“By selling our most sensitive personal data without our knowledge or consent, data brokers can profit by enabling scamming, stalking and spying,” Chopra said. “The CFPB’s proposed rule will curtail these practices that threaten our personal safety and undermine America’s national security.”

The CFPB's proposal would ensure data brokers comply with federal law and address critical threats from current data broker practices, including:

• National security and surveillance risks: Countries of concern, like China and Russia, can purchase detailed personal information about military service members, veterans, government employees and other Americans for pennies per person. This enables the creation of detailed dossiers for potential espionage, surveillance or blackmail operations, allowing relatively small investments to be leveraged into mass surveillance operations.
• Criminal exploitation: Identity thieves and scammers purchase detailed financial profiles to target vulnerable consumers, particularly seniors and financially distressed individuals. These criminals can use this data to execute sophisticated fraud schemes and steal retirement savings, often targeting Americans who can least afford the losses.
• Violence, stalking and personal safety threats to law enforcement personnel and domestic violence survivors: The availability of sensitive contact information poses risks to those who are targeted for their profession, such as judges, police officers, prosecutors and other government employees. Domestic violence survivors also face grave dangers when their current addresses and phone numbers are readily available for purchase through data brokers. Several states have already had to take action to protect judges and law enforcement officers after violent incidents, including the 2020 murder of a federal judge's son by an attacker who purchased her home address.

To address the risks stated above, the proposed rule would:

• Treat data brokers just like credit bureaus and background check companies: Companies that sell data about income or financial tier, credit history, credit score or debt payments would be considered consumer reporting agencies required to comply with the FCRA, regardless of how the information is used.
• Protect consumers' personal identifiers from abuse and misuse: When consumer reporting agencies collect information like names, addresses or ages for credit reports, any subsequent sale of that information would be covered by the FCRA's protections.
• Require clear consumer consent for data sharing: Under the proposed rule, companies relying on consumers’ consent to obtain or share a consumer’s credit report would need separate, explicit authorization to do so, rather than burying permissions in fine print.