CFPB intends to increase oversight of brokers to protect service members

The Consumer Financial Protection Bureau (CFPB) announced this week that it plans to strengthen oversight of data brokers to better protect military personnel, law enforcement officers, victims of domestic violence, seniors, and other populations from surveillance, doxxing, fraud, and threats that result in violence , when cyber threat actors acquire personal and financial information from data brokers through legitimate means. The CFPB proposed updated regulations that would subject data brokers to the accuracy requirements of the Fair Credit Reporting Act (FCRA) and restrict the sale of certain data, such as FICO scores, “credit header” information (Social Security numbers, address, and phone numbers), for purposes only , which are permitted under the FCRA – i.e., for reviewing loan applications and preventing fraud. Currently, the FCRA applies to consumer credit reporting agencies (e.g., Equifax, Experian, and TransUnion), but the CFPB wants to expand its reach to data brokers as well.

The proposed regulations would also require data brokers that sell consumer data to obtain consent through explicit disclosure to consumers. Additionally, the proposed regulations would expressly prohibit the use of collected data for marketing purposes.

In the press release, CFPB Director Rohit Chopra said: “By selling our most sensitive personal information without our knowledge or consent, data brokers can profit by enabling fraud, stalking and espionage.” The CFPB’s proposed rule will curb these practices endangering our personal safety and undermining America’s national security.”

We’ll be watching this rule closely to see how far it goes. The final decision on this rule rests with the CFPB’s new head, based on President-elect Donald Trump’s selection for the role. While the new administration is expected to ease regulatory restrictions on companies, the proposed rule has support from law enforcement, national security officials and lawmakers from both parties, which could increase the chances of this CFPB regulation surviving. Public comments close March 3, 2025.