State Consumer Privacy Laws and the Monetization of Consumer Financial Data

This report summarizes the state laws that give consumers more control over their data, how these rights complement the protections under federal law, and the gaps in protection that result from state law exemptions for financial institutions subject to the Gramm-Leach-Bliley Act (GLBA) or the Fair Credit Reporting Act (FCRA). As the report describes:

• Financial institutions are building new business models around consumer data: Firms in the consumer finance space are increasingly focusing on collecting and using large quantities of consumers' financial data as a source of revenue, including by selling that data to third parties. This data may include details about people's income, expenses, and account balances.
• Existing protections for financial data have limits: Consumers place a high value on their financial data and their ability to keep it private. There is broad consensusthat existing federal privacy protections for financial information have limitations and may not protect consumers from companies' novel and increasingly pervasive methods of collecting and monetizing data.
• The new state laws provide new consumer privacy rights: Under at least some state laws, consumers now have the right to know which data businesses have about them, to correct inaccurate information, to take that data with them to another business, or to request the business delete the information entirely, among other rights.
• State policymakers should assess gaps in existing data privacy laws: These exemptions mean that consumers in states with these new laws will not be able to access the state law privacy rights they have in other areas of their economic life to protect the information collected and/or shared by these exempted institutions. States should consider the importance of ensuring that their citizens are protected in instances where federal law currently has gaps or may be ineffective.

Full report

Read the full report