The Consumer Financial Protection Bureau proposed a rule Tuesday to rein in data brokers trafficking in consumers’ personal data and unique account identifiers.
The rule is aimed at limiting the sale of that sensitive financial information, including Social Security numbers, income data and phone numbers, the agency said in a press release Tuesday.
That information is typically collected by credit bureaus for legitimate purposes, like reviewing a mortgage application, but all too often it’s being used for illicit activity, such as defrauding consumers, tracking military personnel and perpetrating domestic violence, CFPB Director Rohit Chopra said Monday.
“The Consumer Financial Protection Bureau is proposing action to stop data brokers from enabling scammers, stalkers and spies undermining our personal safety and America's national security,” Chopra said during a press conference. “The dangers of unfettered data brokering have become painfully clear.”
The CFPB proposal is part of a broader campaign, including a Justice Department move in October to block access to Americans’ personal data by Russia, Iran and China, among other “countries of concern,” the CFPB said in a release Tuesday.
Data brokers source information from retailers and financial service providers as well as software ‘cookies’ that track consumer activities online and social media posts. They also gather data from public sources, including court and government information available online. Aside from credit reporting bureaus, some top data brokers include the companies Epsilon, Acxiom and CoreLogic, according to an October USA Today report.
Chopra previously talked about instituting rules along these lines in August 2023 during a White House roundtable discussion with officials from other federal agencies. At that time, a White House release said such rules would “ensure all data companies comply with the law and prevent brokers from selling certain data...and give consumers the right to obtain data about themselves from brokers and dispute inaccuracies.”
The director also discussed the issue more recently, in September, alongside Federal Trade Commission Chair Lina Khan and Federal Communications Commisssion Chair Jessica Rosenworcel at an Aspen Institute event.
Chopra contended the proposal has broad support, but the agency may have bigger challenges as part of an incoming Trump administration, to take office in January, that may be hostile to the CFPB’s mission. During the press conference, CFPB officials were asked by journalists about the agency’s ability to pursue and enforce its rules. The agency’s position is that this new proposal has bipartisan support.
The rule would require that companies that sell data be treated like credit reporting bureaus, subjecting them to the Fair Credit Reporting Act, a 1970 law that requires accuracy in data, consumer access to information and curbing misuse, the agency said in the release.
“Companies that sell data about income or financial tier, credit history, credit score, or debt payments would be considered consumer reporting agencies required to comply with the FCRA, regardless of how the information is used,” the agency said.
The rule would also put guardrails around the sale of that sensitive information, as dictated by the Fair Credit Reporting Act, and require more explicit consumer permission for obtaining and sharing such data.
“The CFPB’s proposed rule would ensure that the FCRA’s strong privacy protections safeguard consumers from modern day data brokers that rely on emerging technologies and newer business models to collect and sell consumer data,” the agency said in the release.
Nonetheless, the proposal has already faced resistance from some groups, including police officers worried about how it might curtail their ability to access such information for fighting and solving crimes. Tension on that front reportedly surfaced in October during a meeting between Chopra and the National Association of Police Organizations.
The agency seemed to try to address those concerns in the press release, which said: “The proposed rule would preserve existing pathways created by the FCRA for government agencies to access consumer report information for legitimate law enforcement, counterterrorism, and counterintelligence purposes.”
Some consumer advocates were quick to back the rule proposal. “This rule is a critical step toward reining in the abuses of data brokers, companies that have been selling highly sensitive data to the highest bidder without transparency or accountability for far too long,” said Ben Winters, director of artificial intelligence and privacy for the Consumer Federation of America.
Public comments on the rule are due March 3, the CFPB said.
