Photo of Matthew White

Matt White guides clients through regulatory compliance challenges and represents clients in regulatory and civil investigations and litigation.

Matt has counseled fintech and payment companies on regulatory compliance matters, including those involving the Electronic Fund Transfer Act, the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, the Truth in Lending Act, and their respective implementing regulations (Regulations E, V, P, and Z). Adept with the Consumer Financial Protection Bureau’s (CFPB) Prepaid Rule, Matt has provided guidance regarding prepaid cards and related compliance.

Matt has also aided clients in developing regulatory compliant products and functionalities, including an earned wage access program, reimbursement prepaid card programs, new merchant cash advance products, and tokenized payment capabilities. In connection with products on which Matt advises, he has also negotiated high-stakes technology sales agreements involving complex regulatory issues, including compliance with data privacy laws, financial regulations, and card network rules.

Beyond helping clients strategize for regulatory complexity, Matt also helps clients navigate government investigations and enforcement actions brought by the Federal Trade Commission (FTC), CFPB, and state attorneys general.

On April 29, 2025, Michigan Attorney General Dana Nessel filed a lawsuit against Roku, Inc., alleging that the company collects and monetizes personal data from children without proper consent. The lawsuit claims that Roku’s practices violate the Children’s Online Privacy Protection Act (COPPA) and other privacy laws.

Michigan Attorney General’s Allegations

In its complaint

On April 29, 2025, Michigan Attorney General Dana Nessel filed a lawsuit against Roku, Inc., alleging that the company collects and monetizes personal data from children without proper consent. The lawsuit claims that Roku’s practices violate the Children’s Online Privacy Protection Act (COPPA) and other privacy laws.
Continue Reading Michigan Attorney General Takes Action Against Roku, Alleging COPPA Violations

On April 16, 2025, eight state regulators announced the formation of a collaborative privacy enforcement and information sharing consortium. This coalition signals a more unified and robust approach to privacy enforcement.
Continue Reading State Attorneys General Form Bipartisan Privacy Enforcement Consortium

On March 27, 2025, the Federal Trade Commission (FTC) filed a lawsuit and proposed settlement order resolving claims against Cleo AI, a fintech that operates a personal finance mobile banking application through which it offers consumers instant or same-day cash advances.
Continue Reading FTC Alleges Fintech Cleo AI Deceived Consumers

On Feb. 11, 2025, President Trump nominated Jonathan McKernan to be the next director of the Consumer Financial Protection Bureau (CFPB). If confirmed by the Senate, McKernan would replace Russell Vought, who President Trump designated as acting director of the CFPB on Feb. 7, 2025, a day after Vought was confirmed as the director of

On Nov. 6, 2024, the Federal Trade Commission (FTC) released an administrative complaint and accepted a proposed consent order resolving claims against GGL Projects, Inc., an AI-enabled customer review platform that does business as Sitejabber. The FTC alleges that Sitejabber provides its ecommerce clients with the ability to (a) collect ratings and reviews from consumers

On Nov. 6, 2024, the Federal Trade Commission (FTC) released an administrative complaint and accepted a proposed consent order resolving claims against GGL Projects, Inc., an AI-enabled customer review platform that does business as Sitejabber. The FTC alleges that Sitejabber provides its ecommerce clients with the ability to (a) collect ratings and reviews from consumers

On Nov. 18, 2024, the Federal Deposit Insurance Corporation (FDIC) announced a 45-day extension to the public comment period for its proposed rule making (Proposed Rule) that would establish new recordkeeping requirements and related compliance obligations for insured depository institutions that offer certain “custodial deposit accounts with transactional features.”

As we detailed in a prior