On September 1, 2026, four Venmo users filed a proposed class-action lawsuit against PayPal in federal court in California, and it hit the headlines fast. The claim is unsettling: that Venmo quietly fed users’ “private” transaction details — including names, contact info, payment amounts, who you paid, and even the notes you typed — to outside tracking companies. If you’ve ever marked a Venmo payment as private and assumed that setting actually kept it private, you probably want to know whether this affects you.
Here’s a clear, accurate breakdown of what the lawsuit actually alleges, what’s proven (nothing yet), and the concrete steps you can take right now to lock down your account.
What the lawsuit actually claims
The complaint was filed by plaintiffs Stacey Borquez, Remi Rundzio, Nathan Olson, and Lana Nava, and reported by Bloomberg Law, Law360, and MLex in early September 2026. It’s a proposed class action, meaning a judge has not yet certified a class, and none of the allegations have been proven in court.
The core accusation: PayPal embedded third-party tracking software inside the Venmo app, and that software allegedly intercepted and transmitted sensitive user data to outside firms — regardless of whether a user had set a transaction to “private.” The two tracking companies named are:
- mParticle — a customer-data platform that the complaint says builds persistent user profiles for advertising partners.
- Kochava — a mobile-attribution company that also operates as a data broker.
According to the complaint, the data allegedly shared included full names, email addresses, phone numbers, payment amounts, recipients, and the free-text notes attached to payments. The plaintiffs argue this contradicts Venmo’s own promises. Venmo’s privacy statement says it “does not disclose your personal information with third parties for their promotional or marketing purposes,” and its help center says a payment marked private will not appear “anywhere other than in your personal transactions feed under the Me tab and with the other participant.”
The laws in play
The suit alleges violations of the federal Electronic Communications Privacy Act (ECPA) and the California Invasion of Privacy Act (CIPA), among other state privacy laws. These statutes carry the kind of per-violation penalties that make class actions financially significant.
| Element | Detail (as alleged) |
|---|---|
| Filed | September 1, 2026 — U.S. District Court, California |
| Defendant | PayPal, Inc. (operator of Venmo) |
| Trackers named | mParticle, Kochava |
| Data at issue | Names, emails, phone numbers, amounts, recipients, payment notes |
| Laws cited | ECPA (federal), CIPA (California), other state privacy laws |
| Status | Proposed class action; unproven allegations |
For scale: CIPA (Cal. Penal Code § 637.2) generally allows statutory damages of $5,000 per violation, and the ECPA wiretap provisions allow the greater of actual damages or $100 per day up to $10,000. Multiply those figures across millions of users and you can see why the case drew attention — though actual outcomes in privacy suits are usually far smaller, and many settle or get dismissed.
Are you affected?
If you used the Venmo app during the period the tracking software was allegedly active, you could fall within the proposed class. But two practical caveats matter a great deal:
- No class is certified yet. There is nothing to “sign up” for today, and no settlement fund exists. Be skeptical of any website promising an instant Venmo payout — those are often lead-generation or scam pages.
- Venmo’s user agreement contains an arbitration clause. Like many fintech apps, Venmo’s terms generally push disputes into individual arbitration and include a class-action waiver. That can limit who ultimately participates in a class case, unless a user validly opted out of arbitration when they signed up.
Worked example: Say you sent your roommate $60 for utilities in March 2026 and marked it private, with a note like “rent + wifi.” The lawsuit’s theory is that the amount, your roommate’s identity, and that note could have been transmitted to a tracker anyway. Whether that actually happened to your specific transaction is exactly what discovery in the case would need to establish — it’s an allegation, not an established fact about your account.
What you can do right now
Regardless of how the litigation shakes out, tightening your settings is smart. Here’s how to make Venmo more private today.
| Step | Action |
|---|---|
| 1 | Open the Venmo app and tap the Me tab. |
| 2 | Tap the gear/settings icon, then Privacy. |
| 3 | Under Default Privacy Settings, choose Private. |
| 4 | Use Past Transactions → Change All to Private to hide your history. |
| 5 | Review the Friends List setting and set it to Private too. |
A few important notes: changing your default only affects future payments, so use the “change all to private” option for old ones. Venmo also warns that making past transactions private is permanent and can’t be reversed. And when two people transact, Venmo applies the more restrictive setting — so if either party is set to private, that payment stays private in the social feed.
Keep in mind: these controls govern the public social feed, which is a separate issue from the backend data-sharing the lawsuit describes. Making transactions private is good hygiene, but it may not by itself stop the kind of tracking-SDK data flow the plaintiffs allege.
Extra privacy steps worth taking
- On your phone, limit ad tracking: iOS users can turn off Allow Apps to Request to Track; Android users can reset or delete their advertising ID.
- Review app permissions and revoke anything Venmo doesn’t strictly need.
- Consider using a data-removal service or manually opting out with data brokers like Kochava.
- Keep documentation (screenshots of settings, transaction records) in case a class is later certified and you want to file a claim.
Frequently Asked Questions
Do I need to do anything to join the lawsuit?
Not right now. The case is a proposed class action that hasn’t been certified. If a class is certified or a settlement is reached, official notice would go out with instructions. Avoid third-party sites asking for personal or banking details to “claim” money.
Does marking a payment private protect me from this?
The privacy toggle controls what appears in Venmo’s public/social feed. The lawsuit alleges data was sent to trackers regardless of that setting, so the toggle alone may not address the backend sharing. It’s still worth enabling for everyday privacy.
Has PayPal admitted any of this?
No. As of publication, the allegations are unproven, and companies routinely deny wrongdoing in privacy suits. PayPal had not issued a detailed public statement addressing the specific claims at the time of the filings reported in early September 2026.
Could I get money from this?
Possibly, but it’s far from guaranteed and would likely be modest per person if it happens at all. Privacy class actions often take years and frequently end in dismissal or settlement. Venmo’s arbitration clause may also affect eligibility.
The bottom line
The September 2026 lawsuit is a serious, detailed set of allegations — but they’re allegations, tested in court over the coming months and years, not established facts. You don’t need to panic or hand your information to any “claim” site. The smart move today is to set your Venmo defaults to private, clean up past transactions, tighten your phone’s ad-tracking settings, and keep an eye on official case updates.
WalletWisp is an independent, informational resource and does not provide financial or legal advice. For guidance on your specific situation, consult a qualified professional.
