Lawmakers call for FTC probe into top financial data aggregator

Lawmakers call for FTC probe into top financial data aggregator
© Aaron Schwartz

A group of lawmakers on Friday called on the Federal Trade Commission (FTC) to investigate one of the top financial data aggregators in the U.S., questioning whether it is collecting reams of sensitive information on Americans without adequate consent. 

Sens. Ron WydenRonald (Ron) Lee WydenHillicon Valley: Dems cancel surveillance vote after pushback to amendments | Facebook to ban certain coronavirus ads | Lawmakers grill online ticketing execs | Hacker accessed facial recognition company's database On The Money: Coronavirus complicates Fed decision on rates | Schumer wants .5B in emergency virus funding | Dems offer bill to reverse Trump on military money for wall Hillicon Valley: Democrats cancel surveillance vote over pushback to amendments | Lawmakers grill Ticketmaster, StubHub execs over online ticketing | MORE (D-Ore.) and Sherrod BrownSherrod Campbell BrownOn The Money: Stocks close with second day of steep losses | Dow falls over 800 points as coronavirus fears grow | Kudlow claims virus has been contained | US expects China to honor trade deal amid outbreak Hillicon Valley: Agencies play catch-up over TikTok security concerns | Senate Dems seek sanctions on Russia over new election meddling | Pentagon unveils AI principles Senate Democrats urge Trump administration to impose sanctions on Russia for election interference MORE (D-Ohio), alongside Rep. Anna EshooAnna Georges EshooHillicon Valley: US hits Huawei with new charges | Judge orders Pentagon to halt 'war cloud' work amid Amazon challenge | IRS removes guidance on Fortnite game currency Democrats criticize FCC for not taking action against DC station broadcasting Russian disinformation Gillibrand proposes creating new digital privacy agency MORE (D-Calif.), said the FTC should probe Envestnet, a huge financial services company that owns the largest consumer financial data aggregator in the U.S. The probe comes as Congress has intensified its scrutiny of large corporations collecting personal information on nearly every American. 

“The consumer data that Envestnet collects and sells is highly sensitive," Wyden, Brown and Eshoo wrote in a letter to the FTC. "Consumers’ credit and debit card transactions can reveal information about their health, sexuality, religion, political views, and many other personal details."


"And the more often that consumers’ personal information is bought and sold, the greater the risk that it could be the subject of a data breach," they added.

Envestnet said in a statement Friday that it "is dedicated to improving the financial lives of consumers and does so in compliance with law and regulations and in accordance with leading industry practices for data security, regulatory compliance and privacy." 

"We welcome informed discussion about ways to further data privacy as we continue to build on our pioneering work with financial institutions, regulators and other industry experts," the company said, noting that it scrubs any personal identifiers from its financial data.

Envestnet owns Yodlee, a financial data aggregator used by 15 of the 20 largest banks in the country to offer personal finance tools for customers. Lawmakers are raising concerns that customers aren't given proper notice that Envestnet will collect and sell access to their information.

"Envestnet does not inform consumers that it is collecting and selling their personal financial data," they wrote. "Instead, Envestnet only asks its partners, such as banks, to disclose this information to consumers in their terms and conditions or privacy policy. That is not sufficient protection for users."

Democrats are asking the FTC to look into whether Envestnet's practices are unfair, deceptive or abusive.

Yodlee says it anonymizes the financial data it sells, meaning it does not identify individuals associated with their personal information. But studies have shown that it is relatively easy to "de-anonymize" data, drawing back the information to individual people.

Updated at 2:54 p.m.