Consumer Watchdog Proposes New Regulations Targeting Data Brokers

Consumer Financial Protection Bureau Director Rohit Chopra testifies before the Senate Banking, Housing and Urban Affairs Committee on April 26, 2022, in Washington. Win McNamee/Getty Images

The Consumer Financial Protection Bureau (CFPB) has unveiled a proposed rule aimed at curbing the practices of data brokers who sell sensitive personal information, often without consent, with the watchdog citing risks to consumer safety, national security, and financial stability.

The proposed rule, announced on Dec. 3, seeks to bring data brokers under the framework of the Fair Credit Reporting Act (FCRA), requiring them to comply with strict accuracy and privacy standards in a bid to hold them accountable for how they handle and sell personal and financial data.

Under the proposal, companies selling information such as credit history, income, or Social Security numbers would be treated as consumer reporting agencies, subjecting them to oversight that includes ensuring data accuracy, providing consumers access to their information, and protecting it from misuse. The rule comes as data brokers, who collect and sell vast amounts of consumer data, face growing scrutiny for their role in facilitating identity theft, scams, and foreign surveillance.

“By selling our most sensitive personal data without our knowledge or consent, data brokers can profit by enabling scamming, stalking, and spying,” CFPB Director Rohit Chopra said in a statement. “The CFPB’s proposed rule will curtail these practices that threaten our personal safety and undermine America’s national security.”

The CFPB’s proposal would limit the sale of personal identifiers such as names, addresses, and phone numbers unless their use aligns with specific purposes permitted under the FCRA, such as credit applications. The rule would also restrict how consumer data can be used for marketing, barring companies from leveraging personal information to target vulnerable individuals with predatory advertisements.

Additionally, it would require companies to obtain clear and explicit consent from consumers before sharing their information, preventing the use of broad or vague authorizations often buried in fine print.

Critics of the data broker industry point to its role in enabling criminal exploitation. Scammers often purchase detailed financial profiles to target vulnerable groups, particularly seniors and financially distressed individuals, which can result in substantial losses.

Sensitive information sold in the marketplace has also been linked to violence and stalking, with domestic violence survivors and law enforcement personnel among those most at risk. The 2020 murder of a federal judge’s son, where the attacker used data purchased from a broker to locate the judge’s home, underscored the grave dangers of unchecked access to private information.

The watchdog also highlighted national security risks tied to the sale of sensitive data. Foreign governments, including China and Russia, have been known to exploit data brokers to gather detailed personal information about U.S. military personnel and government employees.

The CFBP highlighted one instance in which researchers purchased data revealing the income and credit ratings of active-duty service members, which could be used for blackmail or espionage.

Public comments on the proposed rule will be accepted until March 3, 2025, well into President Donald Trump’s second term. Given Trump’s pledge for widespread deregulation, the rule’s fate is unclear.

Further, the CFPB itself could be on a collision course with the Trump administration. Elon Musk, who co-leads the to-be-established Department of Government Efficiency (DOGE) that Trump has tasked with leading the effort to cut government expenditures and roll back bureaucracy, recently called for the CFPB to be abolished.

“Delete CFPB,” Musk wrote in a recent post on X. “There are too many duplicative regulatory agencies.”

However, it would likely take congressional approval to dissolve the CFPB.