Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
The Consumer Financial Protection Bureau (CFPB) proposed new data-broker restrictions on December 3, 2024, but withdrew the proposal on May 15, 2025, before it became binding. The proposal would have applied more Fair Credit Reporting Act (FCRA) requirements to certain companies selling sensitive identifying and financial information. It did not create a current nationwide ban on data-broker sales, a universal deletion right, or a comprehensive federal privacy law.
What the CFPB proposal was intended to do
The proposal would have amended Regulation V, the CFPB’s regulation implementing the FCRA. The bureau argued that some data brokers were selling information that functioned like a consumer report while claiming to operate outside the consumer-reporting system.
Under the proposal, certain companies could have been treated as consumer reporting agencies when selling information about individuals, regardless of the buyer’s intended use. That classification would have triggered existing FCRA obligations concerning permissible purposes, authorization, accuracy, access and safeguards.
Free tools Windows power users keep installed
One-click scans. No signup required.
What information would have been covered?
The CFPB highlighted sales involving information such as:
#1 Best Overall
- Names, addresses and ages
- Social Security numbers and phone numbers
- Income and financial tiers
- Credit history and credit scores
- Debt payments and related financial information
The proposal was aimed at certain data-broker activity involving identifying and financial information. It would not automatically have covered every marketing-data company, people-search website or advertising platform in the same way.
Why the CFPB said the issue mattered
Data brokers collect information from public and commercial sources, combine it into profiles and sell access to businesses, investigators and other buyers. The CFPB said misuse of these profiles could contribute to identity theft, fraud, harassment, stalking and doxxing. It also pointed to risks involving domestic-violence survivors, people in financial distress, foreign surveillance and national security.
Those risks do not mean that every broker sells every category of information or that every sale is unlawful. The CFPB’s position was that some companies were effectively engaging in consumer-reporting activity without complying with the FCRA.
How the proposed restrictions would have worked
Sales would have needed a permissible purpose
A covered consumer reporting agency generally cannot sell a consumer report to anyone simply because that buyer is willing to pay. The buyer must have a legally recognized permissible purpose under the FCRA. Depending on the circumstances, permissible purposes can include legitimate credit, employment or housing-related uses.
That would have restricted sales to scammers, stalkers or other buyers who lacked a lawful reason to obtain the information. It would not have banned every sale of covered data or ended all data commerce.
Consent would have needed to be separate and clear
Where a company relied on consumer authorization to obtain or share a covered consumer report, the proposal would have required separate, explicit authorization rather than relying on permission buried in unrelated fine print.
This was not a universal consent-based opt-out from every data broker. The requirement would have applied in situations covered by the FCRA framework.
Recommended Free Tools
Existing FCRA responsibilities would have applied
Companies treated as consumer reporting agencies would have faced the FCRA’s existing requirements, including rules related to accuracy, consumer access, disputes, disclosures, authorization and safeguards against misuse.
The FCRA is a federal law enacted in 1970. It is a sector-specific consumer-reporting law, not a general-purpose federal privacy statute covering all personal information.
Government access would not have disappeared
The proposal would have preserved existing FCRA pathways for government agencies to obtain consumer-report information for legitimate law-enforcement, counterterrorism and counterintelligence purposes. It therefore would not have blocked all government access to data.
What the proposal would not have done
- It was not a comprehensive privacy law. It did not regulate every use or sale of personal information.
- It would not have covered all sensitive data. Browsing data, advertising identifiers, all location data, all health information and all publicly available records would not automatically have fallen within its scope.
- It would not have created automatic deletion. The proposal did not give every person a universal right to erase records held by every broker.
- It would not have banned every data-broker transaction. Lawful sales for permissible purposes could have continued.
- It would not have treated every broker identically. Coverage would have depended on whether a company’s activities met the proposed FCRA definitions.
Timeline: proposal, comment period and withdrawal
| Date | Event |
|---|---|
| December 3, 2024 | The CFPB announced the proposed rule. |
| December 13, 2024 | The proposal was published in the Federal Register. |
| March 3, 2025 | The original public-comment deadline. |
| May 15, 2025 | The CFPB withdrew the proposal before finalization. |
The CFPB said legislative rulemaking was not necessary or appropriate at that time. The agency’s archived rulemaking page lists the matter as closed.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Did the rule become law?
No. The proposal never became a final regulation and did not itself impose a currently enforceable nationwide ban on data brokers. Headlines saying the CFPB “blocked” or “banned” data-broker sales are accurate only when describing the proposal’s intended effect, not the law today.
Its withdrawal also did not erase the FCRA or eliminate other privacy and consumer-protection rules. Existing obligations can still apply when a company operates as a consumer reporting agency, and regulators may pursue deceptive or unfair practices under other laws.
What protections exist now?
FCRA rights in covered situations
If a company is providing a consumer report for a covered purpose, the FCRA may provide rights involving permissible access, disclosures, authorization, accuracy, disputes and consumer access. Whether the law applies depends on the company’s activity and the use of the information—not simply on whether the company calls itself a “data broker.”
FTC enforcement
The Federal Trade Commission can address certain unfair or deceptive practices, but FTC enforcement is separate from the withdrawn CFPB proposal. FTC actions involving precise location data, for example, should not be treated as enforcement of this proposed Regulation V amendment.
Rank #4
State privacy laws
Some states provide deletion, correction, sensitive-data, sale opt-out or targeted-advertising rights. Eligibility, thresholds, exemptions and procedures vary significantly by state. State rights are not equivalent to the withdrawn proposal and should be checked against the law applicable to your residence and the company involved.
Other sector-specific laws
Separate rules may apply to particular information or industries, including laws concerning health information, financial institutions and video-viewing records. These protections do not combine into a single nationwide data-broker ban.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Practical ways to reduce your exposure
- Search people-search sites. Look up your name, phone number and current or previous address on major people-search services.
- Use official opt-out tools. Follow each broker’s suppression or deletion procedure. Save confirmation emails and note when the request was submitted.
- Check your state rights. Determine whether your state privacy law lets you request deletion, opt out of sale or limit the use of sensitive information.
- Freeze your credit files if identity theft is a concern. A credit freeze can help prevent unauthorized new-credit applications, but it does not remove people-search listings or marketing profiles. Start with the CFPB’s credit-report and score resources.
- Monitor accounts and exposed credentials. Review bank and card activity, change reused passwords and use multifactor authentication where available.
- Recheck periodically. Information can reappear, move between brokers or be added by a new source.
Are paid data-removal services worth considering?
Services such as DeleteMe, Incogni and Optery can be useful for people who prefer automated scans and removal requests. They are convenience tools, not replacements for the withdrawn CFPB proposal and not guarantees that every copy of your information will disappear.
They may not reach government records, court records, news archives, exempt entities, newly created broker databases or information republished elsewhere. Before paying, compare broker coverage, rescanning frequency, state-request support, verification methods, renewal pricing, cancellation terms and exclusions.
Readers seeking broader identity and account monitoring may also encounter bundled products such as Aura. Those products are a different fit from a service focused mainly on data-broker removals. Readers focused on credit fraud should prioritize a credit freeze rather than relying only on a removal subscription.
The unresolved legal question
The proposal reflected a broader dispute over how the FCRA applies to modern data brokers. The central question is whether a company can avoid consumer-reporting obligations by describing its product as a data profile when the information it sells resembles information traditionally used for credit, employment or other consequential decisions.
The CFPB’s December 2024 proposal attempted to expand or clarify that coverage through Regulation V. Because the bureau withdrew it before finalization, that interpretation did not become a new nationwide rule.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
