On December 3, 2024, the CFPB proposed a rule to rein in data brokers that sell Americans' sensitive personal and financial information. According to the CFPB’s press release, the proposed rule would limit the sale of personal identifiers and make sure that people’s financial data is only shared for legitimate purposes.
The data broker industry gathers and sells in-depth information about Americans' personal and financial circumstances to anyone who pays for it. The CFPB's proposal aims to ensure data brokers follow federal law and tackle key risks posed by current data broker practices, including national security and surveillance risks, criminal exploitation, violence, stalking, and personal safety threats to law enforcement personnel and domestic violence survivors.
To address these risks, the proposed rule would:
Treat data brokers just like credit bureaus and background check companies. Companies that sell data about income or financial tier, credit history, credit score, or debt payments would be considered consumer reporting agencies required to comply with the FCRA, regardless of how the information is used.
Protect consumers' personal identifiers from abuse and misuse. When consumer reporting agencies collect information like names, addresses, or ages for credit reports, any subsequent sale of that information would be covered by the FCRA's protections.
Require clear consumer consent for data sharing. Under the proposed rule, companies relying on consumers’ consent to obtain or share a consumer’s credit report would need separate, explicit authorization to do so, rather than burying permissions in fine print.
The CFPB believes that these changes would significantly limit the ability of data brokers to sell sensitive contact information that could be used to target, harass, or expose individuals seeking privacy protection, including domestic violence survivors. The proposed rule would preserve existing pathways created by the FCRA for government agencies to access consumer report information for legitimate law enforcement, counterterrorism, and counterintelligence purposes.
Comments to the proposed rule must be received on or before March 3, 2025.
Read the CFPB’s press release here.
The proposed rule can be found here.