NYU’s Technology Law and Policy Clinic and EPIC Urge CFPB to Protect Consumers from Abusive Fintech Practices
By Molly Collett (‘23) and Carmen Lyon (‘23)
The Electronic Privacy Information Center (EPIC), a DC-based tech law nonprofit, has partnered with NYU’s Technology Law and Policy Clinic to file a Complaint with the Consumer Financial Protection Bureau (CFPB) against financial-technology company Rocket Money (fka Truebill). The Complaint alleges that the app’s use of dark patterns and its handling of customers’ financial data per its privacy policy constitute deceptive practices. Dark patterns are designs that manipulate or heavily influence users to make certain choices. Rocket Money uses dark patterns when the app advertises itself as free, while the design of its labyrinthine sign-up process serves to extract fees from its users. Meanwhile, Rocket Money also advertises data privacy to its users, representing that it takes data privacy “the most seriously” and promises its users that “[it will] never sell your data.” Its Privacy Policy renders these promises hollow by acknowledging that “Rocket has shared personal information with third parties or Affiliates, in exchange for valuable consideration.”
Fintech, a collision of the words “financial technology,” refers to a fast-growing sector of companies that use new technologies to compete with traditional financial services firms to assist users in achieving their financial goals. As of 2021, nearly nine in 10 Americans were reported as using some kind of fintech app, from budgeting and saving apps to investment apps, to manage their financial lives. These companies may utilize artificial intelligence, Blockchain, Cloud computing, and big data, and include such companies as Square, Mint, Coinbase, Robinhood, and Acorns.
Until recently, however, the rapidly growing fintech sector largely occupied a regulatory gray area, being treated by regulators as more a part of the tech industry than the financial industry. As a result, these companies have not been subject to the stringent regulation that governs the financial industry, despite having access to highly sensitive consumer financial information. But in April 2022, the CFPB, the federal watchdog of the financial industry, announced that it would start investigating fintech companies. The CFPB’s Director, Rohit Chopra, noted of this development that “[g]iven the rapid growth of consumer offerings by nonbanks [i.e. fintech companies], the CFPB is now utilizing a dormant authority to hold nonbanks to the same standards that banks are held to.”
EPIC saw this sea change at the CFPB as the perfect opportunity to expand their advocacy practice around consumer protection and data privacy into the fintech space. EPIC has a longstanding commitment to consumer protection and privacy in the digital age. For example, EPIC has commented on the CFPB’s inquiry into big tech payment platforms, and advocated for the FTC to promulgate commercial surveillance and data-minimization rules. With this Complaint against Rocket Money, the NYU Tech Law & Policy Clinic is helping EPIC take concrete action against abusive fintech practices. The Complaint urges the CFPB to investigate Rocket Money’s practices and use the agency’s market-monitoring authority to investigate how the fintech industry works. Since Chopra took the helm as the CFPB’s Director last year, the agency has been flexing its market-monitoring authority, issuing orders for tech companies to provide information about their business models and practices. In this way, the Complaint addresses both discrete practices at Rocket Money as well as industry-wide abuses of consumer protection.
