CFPB Withdraws Proposed FCRA Data Broker Rule

Source: Consumer Financial Protection Bureau
Decided: May 15, 2025
Bottom line: Whether a data broker or people-search company is covered by the FCRA will continue to be decided case by case under the statute's existing definitions.

Background

The FCRA applies to “consumer reporting agencies” that assemble or evaluate information on consumers and furnish “consumer reports” to third parties. Whether a particular data broker, people-search site, or identity-verification vendor fits those definitions has long been disputed. A key battleground is “credit header” data: names, addresses, dates of birth, and Social Security numbers drawn from credit files. Industry has generally treated that data as outside the FCRA, which allows it to be sold without a permissible purpose.

On December 13, 2024, the CFPB published a proposed rule, Protecting Americans from Harmful Data Broker Practices (Regulation V), 89 Fed. Reg. 101402. The proposal would have implemented the FCRA’s definitions of “consumer report” and “consumer reporting agency” and its permissible-purpose provisions. According to its summary, it was designed to ensure the FCRA’s protections apply to sensitive consumer information, “including information sold by data brokers.” Commentators described it as treating credit header data as consumer report information that could be sold only for a permissible purpose. Industry groups opposed it, arguing in part that it would hamper fraud prevention. In March 2025, the CFPB published a notice extending the comment period.

What changed

On May 15, 2025, the CFPB, under Acting Director Russell Vought, withdrew the proposal. The notice states that the Bureau “will not take any further action” on it. It gave two reasons: the proposal “in many respects” was “not aligned with the Bureau’s current interpretation of the FCRA, which it is in the process of revising,” and commenters raised concerns, including about the plain text of the FCRA and the Bureau’s statutory authority, that the Bureau said required careful consideration. It said that if it later decides a rule is needed, it will propose a new one and seek comment.

Our take

The withdrawal leaves the law where it was before December 2024, which is not the same as leaving data brokers unregulated. The FCRA’s definitions are broad. Courts have held a range of background and people-search businesses to be consumer reporting agencies when they assemble information on individuals for use in decisions about credit, employment, housing, or insurance, and the FTC has brought enforcement cases on similar theories. Those cases continue to turn on how a company collects, sells, and markets its data, and on what its customers use it for.

What consumers lost is clarity. A final rule would have given courts a detailed framework, particularly on credit header data. Without it, the question will be litigated company by company. We also note the notice’s statement that the Bureau is revising its interpretation of the FCRA. Combined with the May 2025 withdrawal of FCRA guidance and the October 2025 preemption interpretive rule, the direction of federal policy in 2025 was toward narrower federal oversight of credit reporting, making private enforcement and state law correspondingly more important.

Industry will argue that the withdrawal reflects the better reading of the statute. Consumer advocates, including privacy groups, have argued the opposite. Both positions now play out in court rather than in a rulemaking.

What it means if your report is wrong

If an employer, landlord, or lender relied on a report from a background company, tenant screener, or data broker that contained wrong information about you, the FCRA may apply even if the company describes itself as a “data” or “search” service. Ask the user of the report which company provided it, request your file from that company, and dispute the errors in writing. Whether the company is a consumer reporting agency depends on facts about its business, which an attorney can evaluate.

A free case review can assess how this development affects a claim, and there is no fee unless we win.

Sources

Primary

Commentary we reviewed

Updated November 1, 2026. "Our take" is the firm's opinion. This page is general information, not legal advice, and later decisions may change the law.