The Consumer Financial Protection Bureau (CFPB) issued a Request for Information (RFI) to gather insights on how companies offering financial products and services collect, use, and monetize consumer payment and personal financial data. Comments are due by April 11, 2025, providing an opportunity for the current CFPB and industry stakeholders to influence potential updates to data privacy regulations, including Regulation P under the Gramm-Leach-Bliley Act. The RFI reflects the CFPB’s continued focus on the development of consumer payment services that operate outside of the
traditional banking system, including, for example, digital payment apps operated by large technology companies.
Key Issues Highlighted
1. Expanded Data Collection and Use: The CFPB expressed concerns about the growing scope of data collected by financial companies, including payment data combined with biometric, geographic, and behavioral data. According to the CFPB, this commingling raises privacy risks and potential for misuse, such as dynamic pricing or targeted advertising.
2. Effectiveness of Regulation P: The CFPB asserts that Regulation P, which governs how financial institutions share nonpublic personal information, has been criticized for its limited transparency. The CFPB is exploring whether its model privacy form and opt-out mechanisms adequately protect consumers in today’s digital economy.
3. Potential Regulatory Reforms: The CFPB is soliciting input on a range of issues, including:
- Barriers to consumer opt-outs
- Retroactive changes to privacy policies
- Opportunities to impose stricter accountability on data-sharing practices
4. Big Tech’s Role in Financial Data: Drawing on recent inquiries into tech firms’ payment platforms, the CFPB highlighted alleged deficiencies in data governance and transparency, underscoring the need for consistent rules across financial and technology sectors.
* * * * * *
This RFI provides an opportunity for financial institutions, fintechs, consumer advocates, and other stakeholders to help shape the regulatory landscape. Key areas to address include whether any changes are necessary, the balance between innovation and privacy, competitive dynamics influenced by data aggregation, and methods used to improve consumers’ awareness and control over their personal financial data. Given the CFPB’s focus on transparency and fairness, responses that offer empirical data, detailed use cases, or innovative compliance solutions are likely to be impactful.
