The US government is gearing up to regulate the extensive data broker industry with new privacy-focused measures aimed at protecting Americans’ personal information from breaches, criminal misuse, and even AI chatbots.
The upcoming proposal by the Consumer Financial Protection Bureau (CFPB) seeks to extend current regulations that cover credit reports, arrest records, and other data to the so-called “surveillance industry”—the vast network of companies that trade in digitized personal information.
Though details of the rules are not yet finalized or public, they could prohibit data brokers from selling certain types of consumer data—such as income, criminal records, and payment histories—except under specific conditions. The CFPB also plans to impose new restrictions on selling personal details like Social Security numbers, names, and addresses, which brokers often obtain from major credit reporting agencies to build consumer profiles.
Under the Fair Credit Reporting Act, these regulations would ensure that sensitive information is sold only for legitimate financial purposes, such as employment background checks or credit evaluations, and not for unrelated uses like training AI algorithms or chatbots, the CFPB stated.
This move follows a CFPB study revealing widespread concerns about the collection, use, and sharing of consumer data. The inquiry highlighted risks to minorities, seniors, immigrants, and domestic violence victims from unregulated data sharing.
“Reports of sensitive information being monetized—ranging from financial details of military members to lists of people with dementia—are troubling, especially when this data is used in AI and automated decision-making,” said CFPB Director Rohit Chopra. “We are taking steps to ensure data brokers understand they cannot illegally collect and share our data.”
The CFPB will first present the proposal to small businesses for feedback before officially releasing it for public comment.
The CFPB is not alone in addressing the data industry. Last year, the Federal Trade Commission (FTC) proposed extensive regulations aimed at limiting how businesses collect and use consumer data. FTC Chair Lina Khan has criticized the industry for its “persistent tracking and routinized surveillance of individuals.”
These efforts highlight Congress’s ongoing failure to establish a comprehensive national privacy law, despite prolonged discussions and the growing impact of international privacy regulations on US businesses.
