In May 2025, the Consumer Financial Protection Bureau (CFPB) abandoned an important attempt to strengthen federal data privacy protection. The agency withdrew the CFPB data broker rule, a proposal to apply Fair Credit Reporting Act (FCRA) safeguards to more of the sensitive information sold by data brokers. These companies collect, combine and sell information about people who may never have heard of them. The decision leaves the gaps the proposal sought to address unresolved.
The May 15 withdrawal notice, signed by Acting Director Russell Vought, cited changed agency policies, a changed interpretation of the FCRA and concerns raised by commenters about statutory authority. This was a withdrawal of proposed protections, not repeal of a rule already in force. That distinction does not make the political choice harmless: Trump’s CFPB chose to stop pursuing this approach to an industry whose information can expose people to fraud, unwanted profiling and surveillance.
The stakes reach beyond advertising. A person’s financial circumstances, contact information and inferred characteristics can become a product sold far from the original interaction. This article examines what the proposal would have done, why abandoning it matters, the limits of existing protections and what consumers and policymakers can do about those gaps.
Key Takeaways
- The December 2024 proposal sought to bring more data-broker activity within consumer-reporting safeguards. It never took effect.
- Trump’s CFPB withdrew the proposal in May 2025. The decision abandoned proposed safeguards while leaving the FCRA and other existing laws intact.
- The proposal was not a blanket consent requirement for every kind of personal-data collection or sale. Coverage and the purpose of a disclosure mattered.
- Continued exposure creates risks involving fraud, national security, vulnerable communities, government access and weak individual control.
- State laws and federal restrictions address parts of the problem, but they do not create one comprehensive privacy standard.
- Opt-outs, privacy settings and monitoring offer partial relief. They cannot replace enforceable limits on collection, use and disclosure.
What Was the CFPB Data Broker Rule?
The Rule’s Origin Under the Biden Administration
In December 2024, the CFPB proposed changes to Regulation V, which implements the FCRA. Its notice of proposed rulemaking addressed when a data broker is a consumer reporting agency and when the information it sells is a consumer report. The aim was to prevent businesses from avoiding protections through the way they described their products or buyers’ intended uses.
The Fair Credit Reporting Act loophole at issue was therefore a dispute over coverage, not an exemption declaring every data broker unregulated. Credit bureaus and other covered reporting agencies already had legal obligations. The proposal sought to make those obligations harder to evade in parts of the wider information market.
The commercial setting explains why that mattered. The FTC’s 2014 study of data brokers found extensive collection from online and offline sources, sharing among brokers and inferences about sensitive characteristics. Consumers often could not see the process or exercise meaningful choices. Consumers have far less visibility into that process than the companies collecting and distributing their information.
Scope and Requirements of the Proposed Rule
The CFPB’s December fact sheet identified credit history, credit scores, debt payments and income or financial tier as information the proposal would generally treat as consumer-report information regardless of the buyer’s intended use. It also addressed identifying information collected for consumer reports, often called credit-header data, and conditions for relying on a consumer’s permission.
For covered information and activities, the protections included limits on permissible disclosure, accuracy obligations and consumers’ ability to access and dispute their files. The proposal did not establish universal permission requirements for every purchase of location, biometric or court-record data. Nor would a company’s name alone determine whether all its operations were covered.
The distinction between consent and a permissible purpose is important. The FCRA’s existing permissible-purpose provisions allow specified disclosures, including certain credit, insurance and employment uses, subject to applicable conditions. Written consumer instructions are another route. A covered report cannot simply be sold to any interested customer, but the law does not require the same form of consent for every permitted use.
For consumers, the value is a set of enforceable questions: who supplied the report, why could the recipient obtain it, and how can an error be challenged? Those questions connect consumer data privacy to decisions about money, housing and work. Losing the proposed expansion leaves the coverage dispute and its practical consequences unresolved.
Goals and Rationale Behind the Rule
The policy problem is the distance between the original reason information was collected and its later uses. A detail supplied for one transaction can acquire a different meaning when combined with other records. The person described may have little way to see or contest that interpretation before someone acts on it.
That is why transparency alone is insufficient. A company can disclose that information is shared while leaving consumers unable to understand the chain of buyers, purposes and consequences. The proposal attempted to impose stronger obligations on covered activity, rather than making individuals negotiate separately with every intermediary. That objective remains worth defending.
Why the Rule Was Withdrawn in 2025
Leadership and Policy Shift Under the Trump Administration
The withdrawal reflected a clear change in Trump data privacy policy from the approach taken under the Biden administration. The notice said the proposal no longer aligned with the bureau’s policies and objectives, questioned the prior FCRA interpretation and referred to significant concerns raised in comments. It also left open the possibility of a different future proposal.
