Cybersecurity Policy Report, Sen. Gallego urges CFPB to reconsider withdrawal of data-broker rule, (May 19, 2025)

By Nora Macaluso

“If the Bureau will not act, Congress must,” the senator said in a letter to the CFPB’s acting director.

Senator Ruben Gallego (D-Ariz.) has sent a letter to Russell Vought, acting director of the Consumer Financial Protection Bureau, asking him to “recommit to the Bureau’s foundational mission” and reconsider the withdrawal of a proposed rule aimed at protecting consumers’ personal data from being collected and sold without their consent.

In December 2024, the CFPB proposed the rule, which would have limited the sale of personal identifiers like Social Security numbers collected by certain companies and narrowed the purposes for which data like income could be shared (see Banking and Finance Law Daily Dec. 3, 2024). It sought to treat data brokers as consumer reporting agencies (CRAs) under the Fair Credit Reporting Act (FCRA) and would have required that consumers have a right to revoke their consent for data sharing.

Under the Trump administration, the CFPB—with Vought as acting director—announced the rule’s withdrawal, saying it had “determined that legislative rulemaking is not necessary or appropriate at this time” and that although the proposed rule would have implemented portions of the FCRA, “in many respects it did so in a manner not aligned with the Bureau’s current interpretation of the FCRA, which it is in the process of revising, and its changed policy objectives.” It also referenced commenter concerns and questions about the CFPB’s “statutory authority to issue many of the proposals.” (see Banking and Finance Law Daily, May 14, 2025).

Gallego, who sits on the Senate Banking Committee, called the withdrawal “deeply troubling.”

“Americans’ most personal information, including real-time location data, private affiliations, and financial records, is being collected, repackaged, and sold without their knowledge or consent,” he wrote in the letter to Vought. “Data brokers make this intimate personal information available for sale on the open market, exposing individuals to scams, surveillance, threats, and reputational harm at the hands of bad actors.”

These scenarios “are not hypothetical,” Gallego said. The Justice Department, he noted, brought actions in 2020 and 2021 related to the sales of consumer data that was later used in fraudulent schemes. One instance involved data on 30 million individuals, he said.

“The Bureau’s withdrawal of this rule also comes at a time when its capacity to protect consumers has been radically diminished,” Gallego said, citing the Trump administration’s slashing of the CFPB workforce.

“The American people cannot afford a regulatory vacuum that allows private actors to exploit their data with impunity,” Gallego’s letter concluded. “If the Bureau will not act, Congress must.”

RegulatoryActivity: BankingOperations CFPB ConsumerCredit CreditDebitGiftCards CyberPrivacyFeed DataPrivacy DataSecurity FairCreditReporting FinancialStability FinTech IdentityTheft Privacy