Consumer complaint received 2025-09-06 00:00:00
Product: Payday loan, title loan, personal loan, or advance loan — Personal line of credit
Issue: Problem with additional add-on products or services — 
Company: SOFI TECHNOLOGIES, INC.
State: MS

Complaint narrative:
Of course. Here is a powerfully articulated case against SoFi, structured as a formal complaint for you to submit to the California Privacy Protection Agency ( CPPA ). You can copy and paste this text into the CPPA 's complaint webform.

Just fill in the bracketed information with your personal details.

Formal Complaint to the California Privacy Protection Agency ( CPPA ) Regarding : SoFi Technologies , Inc .

Complainant Name : [ Your Full Name ] Complainant Contact : [ Your Email Address and Phone Number ] Date of Incident : On or around [ Date you started the application ] To the California Privacy Protection Agency, I am filing this formal complaint against SoFi Technologies , Inc. ( " SoFi '' ), a financial institution headquartered in XXXX XXXX, California, for what I believe are significant violations of the California Consumer Privacy Act ( CCPA ), as amended by the California Privacy Rights Act ( CPRA ). 

I. Summary of Complaint On or around the date specified above, I initiated an online application for a personal loan through SoFi 's platform. During this process, I submitted highly sensitive Personal Information ( PI ). I ultimately chose not to complete or finalize the application. Immediately following this interaction, I began receiving a barrage of unsolicited marketing calls and text messages from numerous third-party lenders.

This sudden and targeted influx of third-party communications indicates that SoFi either `` sold '' or " shared '' my personal information, as defined under the CCPA/CPRA, without providing the clear, conspicuous, and timely notice required by California law. SoFi 's business practice appears to treat the loan application process itself as a mechanism for lead generation, a purpose that is not made transparent to the consumer at the point of data collection.

II. Statement of Facts I began a personal loan application on SoFis website, providing sensitive PI required for the initial stages, including my name, phone number, email address, and income information.

I did not complete the application, nor did I enter into a customer relationship with SoFi.

Within hours of submitting my initial information, I started receiving a high volume of unsolicited phone calls and SMS text messages from other lending companies regarding personal loan offers.

The timing and nature of these communications lead to the unavoidable conclusion that my PI was transferred from SoFi to these third parties.

I subsequently contacted SoFi to request the full and permanent deletion of my personal information. My request was denied, with SoFi citing vague " legal and regulatory obligations. '' III. Argument : Violations of the California Consumer Privacy Act ( CCPA/CPRA ) SoFis actions and business practices appear to violate several core tenets of California 's privacy law : Violation of the Right to Know & Inadequate Notice at Collection ( Cal. Civ. Code 1798.100 ( b ) ) : The CCPA mandates that a business provide a clear and conspicuous notice at or before the point of collection detailing the commercial purposes for which a consumers PI is collected, sold, or shared. SoFi failed this requirement. A reasonable consumer applying for a loan believes their information will be used for the purpose of underwriting and originating that specific loan. SoFi 's primary commercial purpose appears to have been the immediate monetization of my data as a marketing lead. This purpose was not disclosed in a manner that was clear, conspicuous, or understandable. Burying such a critical use-case within a hyperlinked, multi-page privacy policy does not meet the standard of adequate notice required by law for the collection of sensitive financial information.

Violation of the Right to Opt-Out of Sale/Sharing ( XXXXXXXX XXXX XXXX XXXXXXXX ) : The law requires businesses to provide a clear and conspicuous link titled " Do Not Sell or Share My Personal Information '' to allow consumers to opt out. SoFi 's process is fundamentally flawed because it shares or sells the data before the consumer has a meaningful opportunity to opt out. The system is designed to capture and transfer information almost instantaneously. This reactive model, where a consumer must later navigate privacy portals to stop the flow of data that has already been disseminated, directly contravenes the preventative intent of the CCPA. The right to opt-out is rendered meaningless if it can not be exercised before the injury ( the unwanted sale/sharing of data ) occurs.

Use of Personal Information for an Undisclosed Purpose ( XXXX. XXXX XXXX XXXX XXXX XXXX XXXX XXXX : SoFi collected my information for the disclosed purpose of evaluating a loan application. They then used this information for a secondary, undisclosed commercial purpose : selling it as a qualified lead to other financial institutions. This constitutes a direct violation of the CCPA, which prohibits a business from using PI for any purpose other than what was disclosed in the notice at collection.

IV. Requested Resolution I respectfully request that the California Privacy Protection Agency investigate SoFi 's data collection and sharing practices related to its application processes. Specifically, I request that the CPPA : Order SoFi to cease this deceptive practice of selling and sharing PI from incomplete applications without providing clear, prominent, and explicit notice at the point of collection.

Compel SoFi to provide a full accounting of which third parties my personal information was sold or shared with.

Enforce my Right to Delete, requiring SoFi to delete all PI not strictly necessary for their legally mandated retention period and to provide me with the specific legal statutes that require said retention.

Impose all appropriate fines and penalties on SoFi for willfully disregarding the privacy rights of California consumers.

My experience suggests this is not an isolated incident but a systemic part of SoFi 's business model. I thank you for your attention to this critical consumer privacy issue. 

Sincerely, XXXX XXXX

Company response to consumer: Closed with explanation