CFPB's Proposed Rule on Data Brokers Under the FCRA

On December 3^rd, the CFPB proposed a rule expanding the coverage of FCRA to data brokers, clarifying the definition of consumer report, limiting the use of credit header data, and expanding the consumer consent requirements to furnish a consumer report. Comments on the Proposed Rule are due March 3, 2025.

With an expanded definition of “consumer report” and “consumer reporting agency” (“CRA”), particularly that a person selling any of four types of information about a consumer (credit history, credit score, debt payments, and income or financial tier) for any purpose generally would qualify as a CRA selling consumer reports, a substantial number of data brokers likely would qualify as CRAs. Additionally, despite industry’s requests for certain exemptions such as for fraud prevention or compliance with BSA/AML obligations, the CFPB is proposing that credit header data that was collected by a CRA in whole or in part for the purpose of preparing a consumer report about the consumer is itself a consumer report. This means that a CRA could only furnish credit header data if there is a permissible purpose. According to the CFPB, the proposal does not address data brokers that sell contact information that was not collected for the purpose of preparing consumer reports, and this provision only applies to credit header information that comes from entities that are already CRAs that furnish consumer reports.

I. Background: FCRA

The FCRA permits people to obtain consumer reports from consumer reporting agencies (“CRAs”) only for certain specified purposes (“permissible purposes”) and forbids CRAs from furnishing consumer reports to users who lack a permissible purpose. In addition, consumers have the right to dispute the accuracy of information in their consumer report and be notified when the consumer report information is relied on to make a negative decision about the consumer’s application for credit, housing, or employment.

II. CFPB’s Rationale for the Proposed Rule

The CFPB finds that data brokers’ collection, assembly, evaluation, dissemination and use of vast quantities of often highly sensitive personal and financial data about consumers poses a significant threat to consumer privacy and national security and can facilitate numerous consumer harms, such as financial scams and identification of victims for stalking and harassing. The CFPB finds that data brokers are evading coverage under the FCRA and intends to address this by explaining what a consumer report is and relatedly, what a CRA is.

The CFPB has observed that CRAs continue to engage in practices that may be harmful to consumers. For example, CRAs sell personal identifiers collected for the purpose of preparing consumer reports— “credit header” information—to third parties who may not have an FCRA-permissible purpose to obtain the information.

The CFPB is also concerned with CRAs selling information drawn from consumer reporting databases that has been aggregated or otherwise de-identified. The CFPB is concerned that advances in technology have made, and will continue to make, it easier for users to combine data and identify consumers within purportedly de-identified data sets, and that the sale of such information by consumer reporting agencies thus threatens the privacy of consumer information. The CFPB proposes three possible alternatives to address this problem and clarify when a communication by a CRA of information about a consumer is a consumer report.

The CFPB is concerned that CRAs are monetizing consumer report information for use in marketing in ways that the FCRA prohibits. The Proposed Rule would emphasize that the FCRA’s legitimate business need permissible purpose does not authorize CRAs to furnish consumer reports to users for solicitation or marketing purposes.

To better ensure consumer privacy, the CFPB proposes to specify what is needed to establish a permissible purpose based on the written instructions of a consumer. This proposal is similar to the third-party authorization provisions in CFPB’s Personal Financial Data Rights rule (1033 rule) which was recently finalized.

III. Details of Proposed Rule

a. Definition of Consumer Report (Proposed § 1022.4)

In general, a consumer report under the FCRA is a written, oral, or other communication by a consumer reporting agency of any information that: (1) bears on at least one of seven specified factors relating to a consumer (creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living); and (2) is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer’s eligibility for credit or insurance, for employment purposes, or for any other purpose authorized under FCRA section 604 (permissible purposes).

