On Dec. 3, 2024, the Consumer Financial Protection Bureau (CFPB) released a proposed rule that would treat data brokers as credit reporting agencies, subjecting them to requirements under the Fair Credit Reporting Act (FCRA). The rulemaking would also limit the sale and transfer of credit header data, which contains consumer identifiers, including names, dates of birth and addresses. Accordingly, it impacts compliance requirements and liability for a wide variety of stakeholders using public data, including financial institutions, housing providers, collectors, fintechs, credit reporting agencies, insurance companies, employers and many others.
The CFPB framed the rulemaking as a necessary action to protect national security interests and vulnerable populations from fraud and data theft. Industry stakeholders have raised significant concerns about the overbreadth of the rule, which could limit the ability to use public data in many ways that benefit consumers and the economy, and more broadly that the CFPB is attempting to circumvent Congress and rewrite law. The CFPB proposal comes just a few weeks before a change in administration and after lawmakers including Sen. Tim Scott (R-SC) and Rep. French Hill (R-AR) have called on agencies not to engage in midnight rulemaking. The rulemaking will likely be halted once President-elect Trump takes office, and its future prospects are uncertain.
SBREFA Process and Executive Order
The proposal stems from the CFPB’s Sept. 21, 2023, announcement that it would consider a rulemaking to address several consumer reporting topics, including medical debt reporting, data brokers and credit header regulation under the Fair Credit Reporting Act (FCRA). The CFPB convened a Small Business Review Panel (SBREFA) to collect advice and recommendations from small entities or their representatives as a first step in the formal rulemaking process.
Separately, the rulemaking was mentioned in President Biden’s Feb. 28 Executive Order (EO) on sensitive personal data, which recognizes the “particular risk” the data brokerage industry poses to U.S. national security through the collection of a subset of U.S. government-related data pertaining to U.S. consumers. The EO states that the CFPB is “encouraged” to address the issue and “enhance compliance” with consumer protection laws by continuing the consumer reporting rulemaking.
Consumer Report Definition
The CFPB specifically proposes that data brokers selling information about a consumer’s credit history, debt payments and credit scores are “generally” consumer reporting agencies subject to the FCRA. The proposal states that when a data broker communicates consumer information for any reason, and the receiving entity uses it for an FCRA “permissible purpose,” the communication would be a consumer report. Permissible purposes include credit applications, bank account openings and rental applications, among other activities.
Additionally, the CFPB specifically proposes inclusion of credit header data in the definition of a “consumer report.” The data often appears at the top of consumer reports, including Social Security numbers and date of birth.
The CFPB also expands the definition of “used” and “expected to be used” for information that is used or expected to be used as a factor in establishing a consumer’s eligibility for credit or insurance.
For the information to be “used,” the CFPB’s analysis considers whether any recipient of the information, not solely the immediate recipient of the communication, used the information for a specified purpose. For information that is “expected to be used,” the proposal outlines two tests to determine whether information is expected to be used for one of the specified purposes:
- The person making the communication expects or should expect that a recipient of the information (whether the direct recipient or a downstream recipient) will use it for such a purpose; or
- It is information about a consumer’s credit history, credit score, debt payments or income or financial tier.
By broadening the definition of consumer report to include “credit header data,” the CFPB may create substantial confusion as to many financial institutions’ compliance obligations. The expanded scope of the definitions could capture activities that financial institutions regularly undertake, including fraud detection and identity verification activities.
Use of Consumer Data
The CFPB’s proposal would also require data brokers and other entities under the credit reporting umbrella to obtain consumer consent to sell or transfer customer data for permissible purposes. The proposal requires those companies to provide the consumer with a way to revoke prior consent.
The proposal would limit the sale of certain data for advertising or marketing, for the most part constraining the sale of data to only those companies or persons to whom the consumer applied for credit, insurance, employment, housing or some other service or to whom the consumer otherwise authorized access.
Next Steps
Comments on the proposal are due by March 3, 2025, and the rulemaking is likely to be halted through a regulatory freeze once President-elect Trump takes office on Jan. 20, similar to the freeze issued in 2017. The CFPB, under new leadership in the Trump administration, could opt to resume the rulemaking, as there are bipartisan concerns over data brokers. The House Energy and Commerce Committee held a hearing in 2023 on the data broker industry, and committee leadership sent letters to data brokers, requesting information on the purchase, collection and selling of consumer data. A Trump-nominated CFPB director sympathetic to these concerns could push for a similar rulemaking. The CFPB will consider comments issued on the proposal, and interest groups and trade associations are expected to weigh in with a variety of concerns.
Despite the timing of the proposal, there are a multitude of impacts on various industries, including massive compliance changes and costs. As such, it is important to outline these issues for the incoming administration to provide a full picture of the impact of the proposal for when new leadership at the CFPB may determine next steps for this issue. It will also be important to continue to work with Congress to limit rushed midnight rules.
The Brownstein Financial Services and Government Relations teams are ready to assist with comments and outreach related to this rulemaking.
THIS DOCUMENT IS INTENDED TO PROVIDE YOU WITH GENERAL INFORMATION REGARDING EXPANDED TRANSPARENCY RULES FROM CFPB. THE CONTENTS OF THIS DOCUMENT ARE NOT INTENDED TO PROVIDE SPECIFIC LEGAL ADVICE. IF YOU HAVE ANY QUESTIONS ABOUT THE CONTENTS OF THIS DOCUMENT OR IF YOU NEED LEGAL ADVICE AS TO AN ISSUE, PLEASE CONTACT THE ATTORNEYS LISTED OR YOUR REGULAR BROWNSTEIN HYATT FARBER SCHRECK, LLP ATTORNEY. THIS COMMUNICATION MAY BE CONSIDERED ADVERTISING IN SOME JURISDICTIONS.