In recent years, many states have enacted new privacy laws to put limitations on how our data can be used, shared, and monetized. Today, the CFPB published a report finding that state consumer privacy laws typically exempt entities covered by federal financial privacy laws.

On November 12, 1999, exactly twenty-five years ago, Congress enacted the Gramm-Leach-Bliley Act. The expansive law included a new privacy provision requiring financial institutions to provide a privacy disclosure, as well as an opportunity to opt out of certain data sharing practices. There is broad consensus that this is inadequate for the modern age, especially as personalized pricing and other surveillance practices spread in our economy.

Absent action to beef up federal privacy protections, states will need to take further action to guard against intrusive surveillance and improper monetization of our most sensitive personal financial data.

The report published today follows a series of other CFPB research efforts to identify how companies, including very large technology conglomerates, harvest personal financial data. A 2022 CFPB report described the rise of super-apps and the monetization of personal financial data in the United States, similar to what has been observed with commercial surveillance in China.

The CFPB continues to pursue efforts to modernize the regulatory framework on privacy. The CFPB is working to update the rules implementing the Fair Credit Reporting Act, particularly with respect to data brokers. This effort will be particularly important given how certain data broker practices can create a broad range of harms, including to our personal safety and our national security.

In addition, the CFPB recently finalized the Personal Financial Data Rights Rule, which gives consumers the right to access and permission their personal financial data. The rule puts into place meaningful limitations to ensure that this data is secure and not subject to misuse or abuse.

The CFPB will also continue our work with Congress and the states to enshrine additional protections of personal financial data into law.