The important choice was immediate: this proposal would not proceed to a final rule. The administration did not need to demonstrate that the risks of data brokerage had disappeared to stop that rulemaking. Abandoning a concrete attempt to address those risks put industry flexibility ahead of stronger protections for the people represented in the data.
Industry Influence and Legal Framing
The withdrawal acknowledged commenters’ arguments that the proposal exceeded the bureau’s statutory authority. The bureau adopted a different interpretation and ended this rulemaking.
The dispute also should not be reduced to privacy versus innovation. Fraud prevention and legitimate eligibility decisions can serve useful purposes. The question is whether the information used for them carries enforceable limits, accuracy obligations and routes for correction. A claim that regulation is too broad does not answer what protection should replace it, or how consumers should challenge harmful uses in the meantime.
What the Withdrawal Leaves Unresolved
The United States already has federal privacy protections in particular sectors, and states impose additional requirements. Consumers still face uneven coverage and incomplete control.
A proposal intended to make important protections harder to evade has been abandoned while the underlying information market continues. Consumers are left to work out which rules apply to a transaction they may never see. The government’s decision not to proceed deserves scrutiny for leaving those gaps unresolved.
5 Dangerous Implications for Cybersecurity and Privacy
1. Continued Exposure to Identity Theft and Financial Fraud
Detailed personal profiles can make deception more convincing. A criminal who knows enough about a person’s finances or circumstances can tailor an approach around a real concern. The risk is not limited to someone opening an account under a stolen name; it also includes using accurate personal details to make a dishonest request look familiar and credible.
The abandoned proposal sought to restrict access to covered information, including sensitive identifying and financial data. Such limits could help reduce opportunities for misuse. They would not have eliminated scams, secured every database or guaranteed that a company could never suffer a breach. Withdrawing it leaves those proposed access limits unrealized.
Notification duties also depend on the entity, information and applicable law. For example, the FTC’s Safeguards Rule guidance explains that covered financial institutions must report certain security events to the FTC; those requirements took effect in May 2024. That is not a universal promise of direct notice to every affected person. Consumers should not assume either that all brokers must notify them in every case or that no legal notification requirement can apply.
2. National Security Risks From Sensitive Data Sales
A November 2023 Duke University study demonstrated how researchers could purchase sensitive, individually identified information about military personnel through U.S. data brokers. Buyer-screening practices were inconsistent, including in inquiries made through an overseas-associated domain. Location data was offered, but the researchers did not purchase it. The findings demonstrate a national-security vulnerability in the commercial data market.
Federal protections against adversarial access did exist before this withdrawal. The Protecting Americans’ Data from Foreign Adversaries Act of 2024 prohibited specified broker transfers of personally identifiable sensitive data to foreign-adversary countries and controlled entities. Separately, the Justice Department’s Data Security Program imposed prohibitions and restrictions on covered transactions, effective April 8, 2025.
Those measures address particular foreign-access risks. They do not substitute for the proposed consumer-reporting approach or establish that every risky sale will be detected and stopped. Different protections can reinforce each other; acknowledging one is not a reason to abandon the others. Sensitive commercial data remains a security issue even when a transaction looks less dramatic than a cyber intrusion.
3. Targeting of Vulnerable Communities
The same information can carry very different consequences for different people. A listed address may be an inconvenience for one person and a serious safety risk for a survivor of domestic violence. Financial distress can become a way to identify someone susceptible to a predatory offer. The sensitivity lies partly in the data and partly in who obtains it and what they intend to do.
The Brennan Center’s February 2024 analysis of data-broker loopholes describes risks including abusive targeting, discriminatory effects and government access to commercial records. It argues for stronger constraints on purchases that can sidestep legal protections. It is a broader policy concern requiring limits across different uses of personal information.
For vulnerable people, the burden of finding every listing, interpreting every privacy notice and repeatedly requesting removal is especially troubling. A system that places most of the work on the person at risk is a weak substitute for duties imposed on the companies collecting and distributing the information. The withdrawal leaves that structural criticism intact.
4. Government Access Without Sufficient Accountability
Government purchases of commercial information raise a different concern from ordinary advertising: public authorities can use data while exercising coercive power. Whether a warrant or other process is required depends on the information and circumstances. It is inaccurate to say that every government purchase necessarily bypasses a warrant requirement, but equally wrong to dismiss the oversight questions because information is commercially available.
