Stronger Security, Weaker Privacy Protections
All the exchange apps support multifactor authentication, which supplements a password with verification via a text message, biometric information such as fingerprints or facial recognition, or an authenticator app. However, Kraken didn’t prompt users to set up multifactor authentication during onboarding in CR’s evaluation. All exchanges required complex passwords except Crypto.com, which required only a six-digit PIN, which doesn’t meet CR’s standards for password strength.
To test for security notifications, CR’s evaluators changed the password or other critical account information for all five apps. All five sent security alerts, although only Binance.US and Coinbase had SMS as an option for security notifications. (Compared with SMS alerts, email or in-app alerts can more easily be missed, particularly in the case of urgent account changes.) Crypto.com and Kraken did not provide any SMS delivery options for security notifications, and we were unable to find any security notification settings in Gemini. Also, only Binance.US and Coinbase give users the option to lock their accounts from within the app in case of any security concerns.
Like other financial service providers, crypto exchanges are subject to certain federal requirements around identity verification and anti-money-laundering controls. Crypto exchanges collect significant amounts of personal and financial data as part of account setup and the “know-your-customer” process required of money service businesses under an amendment to the Bank Secrecy Act, which applies to cryptocurrency exchanges operating in the U.S. Given the sensitivity of such information, experts say it’s critical that financial businesses practice good data privacy hygiene.
Unfortunately, CR’s review of their privacy policies revealed that none of the exchanges fully practices data minimization, a policy whereby institutions purposely limit data collection to that which is absolutely necessary to provide the promised level of service.
Also, all of the exchanges reserve the right to share data with marketing partners and affiliated companies. Only Coinbase and Kraken make clear commitments not to sell data.
These kinds of data-sharing arrangements are relatively common for financial services companies, which routinely share data with affiliates and marketing partners, says CR’s Hand. But while traditional financial institutions do so under the Gramm-Leach-Bliley Act, which requires consumer notice and opt-out rights for non-affiliated marketing sharing, crypto exchanges are not subject to the same framework. “Given the sensitivity of the behavioral and asset data they hold, the case for clear disclosure and meaningful consumer controls is especially strong here,” she says.
Ideally, exchanges would give new customers a clear overview of privacy practices during the new-account onboarding phase. However, none of the exchanges did so, and instead offered only links to lengthy privacy policies elsewhere. All the exchanges allow users to adjust how much marketing they receive via the app, but only Coinbase enables users to delete or request access to their stored data from within the app. Other exchanges either didn’t offer such options or required customers to contact customer support.
“The more data a company collects, and the more broadly it is shared, the greater the risk if something goes wrong,” says Hand. “Consumers deserve to understand those trade-offs before they sign up.”
