Consumer Financial Protection Bureau Proposes Rule to Regulate Data Brokers Under Fair Credit Reporting Act

The Consumer Financial Protection Bureau (CFPB) today announced a proposed new rule that all data brokers be regulated under the 1970 Fair Credit Reporting Act (FCRA), a federal law that protects the use and privacy of credit data and requires information in consumer reports (informally known as credit reports) to be accurate. The CFPB previously foreshadowed its move in a September 2023 outline.

As proposed, the rule would significantly broaden the scope of the FCRA, which currently applies to credit reporting agencies (CRAs), such as Equifax Inc. and TransUnion, and entities that report credit data to CRAs.

According to the CFPB, it developed the proposed rule based on extensive market monitoring, which the CFPB says shows that data brokers “routinely sidestep” the FCRA by claiming they aren’t subject to its requirements while selling the kind of consumer personal and financial data that the law addresses. The proposal coincides with the FTC’s announcements of its actions to ban certain data brokers from harvesting and selling location data collected from consumers.

The CFPB’s proposal would amend Regulation V, which implements the FCRA, as follows:

Treat data brokers as CRAs;
Provide that an entity is a CRA if it assembles or evaluates information about consumers, including by collecting, gathering, or retaining; assessing, verifying, or validating; or contributing to or altering the content of such information;
Deem “header” data (identifying information like an individual’s name, address, Social Security number, and phone number) to be a consumer report;
Provide that a communication by a CRA of information about a consumer is a consumer report if the information is used for an FCRA-covered purpose — regardless of whether there is evidence that the consumer reporting agency knew or expected that the information would be used for such a purpose;
Provide that “legitimate business needs” for the consumer report does not include marketing purposes; and
Require a new consumer authorization that must be on a separate document that is signed by the subject consumer and includes the specific purpose for the report along with other disclosures.

CFPB officials emphasize that the proposed rule would address various concerns raised by law enforcement and national security officials. Less clear is the extent to which the proposal could chill broader innovation, such as fintech companies that seek to expand the way individuals and businesses can borrow and repay the money they need, including bringing financing options to traditionally underserved populations by facilitating the consideration of information from non-traditional sources to determine creditworthiness. The CFPB has expressly requested comments on the implications of its proposal for technology providers and platforms used by CRAs and others in mortgage lending and other industries.

Questions have been raised about whether the proposal is likely to be finalized. On the one hand, the incoming Trump administration has vowed to decrease regulation and expressed hostility toward certain CFPB agendas and rules. On the other hand, the regulation of data brokers has bi-partisan support in Congress.

The CFPB’s proposed rule will be open for public comment until March 3, 2025.

Disclaimer

This blog is made available by Foley & Lardner LLP (“Foley” or “the Firm”) for informational purposes only. It is not meant to convey the Firm’s legal position on behalf of any client, nor is it intended to convey specific legal advice. Any opinions expressed in this article do not necessarily reflect the views of Foley & Lardner LLP, its partners, or its clients. Accordingly, do not act upon this information without seeking counsel from a licensed attorney. This blog is not intended to create, and receipt of it does not constitute, an attorney-client relationship. Communicating with Foley through this website by email, blog post, or otherwise, does not create an attorney-client relationship for any legal matter. Therefore, any communication or material you transmit to Foley through this blog, whether by email, blog post or any other manner, will not be treated as confidential or proprietary. The information on this blog is published “AS IS” and is not guaranteed to be complete, accurate, and or up-to-date. Foley makes no representations or warranties of any kind, express or implied, as to the operation or content of the site. Foley expressly disclaims all other guarantees, warranties, conditions and representations of any kind, either express or implied, whether arising under any statute, law, commercial use or otherwise, including implied warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event shall Foley or any of its partners, officers, employees, agents or affiliates be liable, directly or indirectly, under any theory of law (contract, tort, negligence or otherwise), to you or anyone else, for any claims, losses or damages, direct, indirect special, incidental, punitive or consequential, resulting from or occasioned by the creation, use of or reliance on this site (including information and other content) or any third party websites or the information, resources or material accessed through any such websites. In some jurisdictions, the contents of this blog may be considered Attorney Advertising. If applicable, please note that prior results do not guarantee a similar outcome. Photographs are for dramatization purposes only and may include models. Likenesses do not necessarily imply current client, partnership or employee status.