A payment note named his daughter. He says he chose “Private.”

Plaintiff Remi Rundzio says he deliberately marked his Venmo payments private. For one transaction, he wrote a detailed note that included his daughter’s name, the class she took and the date it occurred.

That note was meant to explain the payment. According to the Venmo language quoted in the complaint, a private transaction would be visible in the user’s personal feed and to the other participant, nowhere else.

The lawsuit alleges a different path behind the screen. It says tracking technology embedded by PayPal transmitted transaction information and identifying data to third parties, including mParticle and Kochava. The alleged information included the recipient, amount and note, alongside details capable of tying the transaction to a person or device.

The complaint says this was not an accidental byproduct of processing a payment. It alleges that PayPal selected the tracking tools, configured the events that activated them and controlled which data fields were transmitted. Those assertions have not been tested in court.

The alleged gap between the promise and the data flow

Venmo offered three transaction visibility settings: Public, Friends and Private. The complaint argues that reasonable users would understand “Private” as a restriction on sharing, not merely a limit on what appeared in Venmo’s social feed.

What allegedly left the app

The complaint identifies nine fields that it says were disclosed or made accessible through the tracking technology. This was allegedly person-level information, not an anonymous statistical summary.

• Sender’s full name
• Email address
• Telephone number
• Android Advertising ID
• mParticle ID
• Kochava ID
• Recipient identity
• Payment amount
• Transaction note

The complaint says the transmissions happened while the payment communication was in transit to PayPal. That timing matters because the plaintiffs invoke federal and California wiretapping laws that regulate interception of electronic communications.

Why a transaction note can expose more than a purchase

Venmo payments combine financial information with free text. The complaint says the note field is mandatory when an account is private, meaning a user must enter some description to complete the payment.

A note can be harmless, but it can also identify a medical provider, legal service, recovery program, religious donation, political contribution, housing payment or intimate relationship. Those are examples offered by the plaintiffs, not evidence that every user disclosed such details.

The plaintiffs claim loss of privacy, loss of control over their data and diminished data value. They also allege anxiety and continuing risk because they do not know whether the conduct stopped or whether previously transmitted data was deleted.

The complaint does not allege that money was taken from the plaintiffs’ Venmo balances. It also does not quantify an individual out-of-pocket loss caused by the alleged transmissions. The claimed injury centers on privacy, control and the commercial value of personal data.

The companies named on the receiving end

The plaintiffs say PayPal obtained analytics about user behavior, advertising attribution, custom-audience capabilities and improved marketing performance. The complete list of recipients and downstream uses is not provided. The complaint says those details would need to be obtained through discovery.

The lawsuit also targets the path consumers must use to complain

The privacy allegations are paired with a fight over arbitration. According to the complaint, PayPal notified users in July 2026 that revised Venmo terms would take effect on August 24, 2026. The plaintiffs argue that the changes added obstacles and attempted to apply them to disputes that already existed.

• Handwritten requirements: The new terms allegedly require an original handwritten signature on a notice of dispute and a separate authorization before counsel can discuss an account with PayPal.
• A longer preliminary process: The mandatory informal period allegedly grew from 45 to 60 days, with more time possible if PayPal requests a conference.
• Staged mass arbitration: For 25 or more similar disputes handled by coordinated counsel, the complaint says only 50 selected cases can proceed at once while the rest wait.
• Earlier disputes: The plaintiffs say the new language attempts to govern disputes that arose before the revised agreement took effect, despite language in the former agreement protecting previously filed claims from later amendments.
• Fees for smaller claims: The former agreement allegedly promised that PayPal would pay all arbitration fees for claims of $10,000 or less. The new language instead says the parties may discuss reducing or deferring fees.

Existing users allegedly could not reject only the amendments. The complaint says their stated alternative was to close the Venmo account before the effective date. PayPal has not had an opportunity to present a defense in the supplied material, and the court has not ruled on whether the arbitration provisions are enforceable.

What the plaintiffs want, and what has not been decided

The complaint pleads ten claims, including alleged violations of the Electronic Communications Privacy Act, two provisions of the California Invasion of Privacy Act, California computer-access law, the California Constitution and the state’s Unfair Competition Law. It also asserts common-law privacy, unjust-enrichment and negligence theories.

The plaintiffs ask for an injunction against the alleged sharing, class certification, restitution, disgorgement and multiple forms of damages. Their requested statutory measures include the ECPA formula of actual damages and profits or the greater of $100 per day or $10,000, as well as California privacy-law damages of $5,000 per violation or three times actual damages, whichever is greater.

Those figures are requested remedies, not awards. No damages determination appears in the supplied record.

“Private” can mean two very different things

A privacy control can limit what other users see while doing nothing to restrict analytics, attribution or marketing systems behind the interface. The complaint argues that Venmo promised more than feed privacy. It says PayPal represented that a private transaction would not be shared anywhere beyond the participants, then built a technical pathway that did the opposite.

Whether that pathway existed as alleged, what each recipient obtained and whether users legally consented remain unresolved. The case turns on a basic question with consequences far beyond Venmo: when a financial app labels a payment private, does that promise govern only the screen, or the entire data system behind it?