The debate over DOGE illustrates the importance of separating mechanisms. In April 2025, Whistleblower Aid publicized Daniel Berulis’s allegations about NLRB systems, including concerns about access and possible removal of sensitive agency information. The allegation concerned agency-system access and possible removal of information. It did not establish broker purchases.
The political concern remains: Trump’s administration should be accountable for who can access personal information, for what purpose and under what safeguards. Commercial purchases and access to government-held records require different factual accounts, but neither should be insulated from scrutiny. The CFPB withdrawal belongs in that wider debate about accountability for personal information.
5. Weaker Consumer Control and Consent Norms
Withdrawing the CFPB data broker rule abandoned an opportunity to strengthen limits on covered disclosures, leaving consumers to navigate an information market with incomplete visibility and uneven rights.
Meaningful control requires more than a long notice or a choice buried in settings. A person needs to understand what is shared, with whom and for what purpose. When information passes through several intermediaries, the original interaction may tell them little about the eventual use. Consent is also not the only protection: a legally permitted disclosure can still require accuracy, security and opportunities to challenge errors.
The policy question is who bears responsibility for making those protections work. If the answer is always the individual, the companies that profit from the information face too little pressure to reduce exposure or explain their practices. Stronger legal duties are needed precisely because personal vigilance cannot follow every transfer.
What States Are Doing Instead
California, Vermont, Oregon and Texas
States have developed different tools, and registration should not be confused with a complete set of privacy rights. California’s broker-registration requirements are separate from the CCPA rights to know, delete and opt out of covered sales or sharing. Those rights apply subject to the law’s coverage and exceptions; they are not a promise that every public record can be erased.
Vermont enacted its data-broker legislation in 2018, including a registration framework. Oregon’s requirement began January 1, 2024 under legislation passed in 2023, as its contemporaneous registration announcement explains. Oregon did not first create that registry in early 2025. A registry identifies businesses and supports enforcement; it is not interchangeable with a right to stop every sale.
Enforcement Examples From 2025
In January 2025, Texas sued Allstate and its subsidiary Arity, alleging unlawful collection, use and sale of driving-related information gathered through mobile apps. That example concerns allegations in a filed lawsuit, not an established finding that every accusation was proved.
California’s National Public Data action followed a different path. Its May 8 announcement reported a $46,000 fine ordered May 2 for late registration under the Delete Act. The administrative accusation had been filed in February. The penalty concerned registration, not the company’s data breach or a separate finding of CCPA transparency violations.
These examples show that state regulators can act. They also show why the basis of an action matters. A registration penalty, a privacy-rights claim and a security failure are not interchangeable evidence that the same obligation applies everywhere.
Ongoing Gaps and Limitations
The result is a fragmented legal landscape. A person’s rights can depend on residency, the business, the category of information and the use being made of it. Moving a company across state lines does not automatically make applicable law disappear, but differences in coverage make the system harder for consumers to understand and use.
State action is valuable while leaving important gaps. Registration can improve visibility while leaving difficult questions about permitted uses. A deletion right can help without reaching every source or recipient. Federal sectoral protections can apply while leaving other activity outside their scope. These gaps support the case for stronger national standards.
How Consumers Can Protect Themselves in 2025
Opt Out Using Data Broker Removal Tools
Consumers cannot fully stop the collection and sale of information, but they can reduce some exposure. The FTC’s people-search guidance explains the options: request removal from sites individually or pay a service to handle requests. Before paying, check coverage, reports and how often the service revisits information that reappears.
An opt-out is not a universal deletion order. Public records remain, information can appear in reports about relatives or associates, and new records may create a new listing. A paid service may save time; it does not necessarily reach every broker or every kind of data. The objective is a useful reduction in exposure, not a promise to vanish from the information economy.
Strengthen Your Privacy Settings
Consumers should also reduce unnecessary collection at the source where they can:
- Turn off location access for apps that do not need it, and limit background access where available.
- Review advertising personalization and sharing choices rather than assuming defaults match your preferences.
- Use browser tracking protections and choose privacy tools suited to the device and browser.
- Review app permissions, especially on smartphones and connected home devices.
These steps address particular streams of information. They do not erase public records or stop every form of profiling. Our Privacy & Identity Protection resources put those choices in a broader context. The point is to reduce avoidable exposure while recognizing that personal settings cannot repair the entire system.
Monitor for Signs of Abuse or Breach
Credit reports, breach alerts and identity-theft recovery serve different purposes. The CFPB’s credit-report guidance directs consumers to AnnualCreditReport.com for free reports from the nationwide credit-reporting companies. Reviewing those reports can reveal unfamiliar accounts or incorrect information; a credit score alone will not show the underlying entries.
