Yodlee
Closing the account does not close the file. Money-laundering and tax rules keep your identity and transaction records for years, and a permission to share your data wherever the law allows covers much of the rest. The holds set by statute are the ones no request can move.
Reported incidents
FTC closed its inquiry into its data practices with no further action
2021-02-26Affected Transaction data panels
Envestnet, then the owner of Yodlee, said in its annual report filed on 26 February 2021 that the US Federal Trade Commission had told it in November 2020 that it had closed its inquiry with no further action. The inquiry had begun with a civil investigative demand in February 2020 about its data collection, sharing and deletion practices, which Envestnet said it fully complied with. The same report said its arrangements with the banks and apps that supply the data "generally permit us to use non-identified transaction level data", and that some decline.
FTC demanded records on how it collects, shares and deletes people's data
2020-02-28Affected Transaction data panels
Envestnet, then the owner of Yodlee, said in its annual report filed on 28 February 2020 that it had received a civil investigative demand from the US Federal Trade Commission that month. The demand asked for documents and information about its "data collection, assembly, evaluation, sharing, correction and deletion practices". The report placed it after a request from three members of Congress, in January 2020, that the FTC review its practice of providing de-identified transaction data panels to customers for analytics and market research.
Leaked document showed the card data it sells keeps an ID for each cardholder
2020-02-19Affected Transaction data panels sold to investment firms
On 19 February 2020 Vice published a confidential Yodlee document describing the transaction data it sells to investment firms, drawn from the bank and card transactions of tens of millions of Americans. Names, email addresses and account numbers were removed. Each record kept a unique identifier for the cardholder, the amount, the date, and the city, state and zip code of the business, and clients received new files daily. Vivek Singh of Rutgers University told Vice that three to four transactions with their times and places are enough to unmask a person with very high probability.
Lawmakers asked the FTC to investigate its sale of bank transaction data
2020-01-17Affected Transaction data panels sold for analytics and market research
On 17 January 2020 Senators Ron Wyden and Sherrod Brown and Representative Anna Eshoo asked the US Federal Trade Commission to investigate Envestnet, then the owner of Yodlee. Apps and banks use Yodlee to collect transaction data from people's bank and card accounts. The lawmakers said Envestnet sells access to the financial data of tens of millions of Americans without telling them, and only asks partners such as banks to disclose it in their terms. Envestnet's annual report said it would "de-identify and then provide consumer transaction data panels to customers to support data analytics and market research."
People affected typically ask Yodlee to confirm whether their information was included, and which categories.
The verified route
Where data goes
What Yodlee likely holds
What banks typically hold about you, from our industry research, the most sensitive first.
Pick a folder to see where it goes.
Most sensitive
Sensitive
Everyday
Where it goes
On Yodlee's behalf
They handle your data on Yodlee's instructions. If Yodlee uses them, a request to Yodlee should reach them.
Inferred services
Services banks typically use.
Get their own copy
A request to Yodlee doesn't reach them. Each needs its own, and some keep records under a legal duty.
Inferred practices
What banks typically do with your data, from our industry research.
DÆTRAX is a personal data accountability ledger: a dated record of which companies hold your personal data, what you asked them to do about it, and what they claimed in reply.