CFPB Withdraws Rule Limiting Data Brokers' Sale of Sensitive Consumer Data

The Consumer Financial Protection Bureau (CFPB) has withdrawn a December 2024 proposed rule that would have subjected data brokers to the same transparency and accuracy requirements as consumer credit reporting agencies under the Fair Credit Reporting Act (FCRA). The rule aimed to limit data brokers from selling sensitive personal information, such as Social Security numbers and financial data, thereby protecting consumers from fraud and misuse of their data. The withdrawal, announced by acting CFPB director Russell Vought, was justified by a shift in the Bureau's policy and a reinterpretation of the FCRA, which the agency is currently revising. Consumer advocates criticized the decision as leaving Americans vulnerable to identity theft and scams, given data brokers' extensive collection and sale of sensitive information often without consumer knowledge or consent. Industry groups welcomed the move, arguing that the proposed rule was overreaching, potentially interfering with law enforcement and antifraud activities, and exceeded the CFPB’s authority. This policy reversal marks a significant retreat from the Biden-era initiative to rein in data brokers and enhance consumer privacy protections.