Karsten Wenzlaff, Advisor
August 26th, 2025
Karsten Wenzlaff is a Crowdfunding and Fintech Expert from Germany. He is Secretary-General of Digit[...]
Why Meaningful Consent Is Key for Fintechs Post-Facebook Ruling
Data Privacy | Sep 10, 2024
Image: Freepik/rawpixel.com
What fintechs can learn from Facebook’s privacy breach
Yesterday, Philippe Dufresne, the Privacy Commissioner of Canada, issued a statement welcoming the Federal Court of Appeal's ruling in Canada's Privacy Commissioner vs Facebook (Meta). The court found that Facebook violated Canadian privacy laws by failing to secure meaningful consent from users and not adequately safeguarding their personal information.
See: 2023 Data Privacy in North America – Year in Review
This lawsuit was triggered because Facebook enabled the app "thisisyourdigitallife" (TYDL) between November 2013 and December 2015 to access not just user data but also data from users' friends without their permission, which was ultimately sold to Cambridge Analytica for political profiling - 50 million profiles in total. While the case centers on social media, it offers critical lessons for fintechs that handle sensitive financial data, as consumer protection and data privacy regulations tighten.
Top 3 Takeaways for Fintechs
1. Prioritize Meaningful Consent
Facebook failed to obtain clear and meaningful permission. The companies privacy regulations failed to ensure user's (and their friends) understood how their data would be used. Transparency is top priority for fintechs. They need to make sure users clearly understand what they are agreeing to when they share their personal and financial information.
- Keep privacy rules simple and uncomplicated. Eliminate 'legalese' that might confuse users.
- Make sure that consent is explicit (they know exactly how their data will be used) especially when sharing financial information. Users must also be able to cancel consent so it must be retractable.
- Notify users regularly of any changes to the data usage policy, and update consent when new services or partners are introduced.
2. Implement Robust Data Safeguards
Strong security measures are required by law and essential for financial technology companies, as financial data is extremely sensitive. The court determined that Facebook had not sufficiently protected user data, especially when sharing it with other programs.
See: Privacy and Crypto Shaken as Telegram’s CEO Arrested
- Vet third-party suppliers' privacy policies and make sure they will follow your data protection rules as part of your comprehensive due diligence process before exchanging data with them.
- Implement automated and manual checks to ensure that third parties are consistently adhering to the agreed upon data security standards.
- Use layered/robust security methods, such as multi-factor authentication, encryption, and other measures that prevent data breaches and safeguard reputation.
3. Accountability for Third-Party Data Use
The lawsuit exposed Facebook's failure to sufficiently oversee third-party apps that use its platform (like TYDL), which sold the inappropriately obtained data to Cambridge Analytica (the scandal).
- Conduct regular privacy and security audits to make sure all third-party providers handling user data are meeting compliance standards.
- Use explicit and enforceable data protection terms in contracts with third parties. Be sure to include consequences for non-compliance.
- Give users clear information about how their data will be shared with third parties, and allow them to limit or remove access.
Why It Matters
By learning from Facebook’s mistakes, fintechs can stay ahead of tightening regulations, protect their customers, and foster trust in a competitive quickly changing environment.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
 |  |  |
|---|---|---|
 |  |  |
Leave a Reply