Cash App Settlement Eligibility by State — Complete 2026 Guide

The settlement class is defined at the federal level and applies uniformly across all 50 states and US territories. The two data-security incidents covered are: (1) the December 2021 breach in which a former Cash App Investing employee downloaded customer brokerage records without authorization, affecting approximately 8.2 million users; and (2) the 2023 incident in which a third party exploited recycled phone numbers to gain unauthorized access to accounts. You do not need to prove you were personally harmed by either incident — you only need to show you were a customer during the class period and that your account information was potentially exposed.

The settlement offered three types of compensation: reimbursement of documented out-of-pocket losses up to $2,500 (supported by police reports, bank statements, or similar documentation); reimbursement for up to three hours of lost time at $25 per hour; and direct reimbursement for documented unauthorized transaction losses. Note: The claim filing deadline was November 18, 2024, and payments to approximately 40,380 approved claimants began in April 2025. The claims window is now closed for the Salinas class action.

Breach notification rights. All 50 states now have data-breach notification laws, but they vary considerably in how quickly a company must notify affected residents and what personal information triggers the duty. California's breach notification statute (Civil Code § 1798.29 / § 1798.82) is among the most demanding — it requires notification without unreasonable delay and gives California residents a private right of action for up to $750 in statutory damages per incident, independent of any class action. New York's SHIELD Act (enacted 2019) similarly requires prompt notification and expanded the definition of protected private information. If you are a California or New York resident, Cash App was legally obligated to notify you of the 2021–2022 breach even if it chose not to notify users in states with narrower statutes.

Individual opt-out alternatives. A small number of residents in strong consumer-protection states may theoretically have benefited more from opting out of the class and filing individually. California's Unfair Competition Law (Business & Professions Code § 17200), Massachusetts Chapter 93A, New York General Business Law § 349, and Illinois's Consumer Fraud Act all create pathways for individual data-breach claims with heightened damages. In practice, this math only favors individual litigation if your documented losses are substantial — most claimants recovered far more as class members than they would have net of legal fees in an individual suit. The opt-out deadline has passed regardless.

State tax treatment of settlement payments. Federal tax rules and state income tax rules are addressed separately below. Most states follow the federal treatment but a handful impose their own rules on compensatory damages. See the tax section for detail.

Parallel regulatory actions. Entirely separate from the $15M class fund, Block faced massive regulatory enforcement in January 2025 from both the CFPB and a 49-state coalition. These actions do not change what class members received under the Salinas settlement, but they do provide additional relief pathways for consumers who suffered from fraud mishandling rather than the data breach itself — and those pathways are automatic, requiring no claim filing.

The tax treatment of class-action settlement payments is determined primarily by what the payment is meant to compensate. Under IRC § 104, damages received for personal physical injuries or physical sickness are excluded from gross income — but data-breach settlements rarely qualify for this exclusion because invasion of privacy and unauthorized account access are not physical injuries in the tax-law sense.

For the Salinas settlement specifically, payments fell into three buckets: out-of-pocket loss reimbursements, transaction-loss reimbursements, and lost-time payments. Reimbursements for actual out-of-pocket losses (documented expenses you already incurred, such as credit-monitoring costs or bank fees) are generally not taxable because you are simply being made whole for money you already spent. Unauthorized transaction loss reimbursements similarly restore money that was yours — generally not treated as income. Lost-time payments ($25/hour for up to 3 hours), however, are compensating for your time rather than a specific financial loss, and the IRS typically treats such payments as ordinary income.

State income tax treatment generally mirrors the federal treatment, but a handful of states — including California and New Jersey — have their own rules on the taxability of lawsuit proceeds. If you received a settlement payment and are uncertain, a tax professional can advise based on how you documented and categorized your claim. No 1099 form is automatically issued for small class-action settlements, but that does not mean the payment is necessarily tax-free.

Self-employed users with personal accounts. Many freelancers, gig workers, and sole proprietors use a personal Cash App account for both personal and work-related payments. The Salinas settlement did not exclude self-employed individuals — if you held a standard personal Cash App or Cash App Investing account, you were eligible regardless of whether you also used it for business income. The class definition covers current and former customers; occupation is not a disqualifying factor.

Cash App for Business accounts. Cash App offers a separate product — Cash App for Business — designed for merchants and registered businesses. The settlement class is defined around personal Cash App and Cash App Investing accounts. If your only Cash App presence was a merchant business account opened under a business entity rather than your personal identity, your eligibility would depend on the specific facts of your account setup and is not clearly addressed in publicly available settlement documents. If you held both a personal account and a business account, your personal account use would be the relevant basis for eligibility.

Minor account holders. Cash App's minimum age is 13 (with parental approval for users under 18). Minor users who held accounts during the class period were part of the class; in practice, a parent or legal guardian would have filed the claim on the minor's behalf.

Deceased class members. If a class member died after the class period began but before the settlement was distributed, their estate was generally eligible to file a claim. The claim form required the executor or administrator of the estate to sign on the deceased's behalf and provide supporting documentation. Settlement proceeds received by an estate are typically treated as estate income for tax purposes.