Signage is seen at the Consumer Financial Protection Bureau (CFPB) headquarters in Washington, D.C.
Data brokers collect sensitive personal information and use AI tools to create consumer profiles, which are often sold to companies without individuals' knowledge. Reuters

The U.S. Consumer Financial Protection Bureau (CFPB) is officially withdrawing a proposed rule introduced under former President Joe Biden that would have significantly curtailed the sale of Americans' personal information by data brokers, according to a notice published Wednesday in the Federal Register.

Unveiled in December, the rule sought to classify data brokers as consumer reporting agencies under the Fair Credit Reporting Act (FCRA), reported Reuters.

Data brokers selling financial records would have been required to meet FCRA standards, meaning data could only be sold for legitimate reasons such as loan underwriting, while ensuring accuracy and transparency. The reclassification would have subjected them to more stringent requirements regarding transparency, accuracy, and permissible use of personal data.

Advocacy group Consumer Reports pointed out data brokers collect sensitive personal information—including credit card purchases, web activity, health and genetic data, military status, religion, and financial records—and use AI tools to create consumer profiles. These profiles are often sold to companies without individuals' knowledge and can influence pricing, eligibility, and other key decisions affecting people's lives.

Russell Vought, the CFPB's acting director, explained that the decision reflects a change in the agency's policy direction and interpretation of the FCRA. He stated the proposed rule was ""not necessary or appropriate at this time," referencing broader updates to Bureau policies, The Hill reported.

"Further, commenters raised numerous concerns related to this proposed rule that the Bureau believes require careful consideration before proceeding with a final rule," Vought said.

Concerns Over Ignoring National Security And Privacy

Criticizing the decision, former CFPB Director Rohit Chopra emphasized that the proposed rule was necessary, citing risks to national security, increased surveillance, and potential criminal exploitation associated with data broker practices. He warned that the rollback could even endanger government officials by compromising their personal privacy.

Consumer Reports warned the withdrawal leaves Americans more susceptible to fraud and identity theft.

Matt Schwartz, policy analyst at Consumer Reports, said the decision increases the risk of sensitive information—such as Social Security numbers—falling into the hands of criminals.

"This decision is just the latest troubling move by this administration to abandon the CFPB's critical mission to protect consumers," Schwartz said.

Tumult Inside CFPB

Vought also rescinded nearly 70 policy statements, advisory opinions, interpretive rules, and guidance documents issued by the agency since its inception in 2011.

The scrapping of the data broker rule follows President Donald Trump's recent signing of congressional resolutions rolling back two Biden-era CFPB rules. The rules had extended consumer protections to digital payment technologies, including cryptocurrency.

Vought's leadership has coincided with dramatic internal shifts at the CFPB. He has halted many ongoing initiatives, closed the agency's headquarters, and attempted to carry out sweeping layoffs. Last month, the Bureau moved to eliminate about 90% of its workforce, but a court intervened to temporarily block the cuts.