Data Broker Sales of Consumer Information Targeted in CFPB Plan

Data brokers would face limits on selling Americans’ personal and financial records, including information about military personnel and data that could be used for advertising, under a new federal rule.

The proposal from the Consumer Financial Protection Bureau unveiled Tuesday is intended to protect service members, law enforcement officials, domestic violence victims, and senior citizens, among others. Those groups would be shielded from surveillance, doxing, fraud, and threats of violence when bad actors purchase personal and financial information from data brokers.

Brokers would be subject to accuracy requirements imposed by the 1970 Fair Credit Reporting Act, and could sell data such as FICO scores as well as “credit header” information such as Social Security numbers, addresses, and phone numbers only for purposes allowed under the law. Those currently approved purposes include checking on loan applications and seeking to prevent fraud, the CFPB said.

Companies that sell customer data would have to get their consent to do so by using explicit disclosures, and any data covered by the rule couldn’t be used for marketing purposes, the CFPB said.

“By selling our most sensitive personal data without our knowledge or consent, data brokers can profit by enabling scamming, stalking, and spying,” said CFPB Director Rohit Chopra. “The CFPB’s proposed rule will curtail these practices that threaten our personal safety and undermine America’s national security.”

The FCRA currently applies to consumer credit reporting companies, including the three largest: Equifax Inc., Experian Plc, and TransUnion. The CFPB under Chopra has made it a priority to ensure the law also covers data brokers, but any final action on the rule will be up to President-elect Donald Trump’s pick to lead the consumer finance watchdog.

Comments for the proposal are due March 3.

Credit Headers

The CFPB laid out its ideas for limiting data brokers’ activities in an August 2023 outline.

The outline faced pushback from Republican lawmakers and companies such as LexisNexis Risk Solutions Inc., a part of RELX Group Plc that collects information including real estate transaction and ownership data, bankruptcy records, and historical addresses. Those critics argued restrictions on the sale of data could harm fraud prevention efforts.

Credit header data covered by the proposed rule can also include a consumer’s current and prior employers, mother’s maiden name, and age or date of birth.

Some opponents last year also raised concerns that law enforcement agencies would be hit with new limits on their ability to purchase data, hurting their efforts to conduct investigations and contact witnesses.

CFPB officials said on a Monday call with reporters that fraud prevention and law enforcement uses are legitimate under the FCRA and would be allowed under the proposed rule. Accuracy requirements covering data brokers would help prevent fraud, the officials said.

The rule is also aimed at protecting US national security. Adversarial nations such as China and Russia currently can purchase information about active-duty military personnel and high-ranking government officials and use it to track troop movements or go after key national security officials, the CFPB said.

Trump Threat

Elon Musk—the billionaire tech CEO picked by Trump to help lead a new government panel tasked with slashing government spending—called a November 2023 Duke University report on the sale of military personnel data “concerning” in a post last month on his social media platform X.

A week later, Musk wrote a post calling to “delete” the CFPB altogether.

The series of posts highlights how the data broker proposal is in a precarious position as Trump prepares to take office in January.

The incoming administration is expected to take a significantly lighter regulatory touch, including potentially rolling back several CFPB rules.

But CFPB officials on Monday said the latest proposal would address concerns raised by law enforcement and national security officials, as well as lawmakers from both parties, increasing the odds the rule could survive a regulatory purge.