CFPB Cracks Down on Data Brokers to Protect Sensitive Information

Proposed Regulation Seeks to Limit Data Brokers From Trading Sensitive American Information

The Consumer Financial Protection Bureau (CFPB), in response to numerous high-profile data breaches affecting countless American citizens, is pushing for a regulation to curb the sale of citizens' sensitive, personal, and financial information by data brokers.

Data Brokers to Comply with the Fair Credit Reporting Act

The proposed rule targets data brokers involved in selling sensitive data such as consumers’ income, credit history, credit score, or debt payments. Under this legislation, such data brokers would be classified as consumer reporting agencies and thus, will need to conform to the Fair Credit Reporting Act (FCRA), which outlines restrictions on how agencies may acquire and utilize the information included in consumer reports.

By enforcing this rule, data brokers would be subjected to similar guidelines as credit bureaus and background check firms that currently comply with FCRA.

High-Profile Breaches Highlight Systemic Weakness

During a press brief on Monday, CFPB director Rohit Chopra made mention of the significant National Public Data breach earlier this year, which resulted in the exposure of over 200 million Social Security numbers available for purchase on the dark web. Chopra stressed the systemic vulnerabilities represented by these breaches that have facilitated the buying and selling of personal data.

He further noted the lengths to which foreign nations have gone to secure this data, indicating how data brokers have made it accessible to anyone who can pay the required price.

"By selling our most sensitive personal data without our knowledge or consent, data brokers can profit by enabling scamming, stalking, and spying,” asserted Chopra.

Enhancing Consumer Consent in Data Sharing

The new regulation plans to introduce clearer consent guidelines for data sharing, requiring data brokers to acquire explicit authorization to sell a consumer's sensitive financial or personal data.

While primarily focusing on private firms, the CFPB suggested in another press call that public agencies should retain appropriate access to this information and an invitation for comments on this provision of the proposed rule.

Although a March 3, 2025 deadline has been set for comments, there are concerns that the Trump administration might undermine its effective implementation.

Bipartisan Support for Increased Data Security

Sen. Ron Wyden (D-OR) commended the CFPB's move, labeling it a crucial step toward closing a significant loophole leveraged by "sleazy data brokers." He expressed concerns, however, about the intentions of Trump's administration and its potential impact on American consumers' rights.

A CFPB spokesperson emphasized the broad bipartisan consensus regarding the threats posed by data brokers to Americans' privacy and national security during a Monday press call. They strategically refrained from commenting on the potential actions of future administrations.