CFPB Plans to Kill Data Broker Limits, Big Tech Exam Changes (1)

The Consumer Financial Protection Bureau plans to rescind a number of Biden-era proposals in its latest regulatory retreat, including one that would’ve subjected data brokers to the same rules as consumer credit reporting companies.

The proposed data broker rule, issued in December, was intended to limit the ability of brokers to sell Americans’ personal and financial records for advertising and other purposes. But it doesn’t align with the Trump administration’s interpretation of the Fair Credit Reporting Act, a 1970 law governing consumer credit reports, according to a notice posted in the Federal Register’s public inspection file Wednesday.

The plan to rescind the data broker rule is set to be formally published Thursday—just one in a series of moves by acting CFPB Director Russell Vought to drop proposed rules and guidance documents put forward by his predecessor, Rohit Chopra.

Also listed in the Federal Register public inspection file Wednesday were documents to rescind a CFPB interpretive rule broadening the scope of consumer financial protection laws state attorneys general can enforce and a proposal to revoke a plan barring banks and other financial companies from using certain boilerplate language in consumer finance contracts.

The CFPB on Wednesday also moved to pull back the agency’s ability to publicly name nonbank companies that object to being placed under agency supervision over concerns they pose a threat to consumers.

Vought’s CFPB is also turning to the courts to undo the Biden administration’s agenda.

A Texas federal judge nullified the CFPB’s $8 credit card late fee cap last month and the agency has asked another court in Texas to vacate its ban on medical debt appearing on credit reports. The CFPB is also expected to ask a federal judge in Kentucky to vacate a rule that would allow customers to freely share their bank account and credit card information with third-party fintechs.

Many of Vought’s moves highlight the CFPB’s stated goal of focusing its enforcement and supervision efforts on big banks and away from nonbank companies, including fintechs, said Jesse Silverman, counsel at Troutman Pepper Locke LLP and a former CFPB enforcement attorney.

But the CFPB under Vought has also repeatedly tried to fire around 90% of the agency’s staff, including most of its enforcement attorneys and supervisors. Rescinding rules and guidance is just a piece of the Trump administration’s efforts to eliminate the consumer finance watchdog, said Christine Chen Zinner, senior policy counsel at Americans for Financial Reform.

“It does feel like they’re trying to burn down the building and taking off any and all regulatory oversight,” she said.

Broker Restrictions

The CFPB’s proposal was intended to shield all Americans from surveillance, doxing, fraud, and threats of violence when bad actors purchase personal and financial information from data brokers. The CFPB said at the time that the protections under the FCRA—including accuracy standards and limits on selling personal information—were especially important for service members and their families, law enforcement officials, domestic violence victims, and senior citizens.

But the industry chafed at the proposal, including a provision to classify “credit header” data such as names, addresses, and Social Security numbers as consumer credit reports subject to enhanced protections. Data brokers, credit reporting companies, and other data providers said the restrictions would hinder law enforcement efforts and anti-fraud protections without significant changes.

“We appreciate CFPB Acting Director Russell Vought’s leadership in recognizing the concerns we flagged in our public comment letter, including the fact that the proposed rule did not align with the plain text of the Fair Credit Reporting Act (FCRA), or the Bureau’s statutory rulemaking authority,” said Dan Smith, the president and CEO of the Consumer Data Industry Association, which represents consumer credit reporting companies.

Consumer groups who supported the proposal said those fears were overblown.

“Dropping these proposed limits will leave consumers unprotected and make it more likely that sensitive information like their Social Security numbers will wind up in the hands of crooks,” Matt Schwartz, a policy analyst at Consumer Reports, said in a statement.

Google Fight

In 2022, the CFPB under Chopra said it would use a “dormant authority” from the 2010 Dodd-Frank Act to designate companies the agency deemed a threat to consumers for direct supervision. The supervision orders would remain confidential if the company didn’t object or fail to respond, the agency said.

The CFPB published a November 2023 order designating installment lender World Acceptance Corp. after the company objected. And Google Payment Corp. sued the CFPB in December after the agency designated the Alphabet Inc. unit., which no longer operates in the US, for enhanced supervision.

The CFPB rescinded the Google supervision order on May 7 and the company subsequently dropped the lawsuit.

The CFPB on Wednesday proposed rescinding Chopra’s procedural amendments for making supervision orders public.

“Symbolically, this reinforces the current leadership’s intent to emphasize transparency and procedural safeguards,” said Jonathan Pompan, the chair of Venable LLLP’s consumer financial services practice group.

With Vought’s CFPB pulling back broadly on enforcement and supervision, slashing staff, and facing squeezed budgets, it’s unlikely the agency was planning to use the powers to designate additional companies for supervision, said Todd Baker, a senior fellow at Columbia University’s Richard Paul Richman Center for Business, Law, and Public Policy.

“This is a bone to throw to Big Tech and Fintech who thought they were being ‘named and shamed’ by the agency,” he said.

Digital Payments

Another CFPB proposal targeted in the flurry of rescissions would apply dispute resolution and other requirements of the Electronic Fund Transfer Act to emerging digital payments. That could include stablecoins and other parts of the crypto ecosystem, the CFPB said when it released the proposal in January.

PayPal Holdings Inc., Stripe Inc., and Visa Inc. are among the companies looking to broaden their stablecoin offerings, potentially expanding consumer use of the digital currencies typically pegged to the dollar.

Congress is currently considering stablecoin legislation, with consumer protections among the sticking points for a handful of Democratic holdouts in the Senate.