CFPB Withdrawal of Data Broker Rule Signals Regulatory Shift on Consumer Privacy

According to an article by Wired, the Consumer Financial Protection Bureau (CFPB) has withdrawn a proposed data broker rule aimed at curbing the ability to sell sensitive personal information, including financial and government identifiers.

The CFPB’s proposed rule, originally introduced under former director Rohit Chopra, was designed to address growing concerns about commercial surveillance and national security.

Data brokers are part of a multibillion-dollar industry that compiles and sells detailed personal profiles, often without individuals’ knowledge or consent. They can include Social Security numbers, location histories, and affiliations with political or religious groups.

The agency’s abrupt reversal drew criticism from privacy advocates and civil rights groups, who argue that it prioritizes industry interests over consumer protections. Acting Director Russell Vought, who also serves as Director of the White House Office of Management and Budget, said the proposal was scrapped due to updates in Bureau policies.

The proposed rule was designed to expand oversight by requiring consumer consent before sensitive data could be sold or shared. Some protections still exist under the Fair Credit Reporting Act, but that Act is currently being revised according to Vought. 

Critics, including nonprofit and veteran groups, contend this reversal endangers national security and individual privacy. They point to recent incidents, including breaches and alleged misuse of military data, to highlight the risks.

The Financial Technology Association, a trade organization representing the interests of fintech companies and their executives, had opposed the rule, claiming it would hinder efforts to prevent fraud. Meanwhile, mass layoffs at the CFPB and pressure from high-profile political figures suggest broader shifts in regulatory philosophy.

Lawyers representing clients in the fintech, defense, and consumer data markets should closely monitor the evolving interpretation of the FCRA and its application to data brokers. Shifts in federal enforcement will impact litigation, compliance, and advisory strategies.