What Venmo Public Payments Reveal About You

A payment app that turned every transaction into a social post almost from the start. What eight years of FTC, EFF and Mozilla pressure actually changed.

State of Surveillance

TL;DR: Venmo is owned by PayPal, and it has always been a social app with a wallet attached. It was founded in 2009 on the idea that payments could be another form of social content,[4] and the friend list was public with no way to hide it until 2021. Venmo's own privacy policy says your "username, profile photo, first and last name, month and year of Venmo account creation, and public transactions in which you've been involved" are visible to anyone on the internet, that "your Venmo friends list may be seen by any logged-in Venmo user," and that for business and charity profiles the same public information "may be indexed by and searchable on search engines."[1] On February 27, 2018, the FTC announced a settlement with PayPal/Venmo over deceptive privacy and security claims, including the setting that made transactions public by default.[2] A separate settlement document with the Texas Attorney General described the app's "auto-friending feature that pulled in contacts from users' phones."[6] On August 28, 2019, the Electronic Frontier Foundation and Mozilla sent a joint letter to PayPal CEO Dan Schulman and COO Bill Ready asking Venmo to "make transactions private by default" and "give users privacy settings for their friend lists," and warned that "there is no option for a user to hide their friend list."[3] Venmo added a hide-friends-list setting in 2021 after BuzzFeed News reporters Ryan Mac and Katie Notopoulos used the existing public friend list to find President Joe Biden's account.[4][5] Venmo changed the transaction default to friends-only for new sign-ups in 2026, but it did not make that change for friend lists, and the new default does not reach accounts that already exist.[14] Both defaults are something you have to go change yourself.

What the Public Feed Actually Shows About You

Open a browser, paste a Venmo username into the public profile URL, and you get the user's public profile picture, full name, the month and year the account was created, and the list of public transactions the user has been involved in. Venmo's privacy policy describes the disclosure: "Some personal information is public information and may be seen by anyone on the internet, whether or not they have a Venmo account." Public information for personal profiles includes "your Venmo username, profile photo, first and last name, month and year of Venmo account creation, and public transactions in which you've been involved." For business and charity profiles, that same public information "may be indexed by and searchable on search engines."[1]

The transaction entries are short on purpose: a note, an emoji, a timestamp. Venmo's help center spells out what a shared payment exposes: "If your payment is set to Public or Friends, the payment note, names of sender/recipient, and timestamp of the payment will be shared."[13] What rides along in that note is the leak. EFF and Mozilla described what researchers found in it: countless Venmo users' "drug habits, junk food vices, personal finances, and fights with significant others," available for all to see.[3] A USC Viterbi team later put a number on it. They examined 389 million public messages from 2012 to 2020 and found that 41 million transaction notes, or 10.5% of them, leaked sensitive information. The study described that leak as "some sensitive information such as [a] health condition, political orientation and drug and alcohol consumption."[10] That is the data leak: not the dollar amount, but the note and the friend graph. The note tells a stranger what the payment was for. The friend graph tells the stranger who you actually live with, work with, sleep with, and pay.

The mechanism is public by default. Venmo was founded in 2009 on the idea that payments could be another form of social content, and the app let people post about those payments to a public feed.[4] EFF and Mozilla told the company in August 2019 that this design was the problem: Venmo's "transactions are public by default, which can reveal private details about who you spend time with and what you do with them."[3] Seven years later, Venmo was still shipping new features for a social feed rather than a private one.[14]

The Friend Graph: Who's Actually in Your Phone

Venmo's auto-friending feature was the deeper leak. When you signed up, the app could turn your phone book into a social graph. Consumer Reports found that "your Facebook friends and phone contacts can be automatically imported as your Venmo contacts," cross-referencing phone numbers against existing Venmo accounts.[8] A settlement document with the Texas Attorney General described an "auto-friending feature that pulled in contacts from users' phones."[6] Venmo's help center now says the company "has not automatically added your device contacts as friends since 2022."[7] Either way, the people you have paid are still in your friend list, and you are still in theirs.