Is Used (Proposed § 1022.4(b))

The CFPB is clarifying the phrase “is used” means the purpose for which information is used can cause the communication to be a consumer report, regardless of whether the person communicating the information collected it or expected it to be used for that purpose. Additionally, the Proposed Rule would clarify that information is used for a permissible purpose if anyone, not merely the direct recipient of the communication, uses the information for such a purpose. As a practical matter, this would mean that a person that sells information that is used for a permissible purpose would become a CRA, regardless of whether the person knows or believes that the communication of that information is legally considered a consumer report.

Expected to be Used (Proposed § 1022.4(c))

The Proposed Rule would establish two tests for determining whether information is “expected to be used” for a permissible purpose. Under these tests, information in a communication is expected to be used for such a purpose if: (1) the person making the communication expects or should expect that a recipient of the information will use it for such a purpose; or (2) it is information about a consumer’s credit history, credit score, debt payments, or income or financial tier. Information would need to satisfy only one of the tests for the “expected to be used” element of the definition of consumer report to be met.

Similar to the above definition of “is used,” under the first test, information is expected to be used for a permissible purpose if the person communicating the information expects or should expect any recipient of the information will use it for such a purpose (meaning initial and downstream recipients). The CFPB is asking whether there should be factors that may be relevant to determining whether a person should expect that information will be used for a permissible purpose. The CFPB is also asking whether the rule should identify the steps a person must or should take to ensure that the information it sells is not used for a permissible purpose.

Under the second test, a person selling any of four types of information about a consumer (credit history, credit score, debt payments, and income or financial tier) for any purpose generally would qualify as a consumer reporting agency selling consumer reports because those information types are typically used to underwrite loans. The CFPB’s rationale is related to national security harm, including using Americans’ sensitive personal data for blackmail and espionage. The CFPB also believes that the data broker industry poses data security risks, as the information collected and sold by data brokers is an attractive target for hackers and identity thieves. Finally, the CFPB finds that the data broker industry poses risks to the personal safety of American consumers, e.g., domestic abusers can use data from data brokers to stalk, harass, and commit violence. The CFPB anticipates that if this second test is finalized as proposed, a substantial number of additional data brokers operating today likely will qualify as CRAs.

Personal Identifiers for a Consumer (Credit Header Information) (Proposed § 1022.4(d))

The CFPB proposes to provide that the term “consumer report” includes a communication by a consumer reporting agency of a personal identifier for a consumer that was collected by the consumer reporting agency in whole or in part for the purpose of preparing a consumer report about the consumer. Therefore, a CRA could only make such a communication if the user had a permissible purpose under the FCRA to obtain it.

The CFPB recognizes that the FTC and courts found that identifying information does not constitute a consumer report if it does not bear on any of the seven factors specified in the definition and is not used to determine eligibility. However, the CFPB preliminarily concludes that personal identifiers bear on one or more of the seven factors specified in the definition of consumer report (e.g., a consumer’s personal characteristics).

The personal identifiers at issue are only information that comes from entities that are already CRAs that furnish consumer reports, and the question is whether such entities can take the sensitive contact information that they collect to prepare consumer reports and sell it for purposes not authorized under the FCRA. In that fact pattern, the CFPB preliminarily determines that the sensitive contact information was “collected in whole or in part” to populate consumer reports to furnish to clients that use it for a permissible purpose. According to the CFPB, proposed § 1022.4(d) does not address data brokers that sell contact information that was not collected for the purpose of preparing consumer reports.

Many in the financial services industry objected to credit header information being treated as a consumer report, arguing that such categorization would increase costs, result in delays, and undermine efforts to combat money laundering, terrorism, and other crimes. In response, CFPB states that such predictions “overstate the consequences” and that identifying information would be available in various ways. If an entity has an FCRA permissible purpose to obtain a consumer report, the entity can also use the consumer report for identity verification and fraud prevention activities conducted in connection with that permissible purpose. “For example, a creditor has a permissible purpose to use consumer report information for identity verification and fraud prevention if such activities are conducted in connection with a credit transaction that involves an extension of credit to the consumer or review or collection of a credit account of the consumer.”

