A picture of a sign of a Greenlight branded card at a bank.
Something is spreading through American family finance, and it is dressed to look like a classroom. The pitch is "financial literacy." The product is your child's data, your child's credit file, and ultimately your family's bank account with all this being backstopped by contract against whatever payments or debt a child who cannot legally sign a contract somehow manages to rack up. The industry doing this is not a fringe operation. It is backed by JPMorgan Chase, Wells Fargo, and Andreessen Horowitz. Its executives sat in the same room as the people who went on to run the country's financial regulatory agencies. And it has been quietly building, year by year, toward a moment that has seemingly arrived.
The major player in this is Greenlight Financial Technology, an Atlanta-based financial technology (fintech) firm that began life as a debit card for kids and has since evolved into something more aggressive. Greenlight has no minimum age requirement and currently operates more than 6 million family accounts, offering subscription tiers ranging from $5.99 to $19.98 per month per family. The company positions all of this as education. There is an "in-app financial literacy game." There are chore trackers and allowance tools. There is language about "teaching kids to earn, save, and invest." But what Greenlight is actually doing, stripped of the classroom framing, is building one of the most detailed behavioral and financial surveillance infrastructures ever constructed for children. Greenlight, according to its privacy policy, reserves the right to share children's personal information with ad and marketing vendors, insurance companies, collections agencies, and "other service providers" that seems to include nearly anybody. This seems to open up all types of sensitive information being made available to people and entities the parents have no clue about. Information such as names, birth dates, email addresses, GPS location history, purchase history, and behavioral profiles are all seemingly made available to anyone that could be considered a "service provider" or marketer. The company says it is not currently selling that data. But it acknowledged in writing, when confronted by investigators, that it inserted those permissions into its privacy policy "in case we ever decide to offer merchant-funded offers to parents in the future." The permissions are not limited to aggregated or anonymous data. They appear on their face to cover individually identifiable information about children. When you sign your child up for Greenlight, you are not signing them up for a classroom. You are signing them up for a data collection apparatus that they claim allows them to share your child's GPS coordinates, purchase patterns, and behavioral profile with insurance companies and collection agencies -- and basically nearly anyone if they label them a certain way.
The Credit CARD Act of 2009 is a law that was supposed to protect young people from the credit card industry. Before the CARD Act, credit card companies aggressively marketed on college campuses by offering freebies like T-shirts, Frisbees, and pizza in exchange for students filling out credit card applications, even when those students had no income or experience with credit. Congress banned that practice in 2009. The industry then spent the next decade figuring out how to get them even before college.
Then there is Step, which has grown to over 5 million registered users with a model built around a secured card that automatically reports two years of transactional history to all three major credit bureaus the moment a child turns 18. Step markets this as building "a financial foundation." What it is actually building is a credit dossier on a minor child. And all of that is assembled while that child is legally incapable of understanding or consenting to its creation with it following them into adulthood without any further notice to the parent who originally clicked "agree." At no point during the setup processes for either Greenlight or Step are parents fully informed about who specifically will be receiving that data and what all specifically that data will be used for. Beyond links to the companies' privacy policies in small font at the bottom of pages, parents receive nothing much after that. And if companies and "service providers" are added to the list, there usually is nothing told to the parents about that. And those policies, when parents do find them, offer little clarity since they use open-ended phrases like "other service providers" that don't provide real insight. Meanwhile, Block — the company behind Cash App — has already expanded its features for teens from peer-to-peer payments to savings and card features. And they even now allow investments in stocks and Bitcoin. They plan to extend savings and investing products to children aged 6 to 12. Can you imagine a six-year old using digital devices to conduct actual transactions? And in February 2026, the company owned by YouTube star MrBeast, acquired Step. The combining of viewing habits of millions could possibly be linked with credit profiles on them under one company. After all, MrBeast does have over 400 million YouTube subscribers with many being under 18. The "education" framing is window dressing on an industry racing to capture the most valuable untapped data pool and debt market in American consumer finance--your children.
The reason this is happening now comes down to law and the systematic removal of the people who would have stopped it. The Children's Online Privacy Protection Act (COPPA), enacted in 1998, prohibited the collection, use, or disclosure of personal information from children under 13 in an online environment without verifiable parental consent. And the credit bureaus themselves operated under a clear industry standard that they did not knowingly maintain credit files on minor children, and treating any file found in a child's name as presumptive fraud. That understanding held until 2015 and 2018 delivered two changes that blew it open. In 2015, something called the National Consumer Assistance Plan sprouted up. It's not a law passed by Congress and not a federal regulation or order from any government agency. It is something called an Assurance of Voluntary Compliance (AVC). Basicially, it's a negotiated settlement agreement between the three major credit bureaus and 31 state attorneys general who were threatening to sue them. In the agreement, the private credit bureaus paid a $6 million payment to the states that they emphasized was "not a fine, civil penalty, or forfeiture." The bureaus themselves stated publicly that they broke no law. The name "National Consumer Assistance Plan" was the credit bureaus' own branding for their own compliance program, which was a system they created and controlled and then rolled out on their own timeline over three and a half years. And the rest of the industry then treated as binding infrastructure. In plain language, the credit bureaus paid a fine without admitting guilt, got agreements from the states not to prosecute them for what was obviously found to be violations (otherwise, why would they be investigating them?). And then, they got to create their own pseudo-regulation that ended up benefiting them. In this "agreement," it required data furnishers (i.e., businesses with credit accounts, etc.) to provide a date of birth when reporting authorized users. This created the infrastructure that enabled the linking of a minor child's transactional data to a credit file by Social Security number.
