CFPB Withdraws Data Broker Rules That Could Have Clobbered Insights Work - Articles

Articles

03Jun

CFPB Withdraws Data Broker Rules That Could Have Clobbered Insights Work

The Consumer Financial Protection Bureau (CFPB) withdrew a regulatory proposal that could have unfairly applied restrictions in the Fair Credit Reporting Act (FCRA) to the work of many insights professionals. It would have been a misguided legal end-run around Congress to create a federal privacy law.

  • Our industry wins with the demise of proposed CFPB rules, which would have expanded FCRA to restrict most insights work.

On May 15, 2025, the CFPB announced the withdrawal of the rules (which had initially been proposed on December 13, 2024).

Clearly taking to heart points raised by our Privacy for America coalition on April 2, the CFPB agreed with commenters who had “raised concerns related to the proposed rule's propriety under the plain text of the FCRA, and there were similar questions as to the Bureau's statutory authority to issue many of the proposals.”

The CFPB rules would have completely redefined the meanings of a “consumer report” and “consumer reporting agency” in FCRA, such that a good portion of data in the insights marketplace would be restricted as a “consumer report” and many insights companies would be redefined as “consumer reporting agencies” subject to the restrictions of FCRA.

Privacy for America’s comments noted our agreement that “the use of consumer data across the economy, for purposes outside of the scope of the FCRA’s “permissible purposes,” is an area ripe for federal action to help protect consumers and encourage innovation. However, the type of comprehensive and preemptive federal standard that would achieve the right balance for consumer privacy must be passed by Congress. The CFPB should not use a circumscribed statute like the FCRA to circumvent Congress. The CFPB’s proposed use of the FCRA to regulate the use of all consumer data across the economy is inappropriate, would create more harm than good for consumers, and is wholly outside of the scope of authority the FCRA confers upon the agency.”

Privacy for America concluded its comments by noting that, “Such a drastic expansion of the FCRA—executed without authority from Congress—exceeds the CFPB’s authority to regulate, confronts a “major question” that should be left to Congress, and would harm consumers, the economy, and small businesses by hindering data services companies’ practices that provide valuable and desired offerings to the marketplace.”

About the Author

Howard Fienberg

Howard Fienberg

Based in Washington, DC, Howard is the Insights Association's lobbyist for the marketing research and data analytics industry, focusing primarily on consumer privacy and data security, the Telephone Consumer Protection Act (TCPA), tort reform, and the funding and integrity of the decennial Census and the American Community Survey (ACS). Howard has more than two decades of public policy experience. Before the Insights Association, he worked in Congress as senior legislative staffer for then-Representatives Christopher Cox (CA-48) and Cliff Stearns (FL-06). He also served more than four years with a science policy think tank, working to improve the understanding of scientific and social research and methodology among journalists and policymakers. Howard is also co-director of The Census Project, a 900+ member coalition in support of a fair and accurate Census and ACS. He has also served previously on the Board of Directors for the National Institute for Lobbying and Ethics and and the Association of Government Relations Professionals. Howard has an MA International Relations from the University of Essex in England and a BA Honors Political Studies from Trent University in Canada, and has obtained the Certified Association Executive (CAE), Professional Lobbying Certificate (PLC) and the Public Policy Certificate (PPC). When not running advocacy for the Insights Association, Howard enjoys hockey, NFL football, sci-fi and horror movies, playing with his dog, and spending time with family and friends.

Related

New York Child Data Protection Act is Taking Effect

New York Child Data Protection Act is Taking Effect

The New York Child Data Protection Act (NYCDPA), which would restrict the collection, use and sharin...

Read More >
Oregon Privacy Enforcement and Compliance Review

Oregon Privacy Enforcement and Compliance Review

The Oregon Attorney General (AG) released a report on enforcement of the state’s comprehensive priv...

Read More >
KOSA 2025 - Kids Online Safety Act - S. 1748

KOSA 2025 - Kids Online Safety Act - S. 1748

The Kids Online Safety Act (KOSA) (S.1748), which would restrict the design and operations of many f...

Read More >
Latest General Data Protection Regulation Enforcement Action: GDPR Compliance Tips for the Insights Industry

Latest General Data Protection Regulation Enforcement Action: GDPR Compliance Tips for the Insights Industry

In May 2025, the Romanian data protection authority, ANSPDCP, published a General Data Protection Re...

Read More >
Minnesota Consumer Data Privacy Act Now Law

Minnesota Consumer Data Privacy Act Now Law

A new comprehensive privacy law in Minnesota takes effect on July 31, 2025, covering for-profit comp...

Read More >
California Location Privacy Act Would Have Prohibited Location Data Sales - A.B. 1355

California Location Privacy Act Would Have Prohibited Location Data Sales - A.B. 1355

Recently defeated legislation would have set up another privacy regime in California specific to loc...

Read More >
Members only Article - Please login to view