The CFPB requests comment on an alternative to this approach to credit header information. Under the alternative, a communication by a CRA of personal identifiers can be a consumer report if the information meets the two-prong test in proposed § 1022.4(a)’s definition of consumer report. The final rule could provide illustrative examples of communications by consumer reporting agencies of personal identifiers that are consumer reports, such as communications of age or address information.

De-Identification of Information (Proposed § 1022.4(e))

Proposed § 1022.4(e) addresses when a consumer reporting agency’s communication of de-identified information should be considered a consumer report. The CFPB is proposing three alternative versions of § 1022.4(e) to address the risk of re-identification of consumer report information that has been de-identified.

The first proposed version of § 1022.4(e) is a bright-line approach under which de-identification of information would not be relevant to a determination of whether the definition of consumer report is met.

The second proposed version of § 1022.4(e) would provide that de-identification of information is not relevant to a determination of whether the definition of consumer report in § 1022.4(a) is met if the information is still linked or linkable to a consumer.

The third proposed version of § 1022.4(e) would provide that de-identification of information is not relevant to a determination of whether the definition of consumer report is met if at least one of these conditions is met: (i) the information is still linked or reasonably linkable to a consumer; (ii) the information is used to inform a business decision about a particular consumer, such as a decision on whether to target marketing to that consumer; or (iii) a person that directly or indirectly receives the communication, or any information from the communication, identifies the consumer to whom information from the communication pertains.

b. Definition of Consumer Reporting Agency (Proposed § 1022.5)

Proposed § 1022.5(a) restates the FCRA definition of CRA with minor wording and organizational changes for clarity. Proposed § 1022.5(b) interprets the phrase “assembling or evaluating.” Under the Proposal, a person assembles or evaluates consumer credit information or other information about the consumer if the person: (1) collects, brings together, gathers, or retains such information; (2) appraises, assesses, makes a judgment regarding, determines or fixes the value of, verifies, or validates such information; or (3) contributes to or alters the content of such information. Proposed § 1022.5(b)(2) provides examples of conduct that would constitute assembling or evaluating:

1. When a person collects information from a data source and then groups or categorizes it, regardless of whether the person alters or changes the information;
2. When a person alters or modifies the content of consumer information, including for formatting purposes;
3. When a person determines the value of such information, such as by arranging or ordering it based on perceived relevance to the user;
4. When a person retains information about consumers; or
5. When a person verifies or validates information received about a consumer.

Additionally, the CFPB is clarifying that a CRA furnishes a consumer report if it provides the consumer report to a person and that includes instances where a CRA does not technically transfer a consumer report but facilitates a person’s use of any information in the consumer report for that person’s financial gain. (Proposed § 1022.10(b)).

c. Permissible Purposes Based on a Consumer’s Written Instructions (Proposed § 1022.11)

Proposed § 1022.11 implements FCRA section 604(a)(2) by specifying the conditions that would need to be satisfied for a consumer reporting agency to furnish a consumer report based on a consumer’s written instructions. The notice, authorization process, and limits on use align closely with the requirements for third-party authorization in the CFPB’s Personal Financial Data Rights rule. The Proposal would:

1. Require that the consumer provide express, informed consent to the furnishing of the report and receive a disclosure that is clear, conspicuous, and segregated from other material that includes: the name of the person the report will be obtained from; who the report will be provided to; the product or service, or specific use, for which the consumer report will be furnished; limitations on the scope of such use; and how a consumer may revoke consent;
2. Require that the consumer report furnished pursuant to written instructions must be furnished in connection with a specific product, service, or use the consumer has actually requested;
3. Require that, once consent is obtained, the user of the report procures, uses, retains, or shares the report with a third party only as reasonably necessary to provide the product or service requested by the consumer or the specific use identified. Targeted advertising, cross-selling, and the sale of information in the consumer report are not part of, or reasonably necessary to provide, any other product or service;
4. Prevent a user from procuring a consumer report more than one year after the date on which the consumer provides consent; and
5. Require that the consumer is provided a method to revoke consent that is as easy to access and operate as the method by which the consumer initially provided consent.

