CFPB Proposes Rule to Stop Data Brokers Selling Sensitive Info

The Consumer Financial Protection Bureau (CFPB) proposed a rule on December 3, 2024 aimed at stopping data brokers like Acxiom, Experian, TransUnion from selling sensitive personal information without consent or knowledge. ¹

Data brokers build detailed profiles by stitching public records—such as property ownership—with purchased datasets including online browsing history via cookies, mobile app permissions, loyalty program memberships, and offline interactions at brick‑and‑mortar stores. Acxiom maintains over 500 million profiles covering more than half of US consumers as of early 2024 according to its own marketing materials before the CFPB announcement prompted scrutiny. These insights are marketed for advertising but also used in targeted harassment campaigns against individuals deemed threats based on predictive analytics algorithms developed using flawed training sets lacking sufficient diversity.

The proposed rule mirrors GDPR’s requirement for explicit consent when processing “sensitive” personal data. However, GDPR still allows brokers to sell anonymized buckets of aggregated user behavior patterns without individual authorization—a loophole many privacy advocates say undermines real protection. The new rule would close this gap by ensuring no sensitive details can be traded without clear, documented permission.

Experts warn that legal challenges could delay implementation indefinitely unless there’s bipartisan support for stronger privacy safeguards—something unlikely given current political polarization around digital rights issues today. Without such backing enforcement may stall, leaving millions of Americans vulnerable to unchecked profiling and potential misuse of their private information.

If enacted, the CFPB regulation will require data brokers to change how they collect, store, and share consumer data. Companies must verify consent, maintain audit trails, and provide transparent disclosures about data usage. Failure to comply could result in significant penalties, aligning with the bureau’s mandate to protect financial consumers from opaque or exploitative practices.

Scammers continue evolving tactics, highlighting the need for vigilance and informed decision‑making when sharing personal information online.