CFPB Launches Inquiry Into Data Broker Practices Ahead of Planned Rulemaking Under FCRA

Cooley alert
March 31, 2023

On March 15, 2023, the Consumer Financial Protection Bureau (CFPB) launched an inquiry into the business practices of companies that “collect, aggregate, sell, resell, license, or otherwise share consumers’ personal information with other parties” – collectively called “data brokers.” Noting the significant expansion of the data broker industry since enactment of the Fair Credit Reporting Act (FCRA), the CFPB intends to assess whether – and likely how – entities using new business models and technologies to collect and sell consumer data may be covered by FCRA.

Comments on the CFPB’s request for information (RFI), due by June 13, 2023, will inform the CFPB’s “planned rulemaking” under FCRA, which was identified in the CFPB’s fall 2022 regulatory agenda

Overview of the RFI

The RFI seeks information regarding the data broker market and consumers’ experiences – both positive and negative – in light of the explosion of the market.

On the market side, the CFPB is looking for information on the sources from which data brokers collect information, the type of information collected and shared, the method of collection, whether people can avoid having their information collected, controls implemented by data brokers to ensure the quality and accuracy of data collected, and the potential harms and benefits data broker practices bring to consumers. From a consumer risk perspective, the CFPB is seeking information about data accuracy and privacy, as well as issues accessing, viewing, correcting and removing data collected by such brokers.

What to expect

The CFPB has devoted substantial attention to so-called financial surveillance companies and the potential for consumer harm stemming from their collection and dissemination of consumer information. It therefore comes as no surprise that the RFI focuses on consumer concerns over being “tracked and surveilled” by data brokers. 

The CFPB’s inquiry comes on the heels of an advance notice of proposed rulemaking by the Federal Trade Commission (FTC) seeking public comment on commercial surveillance and data security practices. We expect the CFPB and FTC to take a collaborative approach to the protection of consumer data and the scrutiny of companies that collect and share consumer information going forward.

The RFI also coincides with the CFPB’s January 2023 issuance of market monitoring orders to data aggregators in connection with its ongoing Section 1033 rulemaking pertaining to consumer access to financial records. Entities that engage in the collection and sharing of consumer data should monitor developments related to the CFPB’s Section 1033 rulemaking, which could also be informed by responses to the RFI. 

This content is provided for general informational purposes only, and your access or use of the content does not create an attorney-client relationship between you or your organization and Cooley LLP, Cooley (UK) LLP, or any other affiliated practice or entity (collectively referred to as “Cooley”). By accessing this content, you agree that the information provided does not constitute legal or other professional advice. This content is not a substitute for obtaining legal advice from a qualified attorney licensed in your jurisdiction and you should not act or refrain from acting based on this content. This content may be changed without notice. It is not guaranteed to be complete, correct or up to date, and it may not reflect the most current legal developments. Prior results do not guarantee a similar outcome. Do not send any confidential information to Cooley, as we do not have any duty to keep any information you provide to us confidential. This content may be considered Attorney Advertising and is subject to our legal notices.