White House Withdraws Rule Targeting Data Brokers’ Practices

The White House has officially withdrawn a major data privacy proposal that would have made it harder for data brokers to sell Americans’ personal and financial information. The move reverses a key effort launched in late 2024 by the Consumer Financial Protection Bureau (CFPB) to crack down on the largely unregulated data brokerage industry.

The proposal — titled Protecting Americans from Harmful Data Broker Practices (Regulation V) — was introduced in December 2024 under then-CFPB Director Rohit Chopra. It aimed to reinterpret the Fair Credit Reporting Act (FCRA) to classify data brokers as “consumer reporting agencies,” subjecting them to stricter legal obligations around data collection and resale.

A day before the withdrawal notice was posted, the Financial Technology Association (FTA) sent a letter to acting CFPB director Russell Vought, arguing that the rule would be “harmful to financial institutions’ efforts to detect and prevent fraud.” In its filing, the CFPB also acknowledged receiving “numerous concerns” about the proposed rule, including challenges to its “statutory authority to issue many of the proposals.”

The original push for the regulation came under Rohit Chopra, who warned that data broker practices could “threaten our personal safety and undermine America’s national security.” Since his departure, the CFPB has come under the leadership of Russell Vought, the Director of the Office of Management and Budget (OMB), who is reportedly set to take over the Department of Government Efficiency (DOGE) following Elon Musk’s exit.

The decision has alarmed privacy advocates, especially amid growing public concern over how data brokers collect, handle, and sell deeply personal data — including mental health information.

There have also been several high-profile breaches exposing the risks of this largely unchecked industry. In January 2025, a cyberattack reportedly compromised 17 terabytes of data from a broker collecting smartphone location data, revealing just how much personal information can be exposed through poor security practices.