Replete with Personal Data, BNPL Apps Need Consumer Monitoring, a Report Finds

Tapping a buy now, pay later app to acquire a new couch or pair of shoes means more decisions for consumers beyond choosing how to fund the purchase. A new report from Incogni Inc., a data-monitoring service, suggests they also need to be mindful of the quantity and type of data they share with BNPL apps.

In the report, Incogni found that Afterpay, the BNPL service owned by Block Inc., collected 20 different types of user data, with Klarna and Uplift gathering 19. Types of data points that are shared with third parties by various BNPL providers include precise location, name, address, phone number, and credit scores. Some apps collect Web-browsing history, purchase history, and photos.

BNPL providers such as Afterpay disclose they collect this personal information and their reasons for doing so. A user’s location is collected to find stores that accept Afterpay in the user’s vicinity. Credit scores may be collected to determine a credit risk profile for U.S. users, it says in its privacy policy. Klarna AB, too, lists what data it collects and why and provides a way to delete a user’s data.

The reason BNPL companies collect this data is generally tied to app functionality, analytics, and fraud prevention and security, Incogni says.

The concern for consumers is that this additional data held by companies may come at the expense of controlling access to it, Incogni says. Incogni says its researchers examined eight BNPL apps and collected information about their data collection as lists in the Google Play Store.

“It is important because people should be entitled to know what they are signing up for when they use an app or a service,” says Ron Zayas, of Ironwall by Incogni, another data-privacy services company. “In most cases, it would be fair to say that when people use a BNPL app, they think they are signing up for a service that extends credit for a fee. Instead, they are signing up to have their information bartered, traded, and sold. That information can be weaponized against the consumer in terms of increased risk for scams, hacks and even physical attacks. The more information available on us, the better a scam can be targeted and the more effective it will be.”

Indeed, data breaches continue to plague consumers. In the first half of 2025, the number of publicly reported data breaches totaled 1,732, up 5% from the first six months of 2024, the Identity Theft Resource Center says.

The concern is that the more data collected, the greater the risk that data could be illegally accessed and used for criminal purposes.

“The more information available on us, the better a scam can be targeted and the more effective it will be. Think you are OK because you can see through the Nigerian Prince who has $50,000,000 to give you? Great, most people can. But when a phishing email is targeted to you and uses 40-50 pieces of information that have been bought or stolen on you, your chances of spotting a scam go down precipitously,” Zayas says.

A recent Javelin Strategy & Research report found that 71% of scam victims were manipulated into giving a scammer personal information.

Zayas says consumers can better protect themselves by providing as little information as possible and by giving false information if the consumer feels the actual data is not needed.

Though Californians have specific rights to delete data collected by companies, others in the United States can ask for that, too, because most apps allow that, Zayas says. “Do that when you are done using the app for the transaction you started.”

Zayas advocates a judicious approach to sharing data with companies a consumers does business with. Be mindful that companies may share the data that could be used by others to send offers or online ads targeting uses, he says, adding, “Also, understand that the information you provide here will likely be used by financial institutions and others who see the groups served by these apps as attractive demographics to target with expensive credit and credit-adjacent offerings.”