CFPB Withdraws Data Broker Privacy Rules, Exposes Millions

The Consumer Financial Protection Bureau (CFPB), led by acting director Russell Vought, recently withdrew a proposed rule that would have required data brokers to comply with privacy protections under the Fair Credit Reporting Act (FCRA). This rule, initially proposed in December 2024 under the Biden administration, aimed to close a loophole by classifying data brokers as consumer reporting agencies, thereby mandating explicit consent before collecting and selling sensitive data like Social Security numbers and credit histories. The withdrawal, justified by the CFPB as the rule not aligning with their interpretation of the FCRA, has been widely criticized by privacy advocates who argue it leaves Americans vulnerable to unchecked commercial surveillance and data exploitation. Data brokers operate a multibillion-dollar industry that profits from amassing and selling personal information, often without individuals' knowledge or consent, with recent breaches exposing millions of Social Security numbers and sensitive location data. Critics view the move as part of a broader effort under the Trump administration and allies like Vought to roll back consumer protections and favor corporate interests, undermining national security and personal privacy. This decision has sparked concern among lawmakers and state officials who continue to challenge data brokers' practices and advocate for stronger regulations.