The Consumer Financial Protection Bureau (CFPB) today outlined a plan for rulemaking under the Fair Credit Reporting Act (FCRA) that could significantly impact the entire consumer data ecosystem. The proposed rulemaking could redefine “data brokers” and “data aggregators” and extend FCRA regulation to businesses that do not currently meet the FCRA’s definition of “consumer reporting agency.” The CFPB’s plan could also impose stricter rules for obtaining consumer consent and increase compliance requirements and risks for both new and existing members of the FCRA-regulated consumer data ecosystem.

The proposed rulemaking could also impact consumer reporting agencies (CRAs), furnishers of data to CRAs, sources of data for “data brokers” and “data aggregators,” and end users of data obtained from CRAs and/or “data brokers”/”data aggregators.” CFPB Director Rohit Chopra indicated that a proposed rule would likely be issued in 2024. If implemented as outlined, this rulemaking plan could face significant legal challenges and all affected stakeholders should plan now for commenting and advocacy.

Read more from our team.

Photo of David N. Anthony David N. Anthony

David Anthony handles litigation against consumer financial services businesses and other highly regulated companies across the United States. He is a strategic thinker who balances his extensive litigation experience with practical business advice to solve companies’ hardest problems.

Photo of Mark Furletti Mark Furletti

Mark helps clients navigate regulatory risks posed by state and federal laws aimed at protecting consumers and small business, particularly in connection with credit, deposit, and payments products. He is a trusted advisor, providing practical legal counsel and advice to providers of financial

Mark helps clients navigate regulatory risks posed by state and federal laws aimed at protecting consumers and small business, particularly in connection with credit, deposit, and payments products. He is a trusted advisor, providing practical legal counsel and advice to providers of financial services across numerous industries.

Photo of David M. Gettings David M. Gettings

Dave is a partner of the firm who focuses on defending clients in consumer class actions and complex commercial litigation nationwide, particularly cases involving a variety of federal and state laws and regulations, including the Fair Credit Reporting Act (FCRA), the Telephone Consumer

Dave is a partner of the firm who focuses on defending clients in consumer class actions and complex commercial litigation nationwide, particularly cases involving a variety of federal and state laws and regulations, including the Fair Credit Reporting Act (FCRA), the Telephone Consumer Protection Act (TCPA) and associated FCC regulations, the Fair Debt Collection Practices Act, the Truth in Lending Act, the Electronic Fund Transfer Act, and many similar state consumer protection statutes.

Photo of Cindy D. Hanson Cindy D. Hanson

Consumer finance clients trust Cindy’s experience and skill to resolve their most challenging cases. Focused on class action defense, Cindy has handled numerous FCRA cases and is the point of contact for consumer protection defense.

Photo of Stefanie Jackman Stefanie Jackman

Stefanie takes a holistic approach to working with clients both through compliance counseling and assessment relating to consumer products and services, as well as serving as a zealous advocate in government inquiries, investigations, and consumer litigation.

Photo of Ethan G. Ostroff Ethan G. Ostroff

Ethan Ostroff’s practice focuses on financial services litigation and consumer law compliance counseling. Ethan is part of the firm’s national practice representing consumer-facing companies of all types in defense of individual and class action claims and counseling them on compliance with federal and

Ethan Ostroff’s practice focuses on financial services litigation and consumer law compliance counseling. Ethan is part of the firm’s national practice representing consumer-facing companies of all types in defense of individual and class action claims and counseling them on compliance with federal and state laws.

Photo of Kim Phan Kim Phan

Kim is a partner in the firm’s Privacy + Cyber Practice Group, where she is a privacy and data security attorney, who also assists companies with data breach prevention and response, including establishing effective security programs prior to a data breach and the

Kim is a partner in the firm’s Privacy + Cyber Practice Group, where she is a privacy and data security attorney, who also assists companies with data breach prevention and response, including establishing effective security programs prior to a data breach and the assessment of breach response obligations following a breach.

Photo of Ronald I. Raether, Jr. Ronald I. Raether, Jr.

Ron leads the firm’s Privacy + Cyber team. Drawing from nearly 30 years of experience, he provides comprehensive services to companies in all aspects of privacy, security, data use, and risk mitigation. Clients rely on his in-depth understanding of technology and its application

Ron leads the firm’s Privacy + Cyber team. Drawing from nearly 30 years of experience, he provides comprehensive services to companies in all aspects of privacy, security, data use, and risk mitigation. Clients rely on his in-depth understanding of technology and its application to their business to solve their most important challenges — from implementation and strategy to litigation and incident response. Ron and his team have redefined the boundaries of typical law firm privacy and cyber services in offering a 360 degree approach to tackling information governance issues. Their holistic services include drafting and implementing bespoke privacy programs, program implementation, licensing, financing and M&A transactions, incident response, privacy and cyber litigation, regulatory investigations, and enforcement experience.

Photo of Tim J. St. George Tim J. St. George

Tim defends institutions nationwide facing class actions and individual lawsuits. He has particular experience litigating consumer class actions, including industry-leading expertise in cases arising under the Fair Credit Reporting Act and its state law counterparts, as well as litigation arising from data breaches.

Photo of Chris Willis Chris Willis

Chris is the co-leader of the Consumer Financial Services Regulatory practice at the firm. He advises financial services institutions facing state and federal government investigations and examinations, counseling them on compliance issues including UDAP/UDAAP, credit reporting, debt collection, and fair lending, and defending…

Chris is the co-leader of the Consumer Financial Services Regulatory practice at the firm. He advises financial services institutions facing state and federal government investigations and examinations, counseling them on compliance issues including UDAP/UDAAP, credit reporting, debt collection, and fair lending, and defending them in individual and class action lawsuits brought by consumers and enforcement actions brought by government agencies.

Photo of Alan D. Wingfield Alan D. Wingfield

Alan Wingfield helps consumer-facing clients navigate compliance, litigation and regulatory risks posed by the complex web of state and federal consumer protection laws. He is a trusted advisor and tireless advocate, helping clients develop practical compliance and dispute-resolution strategies.

Photo of Chris Capurso Chris Capurso

Chris focuses his practice on consumer financial services compliance, guiding clients through the many federal and state laws and regulations that impact consumer credit programs.