Then in 2018, the Economic Growth, Regulatory Relief, and Consumer Protection Act was passed. It was sold as a child identity theft protection measure. The claim was that it instructed credit bureaus to create a credit file for a child who doesn't have one so that then a parent could request a security freeze on their behalf. But the law and standard practices already protected minor children by making any information about them as void. In other words, the law--particularly COPPA--didn't allow such a thing to exist. But regardless, the industry and the bill's supporters pushed for a supposed fix that actually involved being able to create a credit file that previously couldn't have been created. That law, signed by President Trump, normalized the existence of credit infrastructure for minors in federal statute. It threaded COPPA's needle by routing everything through a parent since it would be the parent opening the account and providing the consent. In effect, the parent is the account holder, and the child is the beneficiary. Greenlight launched its credit-building product for teens shortly after. Step launched the same year the 2018 law passed. The timing was not a coincidence. Then, beginning in 2025, the watchdog who might have scrutinized all of it was dismantled. The Trump Administration attempted to slash the Consumer Financial Protection Bureau (CFPB) to fewer than 200 employees. The staff was around 1,700 under the previous Administration. As one federal watchdog was being slashed another one was being populated by individuals from the very entities involved in pushing for kid accounts. Andreessen Horowitz has significant control over Greenlight. They led its $260 million Series D investment round and placed a partner on its board. The former Andreessen Horowitz crypto policy lead, Brian Quintenz, was nominated to chair the CFTC (although later withdrawn). And co-founder Marc Andreessen made his way onto the president's technology advisory council.
Elizabeth Warren, Assistant to the President and Special Advisor to the Secretary of the Treasury on the CFPB, delivering the keynote speech at a symposium called "The CARD Act: One Year Later", 2011.
So what are the plans behind this expansion into the lives of your children? Greenlight's CEO has called this a "customer for life" strategy. Step's founder has said plainly: "We are not a teen bank. We're a banking platform and hopefully a brand for the next generation. We fundamentally believe that your journey starts as a child or a teenager, and we just want to be there with you from the beginning...hopefully we have a customer for life." He added that the fintech plans to eventually offer lending products as an additional way to monetize the platform. MrBeast's Beast Industries has already filed for the "MrBeast Financial" trademark and received a $200 million investment from a cryptocurrency treasury company. And they have plans to incorporate decentralized finance (the kind of transactions that go through software and code instead of humans) and crypto into a financial platform aimed at teenagers. Many researchers in neuroscience have spoken out about the dangers of credit and speculation for adolescent users. This developmental stage is marked by an increased responsiveness to rewards coupled with an ongoing maturation of impulse control capabilities. And we do not need to speculate about what happens when you give a financially naive, impulse-prone population access to credit since we have the adult experiment to look at. Credit card balances have risen by $482 billion since 2021 alone. Delinquency among borrowers under 30 has nearly doubled in 5 years. Adults with fully developed brains and legal standing have been crushed by credit card debt as availability expanded. The industry wants to start the clock earlier.
The main federal law protecting the private information of children--the Children's Online Privacy Protection Act (COPPA)--was in response to the invasive actions of a children's website called KidsCom. The site pushed children from 4 to 15 to take surveys in exchange for points toward rewards like toys. It also published their personal information to others under the auspices of linking the child with penpals around the world. In many ways, the finance industry today is going farther than KidsCom ever did.
The deepest and most dangerous element of what these companies are building is what it does to the family unit financially. Parents are being set up to bear liability they don't know they've accepted. The consent mechanism is a checkbox at signup. Greenlight's credit bureau reporting consent is not in its main terms of service. It's actually buried in a separate "Credit & Identity Monitoring Services Addendum" that authorizes the company and its third-party partners to access, monitor, and share credit report data on a recurring basis. This "addendum" covers the parent and, by extension through the family account, the child. As the primary cardholder, the parent is responsible for all charges the authorized user makes. If a teenager creates a balance on the card that a parent is unaware of, the parent might miss a payment or have obligations (in other words, debt) they would have never agreed to. And the industry is now even targeting messaging through children to get the parents to allow children access. Step released a video titled "How to Talk to Your Parents About Investing in Crypto," specifically targeted at kids whose parents "want nothing to do with crypto." It basically coached children on how to convince their parents to let them make investments their parents may not want, and including specific scripts for children to use while talking to their parents. Senator Elizabeth Warren, in a March 2026 letter to Beast Industries, called this the weaponization of familial relationships to bypass regulatory safeguards intended to protect minors from high-risk speculation. What these companies are selling to parents as education is, on examination, a system designed to enroll children in financial products before they can understand them. And also collect data on those children that parents cannot control. All while potentially building up debt obligations through a parent's account that is legally backstopped against whatever the child does. And of course, building a "customer for life."
