EPIC Condemns CFPB’s Withdrawal of Proposed Rules to Rein in Data Brokers 

The Consumer Financial Protection Bureau (CFPB) is withdrawing a proposal to crack down on the data brokers that profit from buying and selling our most sensitive personal information at industrial scale. The proposed rules—“Protecting Americans from Harmful Data Broker Practices”—would have clarified that many data brokers are “consumer reporting agencies” under the Fair Credit Reporting Act (FCRA), meaning they must comply with the FCRA’s privacy and accuracy requirements. 

Data brokers impose severe harm on consumers by degrading privacy, threatening national security, enabling scams and fraud against consumers, putting public officials and survivors of domestic violence in danger, and exacerbating discrimination against immigrant populations. The FCRA establishes important obligations for consumer reporting agencies concerning data collection, sales, and retention. Clarifying that the FCRA covers a wide range of data brokers would mitigate many of the downstream consumer privacy, safety, and economic harms that the industry causes. 

For years, the CFPB has been gathering information and working with stakeholders to develop the proposed rules that are now being withdrawn. EPIC has engaged with the CFPB since the Bureau began inquiring into how data brokers’ business practices impact consumers in 2023. EPIC shared expertise and feedback on earlier stages of the CFPB’s data brokers rulemaking; backed the CFPB’s proposed ban on listing medical debt on credit reports; joined a coalition of organizations calling on the CFPB to clarify that “credit header data” like phone numbers and social security numbers are not exempt from the FCRA; and released informational materials about data brokers and the rulemaking. 

The CFPB received 660 comments from the public in response to its Notice of Proposed Rulemaking issued in December 2024, including comments from consumers directly harmed by data brokers. EPIC collaborated with the National Consumers League (NCL) and Consumer Federation of America (CFA) to file a comment urging the CFPB to finalize the proposed rules, a filing joined by eight other civil society organizations. 

“The data broker industry is out of control—data brokers threaten our privacy, national security, physical safety, and economic security every day. Regulators must step up to address these harms. The Bureau had a critical opportunity to do just that by finalizing rules that clarify that data brokers must follow the Fair Credit Reporting Act,” said Caroline Kraczon, EPIC Law Fellow, “The CFPB’s withdrawal of the proposed rules is another attack in the administration’s war against consumers on behalf of corporate interests.”