111 million users. $180 million in advertising revenue. Purchase history, bank accounts, AI-generated behavioural profiles — and confirmed data sales to advertising partners. What Klarna really collects, how long it's stored, and why the Swedish data protection authority had to intervene twice.
Figures that show how Klarna has transformed from a payment service into a data-driven advertising platform — and what that means for 111 million users.
Klarna's Privacy Policy v11.1.0 lists 12 categories of personal data. Entries highlighted in red are particularly sensitive or disproportionate for a payment service.
Klarna uses a multi-layered data collection system that extends far beyond the individual payment transaction — even without an active purchase at a merchant.
Officially for payment processing and fraud protection — but Klarna's growing advertising business shows that user data is increasingly being commercialised.
Klarna's privacy policy sets out staggered retention periods. Complete deletion of all data is practically impossible — statutory retention obligations ensure that relevant data remains for years.
From data breaches to GDPR fines to anti-money laundering penalties — Klarna has accumulated a remarkable collection of regulatory conflicts in just a few years.
Klarna was the most prominent example of AI use in financial customer service in 2024. The data protection implications largely went undiscussed.
The comparison reveals: Klarna occupies a unique position among the major payment services — as the only service with full creditworthiness profiling, open banking access and confirmed data sales.
Three new regulatory frameworks will put Klarna's data business under pressure — with fundamental implications for the BNPL model.
GDPR rights exist for Klarna on paper, but are often difficult to enforce in practice. These measures are genuinely effective.
Art. 15 GDPR gives you the right to a complete copy of all stored data. Submit a written, dated request by email. Klarna must respond within 30 days. Klarna provides an encrypted PDF — in one documented extreme case, however, it took 3 years and 7 months.
⏱ Medium — 1 to 4 weeksConsumer organisations explicitly recommend: do not grant open banking access to your account as a matter of principle. Once activated, Klarna reads all account movements from the past 30–90 days — rent, medical costs, supermarket spending.
✓ Easy — immediately effectiveYou have an absolute right to object to direct marketing without needing to give reasons (Art. 21(2) GDPR). Disable push notifications in app settings. Unsubscribe from newsletters via the link in Klarna emails.
✓ Easy — immediately effectiveCite personal circumstances when objecting to profiling based on "legitimate interests" (Art. 21(1) GDPR). Klarna must then assess whether its interest outweighs yours. Without a written justification, the objection has little prospect of success.
⏱ Medium — outcome uncertainThere is no delete button. Contact customer service, provide all email addresses used, settle all outstanding balances. Processing time up to 2 weeks. Important: statutory retention obligations keep data for up to 10 years regardless — the account is suspended, not truly deleted.
⚠ Difficult — incompleteStrongest protection. Apple Pay: no server capture, no profiling, no data sales. Direct bank transfer: no external credit check. Those who want to use BNPL can request instalment payment through their own bank — without cross-platform profiling.
✓ Best option