Email-address breach alerts can indicate exposure in known incidents. They do not establish that every affected account has been misused or identify every broker holding information. Likewise, an unexpected call or personalized scam is a warning to investigate, not proof of a particular data source.
If identity theft has occurred, the FTC’s IdentityTheft.gov recovery service helps people report it and create a personalized recovery plan. It is not the site for obtaining credit reports. Our Identity Theft Response Checklist provides a focused response without making monitoring sound like prevention of every loss.
Stay Informed and Get Involved
Understanding the risks posed by data brokers is essential, but awareness should lead to specific demands. Ask representatives and regulators which disclosures are permitted, how errors can be challenged, what information businesses must reveal and who enforces those duties. Support scrutiny of both private-sector practices and government use of commercial records.
Consumers should not have to become full-time privacy investigators to participate in ordinary life. Public pressure matters because a problem experienced privately by individuals can otherwise remain invisible in policy debates. To follow these issues and practical cybersecurity guidance, subscribe to our newsletter.
The Bigger Picture: Data Brokers, Democracy and Power
The Political Clout of Data Brokers
The industry’s power is not limited to holding information. It also includes the ability to define which uses appear ordinary, necessary or too valuable to restrict. A debate framed entirely around the convenience of buyers can lose sight of people who never chose to participate in the transaction.
Commercial profiling can also have political significance. The concern is not that every targeted message is unlawful. It is that detailed classifications can enable manipulation or exclusion while leaving the person categorized unable to see the basis for it.
Surveillance Capitalism and Public Trust
When sensitive personal data becomes a commodity, it does not just affect cybersecurity. It reshapes the relationship between people and institutions that hold power over them. Fear of being located, profiled or exposed can make people less willing to seek help, speak openly or participate in public life.
Privacy protection is therefore more than a preference about advertisements. It is also a question of whether people can act without every ordinary interaction becoming material for an unseen assessment. A legal system that offers remedies only after visible harm has occurred leaves much of that imbalance untouched.
Structural Reform Remains Necessary
Technical tools like VPNs, ad blockers, and opt-out services offer partial relief, but they cannot address the structural imbalance between data collectors and everyday consumers. A person can change a setting without knowing which companies already hold a copy. They can correct one record without being able to trace every inference made from it.
Enforceable rules around purpose, transparency, accuracy and disclosure can shift some responsibility back to the businesses that profit. Existing law already does this in important settings. Existing protections need enforcement, and uncovered activity needs effective limits.
AI, Profiling and Political Risk
The possibility of combining large datasets with automated analysis makes these questions more consequential. A system need not reveal a raw record to act on an inference about someone. More capable analysis does not guarantee that the inference is accurate, that the use is appropriate or that a person has an effective way to contest it.
The warning about AI and surveillance is clear: greater analytical power should increase the demand for accountable limits. It should not become an excuse to collect more first and discuss consequences later. The CFPB proposal addressed part of that problem through consumer-reporting rules; its withdrawal leaves the wider policy challenge in place.
Conclusion
Trump’s CFPB withdrew an opportunity to strengthen protections against harmful data-broker practices. The proposal had limits, and existing federal and state laws remained. Those facts do not erase the administration’s responsibility for choosing to abandon this effort or the risks created by an opaque market in personal information.
Consumers can reduce some exposure, and state enforcement can address specific violations. Neither removes the need for stronger, coherent national standards. The central question is whether companies and government institutions must justify their access and uses, or whether people must continually defend themselves against transactions they cannot see. Withdrawing the proposal leaves that imbalance unresolved.
FAQ
What was the CFPB data broker rule?
It was a December 2024 proposal to clarify and strengthen how FCRA protections apply to certain information and activities of data brokers. It addressed coverage, permissible purposes and consent conditions. It was not a universal ban on personal-data sales and never became effective.
Why was the proposal withdrawn?
The May 2025 notice, signed by Acting Director Russell Vought, cited changed bureau policies, a changed FCRA interpretation and concerns about statutory authority raised in comments. The withdrawal was a policy choice under the Trump administration.
Which data brokers would have been affected?
Coverage would have depended on a company’s information and activities, not simply its size or name. Businesses selling covered consumer-report information could face FCRA duties.
Can consumers stop their data from being sold?
Not entirely. Opt-outs, removal requests and privacy settings can reduce certain exposure, subject to the applicable law and service. They do not erase all public records, stop every recipient or guarantee that a listing will never return.
Is there a federal privacy law protecting consumer data?
There are federal laws protecting particular information, sectors and transactions, including the FCRA. The United States lacks one comprehensive federal consumer privacy law covering the whole information economy. The distinction is incomplete protection, not no protection.