CFPB Urges States to Enact Consumer Protections
See all Insights

CFPB Urges States to Enact Consumer Protections

Brownstein Client Alert, Jan. 21, 2025

Last week, the Consumer Financial Protection Bureau (CFPB) issued a report in tandem with a new initiative aimed at pushing an increased number and widening the scope of state-level consumer finance laws. This likely comes in response to perceived changes the incoming Trump administration will make to the agency, serving as a signal from the current CFPB for states—particularly those with Democratic attorneys general—to pick up where the Biden administration CFPB is leaving off.

This once again highlights the prominence of state attorneys general in nationwide regulatory schemes, even in the uncertainty of imminent regulatory shifts at the federal level.

The agency also released a compendium of prior guidance related to state enforcement of federal laws and other means to tackle regulatory challenges in the financial services industry. For example, the CFPB recently created a nonbank registry of so-called repeat offenders. The CFPB’s goal of making the registry public was to allow law enforcement agencies to enhance their own enforcement and supervisory actions, deepening the agency’s partnerships with state and local consumer protection agencies. The CFPB also issued an interpretive rule explaining that states can enforce the CFPA and that CFPB enforcement actions do halt state actions.

The report also includes recommendations for states to make legal and regulatory changes to tackle the evolving market and the risk of rapid change. That includes proposed legislative text to address increasingly familiar concerns like deceptive pricing, abuse of personal data and banning “abusive” practices by companies to increase market share. The suggestions mimic regulatory enforcement efforts from the agency in recent years.

Here are seven specific recommendations the CFPB spelled out for states:

1. Incorporate “abusive” into state law: The first proposal suggests incorporating the word “abusive” into state laws similar to the Consumer Financial Protection Act (CFPA). “Material interference” is an example of an abusive act or practice that can include disorienting pop-ups, confusing click-throughs or “dark patterns” that digitally trick a web user into behavior like buying something or signing up for a subscription without wanting or meaning to. The abusive standard gives enforcement agencies the advantage of not requiring proof of consumer harm and can be used to address larger patterns.

2. Stronger remedies and tools for investigation and enforcement: The CFPB’s second proposal involves a “use-every-part-of-the-buffalo” approach for states that may have scarce resources by providing regulators a broader scope of enforcement power. Specifically, the report recommends: granting state attorneys general and other state regulators market-monitoring authority similar to the CFPB’s outlines in 12 U.S.C., Section 512(c) outlining the CFPB’s authority to “monitor for risks to consumers in the offering or provision of consumer financial products or services, including developments in markets for such products or services.” States can also grant enforcers at the municipal level the ability to file claims for violation of state unfair, deceptive or abusive acts and practices laws. Another recommendation included provides pre-suit investigative power to state enforcers similar to the CFPB’s authority outlined in 12 U.S.C. Section 5562 related to subpoenas, joint investigations and other legal enforcement tools. Finally, the CFPB recommends that states consider codifying authority for enforcers to seek full relief for its consumers, similar to the CFPB’s remedies listed in 12 U.S.C. Section 5565(a)(2), which includes rescission or reformation of contracts, refunds or return of property, restitution and others.

3. Eliminate requirement to prove monetary injuries: Eliminating the required proof for monetary injuries would free enforcers to go after unfair, deceptive or abusive acts when the harm is difficult to quantify or to stop them before they occur, according to the CFPB. Some states also require a proof of reliance on deceptive statements, which can hinder class actions or lawsuits targeting digital ads. The CFPB also recommended eliminating any requirement to prove ascertainable loss or reliance on a misleading claim while ensuring claims can reach noneconomic injuries like loss of time, privacy or security.

The specific language the CFPB recommended: “Burden of Proof. A public or private enforcer need not prove the following in order to establish a claim under Section [cross-reference to state UDAAP standard]: (a) Ascertainable loss to consumers or the class; (b) Reliance by consumers on a misleading or false claim; (c) Monetary harm.”

4. Exercise authority to ensure consumer protections also protect businesses: States could expand their consumer protection laws to include business-to-business transactions. Some states are already on this path. Massachusetts has an existing action for businesses harmed by unfair or deceptive acts or practices in its consumer protection statute. Illinois is considering an extension of protections for small businesses similar to the federal Truth in Lending Act. And New York recently considered rejecting case law interpreting a requirement under its General Business Law for a practice to be “consumer-oriented” to be unlawfully deceptive.

Generally, the CFPB suggested adding the following definition or similar: “The term ‘consumer’ means an individual, company, or organization, or an agent, trustee, or representative acting on behalf of an individual, company, or organization.”

5. Revitalize private enforcement: To counter the limited resources for states to enforce consumer protections, the CFPB recommends enhancing private enforcement. States could create representative or qui tam actions, modeled after California’s Private Attorney General Act, which authorizes employees to sue for civil penalties for Labor Code violations on behalf of the state. States could also add public injunctive relief remedies and empower nonprofit organizations to bring cases against companies. Proposed amendments could include incentives like attorney fee-shifting, trebled damages and returns-based compensation to consumers or the state. Enforcement oversight should be executed under the state attorney general’s office, according to the report.

6. Provide strong and enforceable consumer data and privacy rights: To address concerns about corporations collecting and monetizing consumer data and exposing them to risks like scams, states could codify data privacy protections. While several federal laws like the Gramm-Leach-Bliley Act and the Foreign Corrupt Practices Act (FCPA) regulate consumer privacy, many states grant consumers rights like access to their collective digital data, the ability to delete personal information and the right to correct inaccuracies.

Other recommended protections include limits on collections to necessary data and restrictions on the use of personal data for purposes beyond providing requested services. The CFPB also suggested prohibiting third-party data transfers or sales with very limited exceptions and outright banning of certain data uses, such as advertising to minors. Also, states should ensure consumers can exercise their rights without retaliation, establish clear consent processes and eliminate exemptions for financial institutions. The agency also recommended hiring personnel with technology backgrounds or expertise to public enforcement teams.

7. Create bright-line prohibitions of so-called “junk fees”: “Junk fees” have been a hot topic in regulatory headlines, defined as hidden or unnecessary charges that companies use to obscure the true cost of a product or service. The CFPB recommends that states adopt bright-line rules to ban hidden fees, requiring businesses to prominently disclose the total price of goods or services, including any additional fees, before consumers make a purchase. It also proposes prohibiting misleading fees, where businesses misrepresent the nature, purpose or refundability of charges, and discouraging price gouging of captive consumers, where businesses overcharge for add-ons or services that cannot be purchased from other providers.


This document is intended to provide you with general information regarding the CFPB's efforts to compel states to enact consumer protections. The contents of this document are not intended to provide specific legal advice. If you have any questions about the contents of this document or if you need legal advice as to an issue, please contact the attorneys listed or your regular Brownstein Hyatt Farber Schreck, LLP attorney. This communication may be considered advertising in some jurisdictions. The information in this article is accurate as of the publication date. Because the law in this area is changing rapidly, and insights are not automatically updated, continued accuracy cannot be guaranteed.

Recent Insights