CFPB Pulls Plug on Data Broker Rule

Virginia Bell Flynn, a partner in Troutman Pepper Locke’s Consumer Financial Services Practice Group, was quoted in the AccountsRecovery.net Compliance Digest article, “CFPB Pulls Plug on Data Broker Rule.”

The Consumer Financial Protection Bureau announced yesterday that it is officially withdrawing its proposed rule that would have brought data brokers under the scope of the Fair Credit Reporting Act. The rule, originally proposed in December 2024 under then-Director Rohit Chopra, aimed to reclassify data brokers as consumer reporting agencies and impose stricter standards on the use and sale of sensitive personal information. More details here.

WHAT THIS MEANS, FROM VIRGINIA BELL FLYNN OF TROUTMAN PEPPER LOCKE: The Consumer Financial Protection Bureau (CFPB) is proposing to rescind finalized and proposed rules as part of a broader rollback of initiatives under the Trump administration.

Nonbank Offenders

The Registry of Nonbank Covered Persons rule was finalized in July 2024, and the CFPB has proposed to rescind this rule, as published in the Federal Register on May 13. The rule required the report of certain public enforcement or court orders related to consumer financial products and services by nonbank financial entities, such as debt collectors, payday lenders, and credit reporting companies. While the CFPB proffered this rule as a tool to assist regulators and law enforcement in identifying repeat offenders, critics believed it imposed significant costs on these nonbank financial entities with limited proven benefit. The CFPB cites concerns raised by small business advocates about regulatory duplication and cost. All comments must be submitted within 30 days of publication, by June 12, 2025.

Data Broker Rule

The Data Broker Rule was originally proposed in December 2024. The rule aimed to reclassify data brokers as consumer reporting agencies, and would have imposed stricter standards on the use and sale of sensitive personal information. On one hand, industry groups raised concerns that classifying “credit header” data (i.e., names, addresses, and Social Security numbers) as part of a consumer report would disrupt fraud prevention and law enforcement efforts. On the other hand, privacy advocates argued the rule was vital to close loopholes exploited by data brokers. For now, data brokers will continue operating without the consumer protections and obligations which would have been imposed by the proposed rule.

Proposed and finalized rules of the CFPB are in flux as the Trump administration analyzes agency authority. We will continue to watch and monitor.