EPIC CFPB Complaint: Rocket Money

On behalf of the Electronic Privacy Information Center (EPIC), the NYU Tech Law and Policy Clinic filed a complaint with the Consumer Financial Protection Bureau against financial technology company Rocket Money (formerly Truebill), alleging unfair, deceptive, and abusive trade practices and violations of the the Fair Credit Reporting Act.

The complaint alleges that the manipulative design of Rocket Money’s interface and its misleading representations to consumers are unfair, deceptive, and abusive practices under the Dodd-Frank Act. While Rocket Money advertises itself as free, the labyrinthine design of its sign-up process extracts fees from users. Rocket Money also advertises strong data privacy practices to its users, claiminging that it takes data privacy “very seriously. Like the most seriously” and promising its users that “we’ll never sell your data.” But provisions in Rocket Money’s Privacy Policy contradict these promises, acknowledging that “Rocket has shared personal information with third parties or Affiliates, in exchange for valuable consideration.”

Moreover, Rocket Money operates as a consumer reporting agency but fails to abide by the requirements for consumer reporting agencies set out in the Fair Credit Reporting Act (FCRA). For example, it shares reports about its customers without having a “permissible purpose” to do so. Rocket Money likewise obtains and uses its customers’ credit reports to engage in self-promotional marketing, another violation of the FCRA.

With this filing, EPIC further expands its advocacy for consumer protection and data privacy into the fintech space. EPIC has commented on the Consumer Financial Protection Bureau inquiry into big tech payment platforms and recommended that the Bureau strengthen Buy Now Pay Later data practices. EPIC also recently advocated that the Federal Trade Commission use all of its authorities to protect consumers, including its Section 5 rulemaking authority to promulgate a commercial surveillance rule and establish a data minimization rule. EPIC encourages the CFPB to protect consumers from data privacy harms in the fintech industry. 

Full Complaint with Exhibits available here.

Complaint without Exhibits available here.

Exhibits only available here.