• by Wendy Davis  @wendyndavis, April 3, 2025

The ad industry is urging the Consumer Financial Protection Bureau to reject proposed regulations that could broaden the sweep of the Fair Credit Reporting Act to cover a broad array of data brokers.

The organization Privacy for America told the agency this week that the potential regulations “would harm consumers, the economy, and small businesses by hindering data services companies’ practices that provide valuable and desired offerings to the marketplace.” Members of Privacy for America include the American Association of Advertising Agencies, Association of National Advertisers, Digital Advertising Alliance, Interactive Advertising Bureau and Network Advertising Initiative.

The Consumer Financial Protection Bureau proposed the regulations last December, during the Biden administration. Since then, the Trump administration has taken steps to dismantle the agency, and it's not clear whether the proposal will move forward.

For now, however, groups are weighing in with comments on the proposed regulations.

The Fair Credit Reporting Act (FCRA) prohibits “consumer reporting agencies” from sharing certain information about people's financial circumstances except for specific purposes -- including eligibility for credit or insurance underwriting, housing, employment and government benefits. The law also gives consumers the right to learn what's in their credit reports, and requires reporting agencies to correct or delete incorrect information.

The agency's proposed rules would broaden the definition of “consumer report” and “consumer reporting agency” in ways that could cover many companies that hawk data.

Currently, “consumer report” is generally defined as information collected by a “consumer reporting agency” about people's credit history, credit score, debt payments or income level, if that data is used or “expected to be used” for one of the specific purposes covered by FCRA.

The proposed rules provide that information regarding consumers' credit history, score, debt payments and income is “expected to be used” for one of the purposes authorized by FCRA -- effectively transforming companies that amass such financial information into “consumer reporting agencies.”

Privacy for America says this proposal would “make certain kinds of information per se consumer reports, including credit history, credit score, debt payments, and income or financial tier information.”

The group adds that this type of economic data “frequently is disclosed for a myriad of legitimate purposes.”

“Information regarding financial tier, for example, may be disclosed for marketing efforts for rideshare services, discount grocery stores, or luxury goods to efficiently target an audience most likely to purchase a product,” Privacy for America writes.

The proposed rules also provide that data collectors are covered by the law if the information they amass is used by a downstream recipient for a FCRA-authorized purpose.

Privacy for America argues that potential change would sweep in companies that may have taken steps to limit the use of the information they compiled.

“Under this proposal, a data services company’s disclosure of information about a consumer could be subject to the FCRA even if the data services company carried out significant due diligence to prevent the use of the information for an FCRA purpose, including auditing its customers on a regular basis, engaging in data labeling, and taking other measures to prohibit downstream use for an FCRA purpose,” the group writes.

Privacy watchdogs largely support the proposed rules.

The Electronic Privacy Information Center and others said this week in a filing that the proposed regulations “will strengthen protections for consumers.”

That groups noted in their filing that information held by data brokers can pose threats to national security, expose consumers to fraud and other threats.

“Data brokers impose real harm on people by degrading privacy, security, and safety,” the Electronic Privacy Information Center and others write.

“Restricting the share of data for only legally permissible purposes will cut off bad actors from directly receiving consumer information,” they add.

The Center for Digital Democracy said in a separate filing that the proposed rules will provide consumers with needed protections.

“Data brokers are currently in the forefront of providing digital 'dossiers' that identify and target U.S. financial consumers, especially through 'identity graph' services that enable personalized tracking and microtargeting,” the Center for Digital Democracy wrote. “This is especially true with the now-dominant digital video streaming system (connected, or CTV) that touches nearly every American household, including those with children.”

Consumer Reports generally supported the agency's proposal, but expressed concern that the potential rules could override stronger privacy protections in states that already regulate data brokers. That organization urged the agency to make clear that the potential changes don't cancel stronger state laws.