For years the friend list was not adjustable at all. EFF and Mozilla put it bluntly in 2019: "there is no option for a user to hide their friend list."[3] BuzzFeed News reporters Ryan Mac and Katie Notopoulos demonstrated the consequence in May 2021, when they used the public friend list to find the Venmo accounts of President Joe Biden, the First Lady, and members of their immediate family.[4] The same reporting mapped nearly a dozen Biden family members and a social web of contacts that included the president's children, grandchildren and senior aides.[10] A Venmo spokesperson told BuzzFeed News the company was "enhancing our in-app controls providing customers an option to select a public, friends-only, or private setting for their friends list."[4] A software engineer, Jane Manchun Wong, tweeted a screenshot of the new privacy options on May 28, 2021.[4] EFF published a victory post on June 7, 2021 titled "VICTORY: You Can Now Make Your Venmo Friends List Private."[5]

Wong's tweet, BuzzFeed's investigation, and EFF's victory announcement are three primary sources for the same event. The change shipped. EFF still called it "the bare minimum," and argued that what Venmo "must do next is make privacy the default for transactions and friends lists, not just an option buried in the settings."[5] As of the help page Venmo maintains today, the friends list can still be set so that it is "visible to other Venmo users, to only your Venmo friends, or private," and the toggle lives in Me, Settings, Privacy, Friends List.[7] That is a better position than 2019, when the toggle did not exist at all. It is still not the default. Venmo did not change that for new accounts in 2026.[14]

What the FTC's 2018 Settlement Covered

On February 27, 2018, the Federal Trade Commission announced a settlement with PayPal, Venmo's parent, over a complaint that covered misleading claims about fund availability and how Venmo's privacy settings worked.[2][6] The FTC alleged that Venmo "failed to disclose that these funds could be frozen or removed based on the results of Venmo's review of the underlying transaction," and that by default some information about transactions between users is displayed on Venmo's "social news feed."[2] The complaint also alleged that Venmo misrepresented its security, claiming it used "bank-grade security systems" while Venmo had no written information security program through at least August 2014, and failed to notify users when a password or email address changed, or when a new device was added to their account, until at least March 2015.[2] The complaint alleged violations of the Gramm-Leach-Bliley Act's Safeguards Rule and Privacy Rule.[2] Acting FTC Chairman Maureen K. Ohlhausen said on the same day that "consumers suffered real harm when Venmo did not live up to the promises it made to users about the availability of their money."[2][6]

The settlement was injunctive, not monetary. As TechCrunch put it: "The consent order released today does not have a fine attached to it, as the FTC doesn't have the authority to obtain civil penalties for initial violations of the FTC Act or under Gramm-Leach-Bliley Act." Each subsequent violation could carry a penalty of up to $41,484.[6] PayPal's statement ran longer than one line: "We are pleased to conclude this process with the FTC in a cooperative way. This brings to an end the investigation that included focus on Venmo platform issues and practices prior to acquisition by PayPal."[6] Venmo was given 150 days to come into compliance, and had to get third-party assessments of its compliance with the Privacy Rule and Safeguards Rule "every other year, for the next 10 years."[6]

The settlement closed in 2018 and the public-by-default transaction feed kept running. The order requires those assessments every other year for 10 years, so they are still running. The 2018 settlement named the problem. It did not install the fix.[2]

What Venmo's Current Privacy Policy Actually Says

Venmo's privacy policy, published on the company's own site and active in 2026, lists ten categories of data collection under the heading "THE INFORMATION WE COLLECT": "Account Information," "Identification Information," "Device Information," "Geolocation Information," "Social Web Information," "Financial Information," "Biometric Information," "Audio, electronic, visual or similar information," "Professional or employment information," and "Information you provide when you contact us." The same section notes that Venmo "may also collect the above data from other third parties, including service providers, internet service providers, partners and merchants, credit reporting agencies, government entities, data brokers, data analytics providers, advertising networks, payment networks and financial institutions."[1]

