On March 15, 2023, the Consumer Financial Protection Bureau (CFPB) announced an inquiry into companies that gather and track information about people's personal lives. The apparent purpose of this inquiry is to gain a better understanding of the full scope and business practices of data brokers, the impact of their activities on consumers' daily lives, and whether they are all following the same regulations. This is an opportunity for the public to provide feedback about these companies and their role in people's lives and the economy. The information gathered will likely shed light on an industry that often operates outside of the public eye and will inform the CFPB's future work to ensure that these companies comply with federal law.
According to CFPB Director Rohit Chopra, "Modern data surveillance practices have allowed companies to hover over our digital lives and monetize our most sensitive data." The inquiry aims to determine whether the rules under the Fair Credit Reporting Act (FCRA) reflect these market realities.
Concerns about data brokers gathering detailed information about consumers and selling it to businesses for employment, credit, and other decisions led Congress to pass the FCRA. People often have little choice about whether to enter into business relationships with these companies, but the data they collect can significantly impact important life decisions, such as buying a home or finding a job. The FCRA provides protections, including accuracy standards, dispute rights, and restrictions on how data can be used. The FCRA covers data brokers like credit reporting companies and background screening firms, as well as those who report information to these firms.
The CFPB inquiry is seeking information about current business practices in the market to inform its efforts to administer the law, including planned rulemaking under the FCRA. The CFPB is interested in learning about the business models and practices of data brokers, including the types of data they collect and sell and the sources they rely upon. Direct experiences of individuals with these companies are also of interest, including instances where people try to remove, correct, or regain control of their data.
