CFPB’s Proposal Would Protect Americans’ Personal, Financial Data

For Immediate Release                                                                          

December 3, 2024 

CFPB’s Proposal Would Protect Americans’ Personal, Financial Data

WASHINGTON, D.C. – The Consumer Financial Protection Bureau today announced a proposed rule that would ensure that safeguards to protect consumers’ personal data available under the federal Fair Credit Reporting Act (FCRA) would also protect consumers from harmful data broker practices.  

Data brokers accumulate personal data from retailers, websites, including social media and apps, newspapers, financial service providers, as well as data technologies from cookies and other devices to collect consumers’ online data. The data may be combined with information from criminal and civil court records. They then sell the data with few safeguards on privacy, security or accuracy. This data may then end up in the hands of scammers, fraudsters, and other bad actors. 

“The widespread use and abuse of individuals’ personal information, including dissemination of inaccurate data, is real and alarming,” said Christine Hines, senior policy director at National Association of Consumer Advocates. “The CFPB has struck the right note to address the increasing profiteering on consumers’ personal information and to ensure existing safeguards against fraud and misuse are applied to all players in the market.” 

According to the proposal, a data broker who sells a person’s credit history, credit score, or other info is selling a consumer report under the federal law. A data broker that sells consumer reports generally would be a consumer reporting agency under the FCRA. Under the proposed rule, data brokers, among other things, will then have to comply with rules to maintain accuracy, safeguard against misuse, and ensure consumers can access their information.  

The CFPB says its proposal would address “critical threats” from current data broker practices, including criminal conduct of identity thieves and scammers that hurt vulnerable consumers; misuse of sensitive information belonging to individuals targeted by their profession; and national security and surveillance risks connected to personal information of military members, government employees and others.  

Public comments on the data broker proposal are due March 5, 2025.   

###