CFPB proposes restrictions on sales of consumer information by data brokers

In one of its final regulatory efforts under the Biden administration, the Consumer Financial Protection Bureau (CFPB) proposed a new rule on Tuesday that aims to protect consumer financial data from misuse by limiting its sale by data brokers. The proposal has drawn criticism from industry trade groups concerned about its potential implications.

The U.S. consumer finance watchdog seeks to ensure that sensitive personal data is shared only for “legitimate purposes,” such as facilitating mortgage approvals, and doesn’t fall into the hands of scammers or other bad actors. To achieve this, the CFPB’s rule would classify data brokers as “consumer reporting agencies” and require them to comply with the Fair Credit Reporting Act (FCRA).

“By selling our most sensitive personal data without our knowledge or consent, data brokers can profit by enabling scamming, stalking, and spying,” CFPB Director Rohit Chopra said in a statement. “The CFPB’s proposed rule will curtail these practices that threaten our personal safety and undermine America’s national security.

The CFPB defines data brokers as companies that collect and sell information about individuals’ personal and financial lives — such as Social Security numbers and phone numbers — to those willing to pay. Under the proposed rule, brokers that sell data on income, credit scores and debt payments will be considered consumer reporting agencies and be required to comply with the FCRA. 

Additionally, companies that rely on consumer consent to access or share credit reports would need to secure “separate, explicit authorization” rather than embedding permissions in fine print.

According to the CFPB, data brokers often claim they are exempt from FCRA requirements, despite selling information that Congress intended the law to protect when it was enacted in 1970. The proposed rule, the bureau argues, would safeguard consumers against “modern-day data brokers” that exploit emerging technologies and new business models to collect and sell data.

But the proposal has faced pushback from the Consumer Data Industry Association (CDIA), which warned it could “compromise public safety and increase costs for maintaining our world-class credit reporting system” without improving accuracy, efficiency or reliability

“Our members recognize the importance of consumer privacy,” Dan Smith, CDIA president and CEO, said in a statement. “We are still reviewing the rule but have concerns. We believe the CFPB lacks the legal authority to issue the rule as proposed. This approach also is misguided and potentially harmful to public safety, law enforcement, and the consumer economy.”

The trade group also argued that the rule could increase fraud risks, hinder law enforcement efforts and negatively impact child support enforcement measures.