{"id":3200,"date":"2025-05-15T11:19:24","date_gmt":"2025-05-15T11:19:24","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=3200"},"modified":"2025-05-15T11:19:24","modified_gmt":"2025-05-15T11:19:24","slug":"data-on-sale-trump-administration-withdraws-data-broker-oversight-proposal","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=3200","title":{"rendered":"Data on sale: Trump administration withdraws data broker oversight proposal"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

The US Consumer Financial Protection Bureau has withdrawn a proposed rule that would have restricted data brokers from selling US citizens\u2019 personal and financial information.\u00a0\u00a0<\/p>\n

The decision, announced Wednesday in the Federal Register, marks a significant reversal in consumer privacy protection efforts and raises serious concerns about the security of sensitive personal data.\u00a0<\/p>\n

\u201cWith the CFPB stepping back from regulating data brokers, American consumers face intensified risks of identity theft, behavioural profiling, and discriminatory targeting,\u201d said Sanchit Gogia, chief analyst and CEO at Greyhound Research. \u201cThis regulatory withdrawal significantly undermines public trust in the digital economy.\u201d\u00a0<\/p>\n

The withdrawn proposal, titled \u201cProtecting Americans from Harmful Data Broker Practices,\u201d would have implemented certain provisions of the Fair Credit Reporting Act regarding when consumer reporting agencies may furnish consumer reports and when users may obtain them.\u00a0<\/p>\n

\u201cThe Bureau is withdrawing this NPRM in light of updates to Bureau policies,\u201d the CFPB stated in its official notice<\/a>. The agency cited that the proposal \u201cdid so in a manner not aligned with the Bureau\u2019s current interpretation of the FCRA\u201d and its \u201cchanged policy objectives.\u201d\u00a0<\/p>\n

Concerns over legal authority<\/strong>\u00a0<\/h2>\n

The CFPB cited concerns raised during the comment period as a factor in its decision. \u201cAt least one commenter raised concerns related to the proposed rule\u2019s propriety under the plain text of the FCRA, and there were similar questions as to the Bureau\u2019s statutory authority,\u201d the notice stated.\u00a0<\/p>\n

The agency concluded it would be \u201cinappropriate to proceed to a final rule\u201d based on these concerns.\u00a0<\/p>\n

Originally published<\/a> in the Federal Register on December 13, 2024, the rule sought to address what former CFPB Director Rohit Chopra had described as a \u201cstaggering\u201d problem of data brokers selling Americans\u2019 private information without proper oversight.\u00a0\u00a0<\/p>\n

\u201cData brokers \u2013 the outfits that collect and sell detailed information about our personal and financial lives \u2013 are making this data available to anyone willing to pay,\u201d Chopra wrote<\/a> in a blog in 2024, informing about the proposed rule.\u00a0<\/p>\n

Data brokers are companies that collect and sell vast amounts of personal and financial information.\u00a0\u00a0<\/p>\n

\u201cThe vulnerabilities include targeted scams, discrimination, and exploitation by obtaining sensitive information for specific demographics,\u201d explained Neil Shah, VP for research and partner at Counterpoint Research. \u201cData brokers can collect data without any transparency, control, or consent.\u201d\u00a0<\/p>\n

The proposed regulation would have closed a loophole in the Fair Credit Reporting Act<\/a> by treating data brokers like other consumer reporting agencies, requiring them to comply with the same privacy rules.\u00a0<\/p>\n

The withdrawal comes amid broader changes at the CFPB under the Trump administration. The agency has moved to withdraw scores of guidance documents issued since 2011 and has scrapped other consumer protection proposals.\u00a0<\/p>\n

However, the CFPB has left the possibility of future action open, stating: \u201cWhen and if the Bureau determines it necessary to issue a rule implementing the relevant definitions and provisions of the FCRA, it will propose a new rule and seek public comment thereon.\u201d\u00a0<\/p>\n

Privacy concerns escalate<\/strong>\u00a0<\/h2>\n

Without these protections, data brokers can continue collecting and selling Americans\u2019 sensitive personal information<\/a> with minimal oversight. This data often includes Social Security numbers, financial records, location histories, and purchase patterns, leaving consumers vulnerable to identity theft and fraud.\u00a0<\/p>\n

\u201cDemographic groups already underserved by mainstream financial services\u2014low-income earners, elderly individuals, and racial minorities\u2014are now most exposed to data misuse,\u201d Gogia said. \u201cThe most vulnerable demographics could be minorities, seniors, children, or families of military,\u201d Shah added.\u00a0<\/p>\n

Security breaches at data broker companies have already demonstrated these risks. In the past year alone, major data breaches exposed millions of Social Security numbers and location data tracking people\u2019s movements.\u00a0<\/p>\n

Privacy advocates argue that the collection and sale of personal data without explicit consent violates fundamental privacy rights. The absence of federal regulations means consumers often have no way to know who has their data or how it\u2019s being used.\u00a0<\/p>\n

Impact on businesses and consumers<\/strong>\u00a0<\/h2>\n

The data broker industry, valued at billions of dollars, has faced increasing scrutiny. The Federal Trade Commission has taken action against several data brokers in 2024, banning some from collecting and sharing data without permission.\u00a0<\/p>\n

With the federal rule withdrawn, attention shifts to state-level regulations, creating new challenges for businesses. \u201cWithout a national standard, the compliance landscape is fractured, exposing enterprises to both reputational and legal harm across state lines,\u201d Gogia explained.\u00a0<\/p>\n

Shah echoed these concerns: \u201cThe lack of strong federal regulation will increase the burden of protecting sensitive information for enterprises. This will increase compliance costs, especially for companies operating across different states.\u201d\u00a0<\/p>\n

Several states have already developed their own frameworks for data privacy protection. \u201cSome states with more solid privacy laws<\/a>, such as California, Colorado, and Utah, will remain somewhat protected,\u201d Shah noted. However, he added that \u201cconsumers need to be cognizant of those laws and their rights.\u201d\u00a0<\/p>\n

For consumers, the withdrawal shifts the burden of protection to individuals. \u201cUntil the CFPB revisits data broker regulation, consumers remain the last line of defence against identity exploitation,\u201d said Gogia. \u201cDigital literacy is no longer optional\u2014it\u2019s survival infrastructure in today\u2019s data economy.\u201d\u00a0<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

The US Consumer Financial Protection Bureau has withdrawn a proposed rule that would have restricted data brokers from selling US citizens\u2019 personal and financial information.\u00a0\u00a0 The decision, announced Wednesday in the Federal Register, marks a significant reversal in consumer privacy protection efforts and raises serious concerns about the security of sensitive personal data.\u00a0 \u201cWith the […]<\/p>\n","protected":false},"author":0,"featured_media":3188,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-3200","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/3200"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3200"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/3200\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/3188"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3200"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3200"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3200"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}