Either the CRA or the person to whom the consumer report will be furnished would be authorized to obtain the consumer’s express consent and to provide the required disclosure. However, the CRA ultimately would be responsible for ensuring that it furnishes a consumer report in accordance with these requirements.

d. Permissible Purpose Based on Legitimate Business Need (Proposed § 1022.12)

The CFPB proposes § 1022.12 to incorporate into Regulation V the permissible purposes listed in FCRA section 604(a)(3)(A) through (F).

Proposed § 1022.12(b) would implement and interpret the legitimate business need permissible purpose in FCRA section 604(a)(3)(F). FCRA section 604(a)(3)(F) provides that a consumer reporting agency may furnish a consumer report to a person which it has reason to believe has a legitimate business need for the information in two scenarios: (1) in connection with a business transaction that is initiated by the consumer (the consumer-initiated transaction prong), and (2) to review an account to determine whether the consumer continues to meet the terms of the account (the account review prong).

The Proposal would clarify that the consumer-initiated transaction prong of the legitimate business need permissible purpose authorizes a consumer reporting agency to furnish a consumer report to a person only if the consumer reporting agency has reason to believe that the consumer has initiated a business transaction. The Proposal includes examples that clarify that a consumer may interact with a business without initiating a transaction, such as by asking about the availability or pricing of products or services.

The Proposal also would state that neither prong of the legitimate business need permissible purpose authorizes a CRA to furnish a consumer report to a person if the consumer reporting agency has reason to believe the person is seeking information from the report to solicit the consumer for a transaction the consumer did not initiate or to otherwise market products or services to the consumer. There is a cross-reference to FCRA section 604(c) related to prescreened offers for credit or insurance transactions, which permits the release of consumer report information for marketing.

The CFPB proposes § 1022.13 to incorporate into Regulation V the permissible purposes listed in FCRA section 604(a)(1), 604(a)(3)(G), and 604(a)(4) through (6), related to certain agency or other official requests.

IV. Proposed Effective Date

The CFPB requests comment on an effective date for the proposed rule, and the CFPB is considering whether that date should be six months or one year after publication of the final rule in the Federal Register.

V. Requests for Comment

The CFPB requests comment on all aspects of this proposed rule. In addition to the requests regarding specific topics in the preamble, the CFPB generally requests comment on:

1. Whether each proposed provision is sufficiently clear so that entities that would be covered under a final rule could comply, or whether clarifying revisions are needed and, if so, what they are;
2. Whether additional examples regarding any of the proposed provisions would be helpful and, if so, what those examples should be;
3. Any anticipated drawbacks of any of the proposed provisions, such as any unintended negative consequences for consumers or covered entities or potential conflicts with other laws, and any alternatives that would achieve the goals of the proposed rule while reducing or avoiding such consequences or conflicts;
4. The anticipated benefits and costs of each proposed provision to consumers and to entities that would be covered if the proposed rule were adopted as proposed, and any alternatives that would reduce costs; and
5. With respect to questions 1 through 4, any considerations particular to small entities that the CFPB should consider.

VI. Impact of new Administration

As this is a proposed rule and the comment period will still be open when the new Administration takes office, the next CFPB director will have substantial discretion with it. The new CFPB director could withdraw the proposal altogether, extend the comment period, not finalize the proposal, withdraw and reissue a modified proposal, finalize the rule with some modifications, or some combination of any of the above. The path forward will depend on who is named as the next CFPB director and their priorities. One possibility is that the rulemaking continues and is finalized with certain meaningful modifications. For example, it is possible the final rule could include exemptions that would permit entities to use credit header data for fraud prevention and anti-money laundering purposes.

Since this is only a proposed rule, it is not eligible for a resolution of disapproval under the Congressional Review Act.