Metered pulls make frequency a consent question

JPMorgan Chase now charges data aggregators like Plaid for the requests its systems answer. The fee applies to each call rather than a monthly total, a JPMorgan managing director told a panel in December. The Consumer Financial Protection Bureau’s rewrite of the Section 1033 open banking rule went to the White House for review in August, and it is expected to let banks charge for access the 2024 version made free.

The fight is being argued as a question of who pays. The Financial Technology Association says the costs “will be passed directly on to American consumers and small businesses,” and that data access is a legal entitlement, “not a conditional right contingent upon paying access fees.” That’s a serious argument about competition. This post doesn’t argue the price.

It argues about the screen, because a price changes what the screen is for.

Both sides agree the product sets the volume

Listen to what each side says about volume and they land in the same place. On that December panel, JPMorgan’s Kate Prochaska said: “Once people actually have to pay for things, they start thinking about, ‘Well, do I need to ping this often?‘” The association’s Angelena Bradfield answered that how much data an app pulls is a function of the user’s experience. People check their apps, and the app checks the bank.

PNC put the bank case more bluntly in its comment letter to the bureau, as quoted by Payments Dive: “When third party access to consumer data is free and unlimited, third parties have little incentive to minimize cadence, scope, or retention of data they do not need and will not use.”

One side calls the volume waste. The other calls it the product working. Both are saying that how often an app looks at a bank account is a product decision. Neither has said where the person whose account it’s gets to see that decision.

Frequency was never on the screen

The 2024 rule came closer than anything before it. It told apps to limit collection to what is “reasonably necessary” for the product the person asked for, and it defined collection to include “the scope of covered data requested and the duration and frequency of collection.” It capped every authorization at one year before the app had to ask again.

Now look at what the same rule required the person to be shown. The authorization disclosure lists the app, the bank, the product, the categories of data and the expected duration. Frequency isn’t on the list. The one variable a bank can now put a price on is the one the strictest version of the rule never asked anyone to show.

That rule isn’t in force either. A federal court in Kentucky has blocked enforcement while the bureau reconsiders it, and the reconsideration notice asks whether banks should be able to “recover a reasonable rate” for answering requests.

The invoice decides if the screen doesn’t

Today the answer to “how often” lives on a signup screen nobody reads twice. CNBC reported an internal JPMorgan memo complaining that aggregators access data “multiple times daily, even when the customer is not actively using the app.” Plaid’s answer was that all of that activity begins with the permission a customer grants at signup, and that background calls are how people get “critical alerts for overdraft fees or suspicious activity.”

Plaid is right that those alerts matter. That’s the problem. The pull that catches an overdraft is the same kind of pull a bank now bills for, and the person who wanted the alert agreed to it with one tap that never mentioned it.

So far the meter has stayed out of sight. When Plaid and JPMorgan renewed their agreement, Plaid told clients that current contracts and customer fees remain unchanged. The cost sits in a contract between two companies, and JPMorgan says the trimming has started there: once it announced fees, Prochaska said, “people are more judicious and thoughtful about it.”

If a balance that used to refresh in the background starts refreshing only when the app opens, the overdraft warning arrives after the overdraft. Nobody chose that on a screen. It got chosen in a contract. That’s the failure state worth worrying about, and it isn’t a breach. It’s a downgrade the person never agreed to and has no way to see.

Identity already has a word for this

OpenID Connect, the identity layer under most modern login flows, treats access while you’re away as its own grant. The spec defines an offline_access scope and says the provider “MUST always obtain consent” before issuing the token that allows it. It adds that “a previously saved user consent is not always sufficient,” because access when the user isn’t present poses greater privacy risk.

At Auth0 I worked inside that model, where consent is granted scope by scope and each scope has a name. Open banking consent still bundles “while I’m using the app” and “while I’m asleep” into a single tap. Identity split those two apart years ago, and a price per pull is a good reason for open banking to do the same.

What the screen should say

The lazy version of this screen is a number. “This app may request your data up to 12 times a day” is accurate, and it’s a mechanism dressed as a disclosure. You can’t make a decision with it.

The version a person can decide on names what the looking buys them and what stops if they say no. Check my balance in the background so you can warn me before an overdraft. Or only update when I open the app. Two choices, each with its consequence, and the app lives with whichever one the person picks.

That forces the product team to do what the price is already forcing on the business side: say which pulls are the product and which are habit. A pull that can’t be explained on that screen in one plain sentence is a pull the app should stop making.

The question I’d put to any background access in a design review is simple. What does the person get from us looking while they’re not here? If the team can’t answer in a sentence the person would recognize, the access goes, not the sentence.

Whatever the bureau publishes, the meter is already running at the largest bank in the country. Where the decision about how often gets made is still open. It can be made on the consent screen, where the person sees it, or in a contract they’ll never read.