Data Brokers Eyed by CFPB for Selling Sensitive Info for Ads, AI

Data brokers face new restrictions on selling people’s personal data to feed digital advertising and artificial intelligence under a forthcoming CFPB proposal.

The Consumer Financial Protection Bureau on Tuesday said it intends to propose a rule that would apply the Fair Credit Reporting Act to data brokers and other companies that collect, resell, aggregate, and license consumers’ personal information and financial data, often without their knowledge.

Data brokers have long been subject to scrutiny from consumer advocates and they’ve become a target of CFPB Director Rohit Chopra. The firms gather and sell information related to people’s finances, including their estimated income, net worth, and home value, research has shown. The CFPB issued a request for information on data brokers in March, stating at the time that it intended to conduct a rulemaking for the industry.

“Reports about monetization of sensitive information—everything from the financial details of members of the U.S. military to lists of specific people experiencing dementia—are particularly worrisome when data is powering ‘artificial intelligence’ and other automated decision-making about our lives,” Chopra said in a statement.

Read More: CFPB Opens Data Broker Inquiry Ahead of Potential Rule Changes

The 1970 credit reporting law and its implementing regulations require a company seeking access to a person’s credit report to have a legitimate reason for accessing it, like a job or apartment application, and mandates that consumers are told when that data is accessed. Consumers are also allowed to challenge mistakes on their credit reports, among other requirements.

The three largest consumer credit reporting companies—Equifax Inc., Experian Plc, and TransUnion—are already covered by the law. CFPB officials say their proposal, which is expected to come at some point in 2024 following a required small business review panel, will rope in companies that aren’t currently subject to the FCRA.

Sensitive Data Sales

The coming proposal would seek to ban the sale of consumer data, including so-called “credit-header data” like a person’s name, address, or Social Security number, for the purpose of targeting advertisements.

The agency is also taking aim at the use of such data to train artificial intelligence. That would include tools that make automated decisions about consumers, such as whether to advance an application, and the development of generative AI chatbots that can respond to consumer questions.

Data brokers would also be blocked from selling such data to potential stalkers or perpetrators of domestic violence, as part of the planned proposal.

CFPB officials raised concerns about how data procured from brokers can be used in scams that target specific populations, like members of the military.

The CFPB’s announcement of a forthcoming rule on data brokers came ahead of a Tuesday White House roundtable on data brokers that will include the Federal Trade Commission, the Justice Department, the White House Office of Science and Technology Policy, and the National Economic Council. The CFPB will also be taking part.

“We applaud the steps the Consumer Protection Financial Bureau is taking to stop data brokers from unlawfully collecting and selling millions of Americans’ sensitive data. The CFPB’s proposals would help protect our most vulnerable consumers from targeted fraud and scams,” White House National Economic Council Director Lael Brainard said in a statement.