On sharing for the company's own marketing, the policy is direct: "Venmo does not disclose your personal information with third parties for their promotional or marketing purposes."[1] The sharing it does describe starts with PayPal itself: "Our parent company, PayPal, Inc. and affiliates and subsidiaries it controls." Then law enforcement: "Law enforcement, government officials, or other third parties if PayPal is compelled to do so by a subpoena, court order or similar legal procedure." Then service providers, merchants and partners, financial institutions and payment networks, the other Venmo user in a transaction, and "the public, through the Venmo feed on our website and mobile application and elsewhere on the internet."[1] That last category is the one that matters here. It is why the FTC's Gramm-Leach-Bliley Safeguards Rule and Privacy Rule were part of the 2018 complaint.[2]

On cookies and Do Not Track signals, Venmo's policy says explicitly: "We do not respond to DNT signals."[1] On geolocation, the company says it collects it, and points you at your own device: "For information about your ability to restrict the collection and use of Geolocation Information to enhance our Services, please refer to the settings available in your device."[1] On the public-by-default social graph, the policy says this in plain language: "your Venmo friends list may be seen by any logged-in Venmo user; you may adjust or turn off this setting in the privacy section in your account settings."[1] That sentence acknowledges both the leak and the toggle.

Consumer Reports investigative reporter Derek Kravitz published "Who Can See What You Do on Venmo? You'd Be Surprised" on October 17, 2024. He found that Venmo's public profiles let outsiders look through contact lists and payment histories, that at signup "your Facebook friends and phone contacts can be automatically imported as your Venmo contacts," and that new accounts still started with payment details set to public, with few users reading the fine print to pick "friends-only" or "private."[8] That reporting captured the position in 2024. Venmo changed one default in 2026. The friend list default never changed.[14]

What Anyone Can Build From It

The privacy risk is not theoretical. BuzzFeed News used the public friend list to find the President of the United States in May 2021.[4] In 2024, Wired found Vice President JD Vance's Venmo account and all of his public contacts.[14] Wired Opinion writer Dan Salmon got his start on the same public feed. His 2019 piece, "I Scraped Millions of Venmo Payments. Your Data Is at Risk," opens with a personal note: "I was a grad student studying information security at the time, and I thought I might make some extra cash." He wrote a 20-line Python script and pulled 115,000 transactions a day out of Venmo's public API.[11] He published the dataset on GitHub.[9] A USC Viterbi team then measured the corpus at scale.[10] The point is not that the researchers were malicious. The point is that the dataset is open by default to anyone who runs a script.

For an individual user, the harm chain runs in two directions. Outbound: scammers, stalkers, divorcing spouses, spies, and journalists can pull a target's transaction history and friend list without the user logging in and without the account owner knowing.[8][9][11] Inbound: if you have ever transacted with the target, you are in their friend graph, and your name and your photo appear there as a result. The 2019 scrape was not a one-off trick. After the first wave of scraping in 2018, a computer science student named Dan Salmon pulled seven million transactions out of Venmo's API over about six months, at 40 transactions a minute, and showed that nothing had really changed.[9]

How Law Enforcement Uses It

Venmo's privacy policy names law enforcement as one of the categories of recipient it shares data with: "Law enforcement, government officials, or other third parties if PayPal is compelled to do so by a subpoena, court order or similar legal procedure."[1] But a subpoena is the slow way to get a payment history. The public-by-default feed hands over the same data to anyone who knows a username, with no notice to you and nothing to unlock.[9][11] If you have ever typed a note about a debt, a divorce settlement, a tips arrangement, or a transaction a court might care about later, that note was visible to anyone who knew your username, including any opposing counsel who did a single lookup.

The civil-discovery angle is the more common one for readers. Consumer Reports listed who stands to gain from all of this: "scammers, stalkers, divorcing spouses, spies, journalists."[8] In a lawsuit or a divorce filing, the public history gives the requesting party a head start, because the public feed is the same data a subpoena would return after the legal-process clock ran out.

