US agency proposes new rule blocking data brokers from selling Americans’ sensitive personal data

The Consumer Financial Protection Bureau has proposed a new rule that would block data brokers from selling personal and financial information on Americans, including their Social Security numbers and phone numbers, under the Fair Credit Reporting Act. 

In proposing the new rules, months after President Biden signed an executive order to curb the sale of Americans’ private data, the U.S. consumer protection agency said it aims to “rein in” data brokers, who sidestep federal law by claiming that they are not subject to the FCRA’s legal provisions.

The CFPB’s director Rohit Chopra told reporters on a call Monday that the proposed rule would “curtail the widespread evasion” of the FCRA, which is the federal privacy law that protects personal data collected by consumer reporting agencies, like credit bureaus and tenant screening companies. The rule would also “make it clear that many of these data brokers, like credit bureaus and background check companies, are subject to federal protection under the FCRA.”

The move to close the regulatory loophole at the federal level comes at a time where data brokers face increasing scrutiny for profiteering from selling access to — and sometimes losing — vast amounts of Americans’ personal information. By acknowledging the “widespread evasion” of the federal privacy law, Chopra said the agency recognized that data brokers have long taken advantage of the law, and warned of the “staggering” problem caused by data brokers who are “making this data available to anyone willing to pay a price.”

According to the CFPB, the proposed rule would treat data brokers the same as credit bureaus and background check companies, or any other company that sells data about income or credit scores, histories, and debt payments, which are already subject to the FCRA. The proposed rule would also limit data brokers from selling information that can identify individuals, such as Social Security numbers and phone numbers, which would be covered under the FCRA going forwards.

“Today’s proposed rule is a major step forward to ensure that companies trafficking in Americans’ most sensitive information face real consequences for violating long standing law and for putting people and our country at risk,” Chopra said.

The CFPB said it was proposing the new rule to “further Congress’ goal” of protecting Americans’ personal data, as intended when it voted to pass the FCRA in 1970. Since then, the United States has become the only Western democracy to not have passed nationwide data protections into law. 

The proposed rule will remain public in the Federal Register until early March 2025. 

It’s unclear whether the rule will last under the incoming Trump administration, which has promised widespread deregulation across the U.S. government. CFPB officials would not say, but told reporters that there was “broad bipartisan recognition that data brokers pose real dangers.”