PayPal bought coupon browser extension Honey for $4 billion in 2020 and turned it into a surveillance tool installed on 20 million browsers. YouTuber MegaLag discovered in December 2024 that every time you clicked "Apply Coupon," Honey silently replaced the content creator's affiliate tracking cookie with its own — stealing commission from creators like Sam Denby of Wendover Productions, who filed a class action. Honey tracked browsing across every website, not just shopping sites. After the exposé, 8 million users uninstalled it and Rakuten kicked Honey off its affiliate network in January 2026. In October 2022, PayPal quietly updated its terms to let it reach into your account and take $2,500 every time you posted something PayPal — at its "sole discretion" — considered "misinformation." Not a court, not a regulator. PayPal. Its own former president David Marcus publicly said "this goes against everything I believe in." PayPal claimed the entire policy was published "in error" — despite the Wayback Machine showing it was live for 11 days. A payment processor tried to become a speech arbiter with the power to drain your bank account.
What they claim: PayPal's privacy policy states it collects data to provide and improve services and protect users.
What we found: PayPal's Honey browser extension tracked all browsing activity across every website. In December 2024, YouTuber MegaLag exposed that Honey performed cookie stuffing — silently replacing content creators' affiliate cookies with its own, stealing commission revenue. The scheme generated an estimated $1.4 billion in revenue for PayPal. Honey lost 8 million of its 20 million users after the exposé. In January 2026, Rakuten Advertising removed Honey from its affiliate network.
What they claim: PayPal's privacy policy describes limited, purposeful data sharing with third-party partners.
What we found: PayPal shares data with over 600 third parties. In October 2024, PayPal enabled a new data-sharing setting by default called Personalised Shopping that shares purchase history, browsing data, and financial information with participating stores. Users were not asked; they had to discover the pre-ticked box and manually opt out.
What they claim: PayPal implements appropriate technical and organisational measures to protect personal data.
What we found: In January 2025, New York DFS fined PayPal $2 million after discovering its Form 1099-K system exposed Social Security numbers, names, and dates of birth for 35,000 customers. PayPal's engineering team classified a system update incorrectly, bypassing risk assessments and penetration testing. PayPal had not implemented mandatory multi-factor authentication.
What they claim: PayPal's Acceptable Use Policy says it protects user funds from unauthorized deductions.
What we found: In October 2022, PayPal published an updated AUP allowing it to deduct $2,500 per infraction from user accounts for posting "misinformation" — with what counts as misinformation determined at PayPal's sole discretion. PayPal's own former president David Marcus publicly condemned the policy. PayPal reversed it within days, claiming it was published "in error," but the Wayback Machine confirmed it was live for 11 days.
What they claim: Venmo (owned by PayPal) states users have control over their privacy settings.
What we found: Venmo set all transactions to public by default, with no option to hide friends lists. In May 2021, BuzzFeed News found President Joe Biden's secret Venmo account in under 10 minutes, mapping his entire social network including senior White House officials. The EFF documented therapists with exposed patient lists, women stalked by ex-boyfriends, and journalists with burned sources. Venmo only added the option to hide friends lists after the Biden incident.
What they claim: PayPal states it processes refunds and holds funds only to protect against fraud.
What we found: PayPal routinely holds seller funds for up to 180 days without explanation, even for established sellers with clean records. Multiple class action lawsuits and thousands of CFPB complaints document PayPal freezing accounts containing thousands of dollars with no fraud detected and no appeal process. Small businesses have been bankrupted waiting for PayPal to release operating capital.