extent to which Venmo implements or adheres to a particular level of security. Venmo is also required to make certain disclosures to consumers about its transaction and privacy practices, and is prohibited from violating the Privacy Rule and the Safeguards Rule. Consistent with several past cases involving violations of Gramm-Leach-Bliley Act Rules, Venmo is required to obtain biennial third-party assessments of its compliance with these rules for 10 years.

The Commission vote to issue the administrative complaint and to accept the proposed consent agreement was 2-0. The FTC will publish a description of the consent agreement package in the Federal Register shortly. The agreement will be subject to public comment for 30 days, beginning today and continuing through March 29, after which the Commission will decide whether to make the proposed consent order final. Interested parties can submit comments electronically by following the instructions in the “Invitation To Comment” part of the “Supplementary Information” section.

NOTE: The Commission issues an administrative complaint when it has “reason to believe” that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. When the Commission issues a consent order on a final basis, it carries the force of law with respect to future actions. Each violation of such an order may result in a civil penalty of up to $41,484.

The Federal Trade Commission works to promote competition, and protect and educate consumers. You can learn more about consumer topics and file a consumer complaint online or by calling 1-877-FTC-HELP (382-4357). Like the FTC on Facebook, follow us on Twitter, read our blogs and subscribe to press releases for the latest FTC news and resources.