CFPB Proposes Rule to Restrict Use of Consumer Information by Data Brokers

The CFPB proposed a rule to classify data brokers as "consumer reporting agencies" ("CRAs") under the Fair Credit Reporting Act ("FCRA"). The proposed rule would impose stricter requirements on the use of consumer data and limit the disclosure of sensitive information. (See accompanying Fact Sheet.)

According to the CFPB, data brokers "are companies that collect, aggregate, sell, resell, license, enable the use of, or otherwise share consumers' information." Data brokers gather information about credit, criminal, employment and rental histories, along with other sensitive information.

The proposed rule, among other things, would:

• require data brokers that sell consumer data to ensure accuracy, address discrepancies and prevent misuse of consumer data. The FCRA generally forbids consumer reporting agencies from furnishing consumer reports to users who lack a "permissible purpose."
• clarify that "credit header data" (meaning certain personal identifiers such as name, address, date of birth, Social Security number and phone number) can constitute a consumer report, thereby restricting credit reporting companies from disclosing sensitive contact information without a permissible purpose.
• prohibit the use of consumer reports for marketing. The CFPB emphasized that targeted advertising does not qualify as a "legitimate business need" under the FCRA. 
• require clear consumer consent for data sharing and limit the retention and use of consumer data to the stated purpose.

Comments on the proposal are due on or before March 3, 2025.