Consumer Watchdog Proposes New Regulations Targeting Data Brokers

The Consumer Financial Protection Bureau (CFPB) has unveiled a proposed rule aimed at curbing the practices of data brokers who sell sensitive personal information, often without consent, with the watchdog citing risks to consumer safety, national security, and financial stability.
Under the proposal, companies selling information such as credit history, income, or Social Security numbers would be treated as consumer reporting agencies, subjecting them to oversight that includes ensuring data accuracy, providing consumers access to their information, and protecting it from misuse. The rule comes as data brokers, who collect and sell vast amounts of consumer data, face growing scrutiny for their role in facilitating identity theft, scams, and foreign surveillance.
“By selling our most sensitive personal data without our knowledge or consent, data brokers can profit by enabling scamming, stalking, and spying,” CFPB Director Rohit Chopra said in a statement. “The CFPB’s proposed rule will curtail these practices that threaten our personal safety and undermine America’s national security.”
The CFPB’s proposal would limit the sale of personal identifiers such as names, addresses, and phone numbers unless their use aligns with specific purposes permitted under the FCRA, such as credit applications. The rule would also restrict how consumer data can be used for marketing, barring companies from leveraging personal information to target vulnerable individuals with predatory advertisements.
Additionally, it would require companies to obtain clear and explicit consent from consumers before sharing their information, preventing the use of broad or vague authorizations often buried in fine print.
The watchdog also highlighted national security risks tied to the sale of sensitive data. Foreign governments, including China and Russia, have been known to exploit data brokers to gather detailed personal information about U.S. military personnel and government employees.
The CFBP highlighted one instance in which researchers purchased data revealing the income and credit ratings of active-duty service members, which could be used for blackmail or espionage.
Public comments on the proposed rule will be accepted until March 3, 2025, well into President Donald Trump’s second term. Given Trump’s pledge for widespread deregulation, the rule’s fate is unclear.
However, it would likely take congressional approval to dissolve the CFPB.