What to Do Right Now

  1. Set every future payment to private. In Venmo, go to the Me tab, tap the Settings gear, tap Privacy, and choose Private. Venmo's help center documents the path: go to the Me tab, tap the Settings gear at the top right, tap Privacy, then "Choose between Public, Friends, or Private."[12] New accounts created after Venmo's 2026 update start on friends-only, but older accounts keep whatever setting they already had, and friends-only is not private.[14] This is the single toggle that closes the leak the FTC cited in 2018 and that EFF and Mozilla asked Venmo to fix in 2019.[2][3]
  2. Retroactively privatize the past. Venmo lets you change the privacy setting of past payments individually. Open a past payment, tap its privacy setting, and make it more private. One rule to know: you can only make past payments more private than they were initially. If you want to hide all of them at once, the option sits in the Privacy menu under Settings.[12]
  3. Hide the friend list. In Me, Settings, Privacy, Friends List, change the setting from public to private. EFF called the friends-list setting the "bare minimum" in 2021 and argued that Venmo "must do next is make privacy the default for transactions and friends lists, not just an option buried in the settings."[5][7] Venmo still leaves the friend list public for new accounts, and the toggle is buried.[14]
  4. Stop syncing your contacts. Venmo's help center says it "has not automatically added your device contacts as friends since 2022," and that you have to add friends manually even if your contacts are synced.[7] Revoke the contact permission anyway. The people already in your friend list from before 2022 are still in it, and anyone who has paid you can still be searched to find you.[14]
  5. Close your account before you stop using it. Deleting the app from your phone does not close your Venmo account. The account keeps running on Venmo's servers until you close it yourself.
  6. Keep the note private, even on a private payment. Venmo's help center is blunt about who sees what: "All payment participants can always see the amount, note, names of sender/recipient, and timestamp of the payment."[13] A private payment keeps the note out of the feed, but the other side of the payment always sees it. If a note could hurt you, do not type it.
  7. For sensitive transactions, use a different rail. Zelle, ACH transfers, and bank-to-bank wires do not post a public social feed. If your concern is what an ex-partner, an employer, or an opposing attorney can see, do not use Venmo for it.

None of these steps change the policy Venmo files with the FTC under the 2018 settlement. The compliance clock keeps running. Your account settings are the part of this you actually control.[2]

Sources

  1. PayPal / Venmo, Venmo Privacy Policy (current at time of writing)
  2. U.S. Federal Trade Commission, PayPal Settles FTC Charges that Venmo Failed to Disclose Information to Consumers About the Ability to Transfer Funds and Privacy Settings (February 27, 2018)
  3. Electronic Frontier Foundation and Mozilla Foundation, EFF and Mozilla Release Public Letter to Venmo (August 28, 2019)
  4. Ryan Mac and Katie Notopoulos, BuzzFeed News, Venmo Will Now Let You Hide Your Friend List Because We Found Biden's Account (May 28, 2021, updated June 1, 2021)
  5. Gennie Gebhart, Electronic Frontier Foundation, VICTORY: You Can Now Make Your Venmo Friends List Private. Here's How (June 7, 2021)
  6. Sarah Perez, TechCrunch, The FTC settles with Venmo over a series of privacy and security violations (February 27, 2018)
  7. PayPal / Venmo, Adding & Removing Friends, help center article
  8. Derek Kravitz, Consumer Reports, Who Can See What You Do on Venmo? You'd Be Surprised (October 17, 2024)
  9. Zack Whittaker, TechCrunch, Millions of Venmo transactions scraped in warning over privacy settings (June 16, 2019)
  10. Marc Ballon, USC Viterbi School of Engineering, I Know What You Did on Venmo (April 20, 2022)
  11. Dan Salmon, WIRED Opinion, I Scraped Millions of Venmo Payments. Your Data Is at Risk (June 26, 2019)
  12. PayPal / Venmo, Changing Payment Privacy & Hiding Past Payments, help center article
  13. PayPal / Venmo, Manage your Venmo privacy settings, help center article
  14. Katie Notopoulos, Business Insider, Venmo's privacy settings are a dumpster fire (May 12, 2026)

Published: October 21, 2026