Unbridled and Underregulated: Removing FCRA and GLBA Exemptions from Privacy Laws to Hold Data Brokers Accountable

Introduction

Data brokers comprise a multi-billion-dollar industry of companies in the business of collecting, aggregating, packaging, making inferences about, and selling data, including the personal data of consumers. Data bought and sold within the data broker industry includes everything from demographic, financial, and political data to health information, data on children and teenagers, and geolocation and biometric data. The data brokers most well-known to consumers—within the broader, often invisible industry—are consumer reporting agencies that sell “credit reports” and “credit scores” on people to lenders, landlords, and other purchasers. Consumer reporting agencies (CRAs) are regulated by the 1970 Fair Credit Reporting Act (FCRA), a federal law which gives American citizens the right to access their credit reports once annually and to correct information that is inaccurate. Consumer reporting agencies also fall within the scope of the Gramm-Leach-Bliley Act (GLBA), which regulates financial institutions’ use of personal information. 

CRAs often sell much more than just credit reports. Prominent CRAs, for example, sell salary and employment information on hundreds of millions of U.S. consumers as well as health, location, and other information that goes far beyond what is traditionally included in a credit file. This raises two important yet under-discussed problems for policymakers, legislators, and consumers. First, all general state privacy laws exempt FCRA-covered data, even though the FCRA covers a much broader spectrum of personal information than consumers might expect. All general state privacy laws also contain an exemption for GLBA-covered entities or data. The protections included in the GLBA and the FCRA are different and often not as expansive as the protections and consumer rights included in general state privacy legislation. Legislators may not be aware that consumer reporting agencies engage in such widespread data brokerage—and may therefore unintentionally let these privacy-invasive and harmful activities off the hook from their state privacy law’s rules. Second, it highlights the regulatory grey area in which data brokers often operate, which incentivizes data brokers to claim or disclaim the protections and obligations of different legal frameworks to best suit their purposes. Exemptions in state laws for GLBA- or FCRA-covered data or entities can exacerbate this regulatory arbitrage. 

This paper proceeds in four parts. It examines the few regulations that govern some data broker business activities, including the GLBA and the FCRA. It then dives into the GLBA- and FCRA-based exemptions in various state privacy laws and how they allow privacy-invasive and harmful data brokerage activities to continue without adequate regulatory coverage. Next, the paper compares the consumer rights and protections included in the GLBA, the FCRA, and state privacy laws, evaluating the negative incentives created by the current legislative and regulatory structure governing data brokers. 

Lastly, it offers recommendations for state legislators, federal legislators in Congress, and federal policymakers: 

1. States with consumer privacy laws should evaluate any potential loopholes in the text and explore new legislation to close these gaps. States should remove GLBA and FCRA data-level or entity-level exemptions from consumer privacy laws so that consumers can both exercise their rights under the GLBA and FCRA without issue and receive protections against CRAs’ other data activities (like selling demographic data and non GLBA- or FCRA-covered financial data). 
2. Congress and legislatures in states without general consumer privacy laws should pass new laws without entity- or data-level GLBA or FCRA exemptions in the first place. Further, lawmakers should introduce legislation to clarify the coverage of CRAs under the FCRA—and strengthen the rules for consumers.  
3. Lastly, federal agencies such as the CFPB, Federal Trade Commission (FTC) and Department of Justice (DOJ) should use their authority to strengthen rules to protect consumers from data brokers. For example, the CFPB should resuscitate its “Protecting Americans from Harmful Data Practices” rulemaking. The Bureau’s 2024 proposal would clarify that many data brokers fulfill the definition of CRAs under the FCRA, meaning data brokers that are CRAs must comply with the FCRA. The CFPB and FTC should also bring enforcement actions against data brokers violating the law.