CFPB Announces New Inquiry into Data Brokers

The Consumer Financial Protection Bureau announced on Wednesday it is investigating how third party data brokers conduct business and collect sensitive data, marking a new step in the federal government’s investigation into how personal digital data is used between companies. 

An independent bureau within the Federal Reserve System, the CFPB said in a new Request for Information that it wants to understand the “full scope” of how online user data is transmitted between businesses, including how this impacts individual Americans. 

“Modern data surveillance practices have allowed companies to hover over our digital lives and monetize our most sensitive data,” said CFPB Director Rohit Chopra. “Our inquiry will inform whether rules under the Fair Credit Reporting Act reflect these market realities.”

Comments on the RFI are open to the public. The CFPB is especially concerned about standard business practices in the data broker industry, including details about the specific kinds of data third party brokers collect and sell. 

Officials also want to know about individual experiences with data broker companies, particularly the experiences of users who have requested to have their information removed. All comments received from this RFI will help the CFPB better gauge the data broker industry and how to regulate it. 

Members of Congress have expressed enthusiasm for the CFPB’s new investigation, including Sen. Ron Wyden, D-Ore.

“Americans’ personal information isn’t only being harvested from our phones—water and power companies, phone and cable providers and credit bureaus are all sharing private details of our lives with shady data brokers,” Wyden said. “I’m glad the CFPB is heeding that call and launching an investigation into this unsavory industry.”

Wyden, a vocal critic of data brokers and advocate for consumers’ digital privacy, requested the CFPB do more to halt the invasive harvest and sale of sensitive personal data back in 2021. 

Data broker regulation has primarily arrived in the form of pending legislation and Congressional discussion for years, however, no extensive federal law regulating the industry has been ratified. Some companies have independently responded to lawmakers’ requests to better protect individuals’ data privacy, namely amid the initial overturning of Roe v. Wade that called into question the security of geographic data for individuals seeking reproductive health care.