The Consumer Financial Protection Bureau (CFPB) withdrew its proposed data broker rule on May 15, 2025, ending an effort that would have brought data brokers under the Fair Credit Reporting Act (FCRA) for the first time. In 2026 this means data brokers still face no federal consent requirement before selling your income, credit, address, and family details — state privacy laws and services like PrivacyOn are now your primary line of defense.
What Was the CFPB Data Broker Rule?
On December 13, 2024, the CFPB proposed a rule titled “Protecting Americans from Harmful Data Broker Practices (Regulation V).” It would have redefined key terms in the Fair Credit Reporting Act to sweep data brokers into the FCRA’s definition of a “consumer reporting agency” (CRA).
In practical terms, brokers selling sensitive financial information — income data, credit histories, debt payments, credit header data (name, address, SSN) — would have been required to:
- Obtain your written consent before selling that data.
- Verify a “permissible purpose” under the FCRA for every data transfer.
- Provide dispute rights so consumers could correct inaccurate records.
- Face civil penalties and private lawsuits for violations.
The proposal was one of the most significant federal privacy actions in years. Senators, national security officials, and consumer groups had backed it as a way to shut down the pipeline that lets scammers, stalkers, and foreign intelligence services buy sensitive personal data at scale.
Why Was the Rule Withdrawn?
On May 14, 2025 the CFPB filed a formal notice withdrawing the proposed rule; the withdrawal was published in the Federal Register the next day. The Bureau said rulemaking was “not necessary or appropriate at this time,” citing:
- New Bureau policies under the current leadership.
- Concerns raised by industry commenters that treating data brokers as CRAs did not align with the FCRA’s statutory text.
- The Small Business Administration’s Office of Advocacy requesting withdrawal in April 2025.
- The agency’s own reinterpretation of the FCRA, which is itself being revisited.
Industry trade groups — including the Consumer Data Industry Association — publicly welcomed the decision. Consumer privacy advocates including the Electronic Privacy Information Center (EPIC) criticized it, arguing that the withdrawal leaves in place a data broker ecosystem the CFPB itself had said “fuels scams, stalking, and national security threats.”
What did NOT change
The FCRA still governs traditional credit reporting agencies like Equifax, Experian, and TransUnion. What the withdrawal killed was the CFPB’s effort to extend those rules to the hundreds of consumer data brokers that operate outside the FCRA today. Those brokers — Spokeo, BeenVerified, Whitepages, LexisNexis Risk Solutions, and the rest — can continue to buy, package, and resell your data without your consent under federal law.
What This Means for Your Privacy in 2026
1. No New Federal Consent Requirement
Before the rule was withdrawn, data brokers were preparing to have to ask before selling your income, credit, or credit-header data. That preparation has largely stopped. In 2026, most consumer data brokers still operate on an opt-out model — your data is sold by default, and you must proactively remove yourself.
2. State Laws Are Doing the Federal Government’s Job
With federal action stalled, state privacy laws are the effective baseline. As of mid-2026, roughly 20 states have comprehensive consumer privacy laws, and California’s Delete Act with the DROP platform is now live, letting Californians send one deletion request that reaches every registered broker at once.
- California: CCPA / CPRA / Delete Act — strongest state framework, plus DROP
- Virginia: VCDPA
- Colorado: CPA
- Connecticut: CTDPA
- Utah: UCPA
- Texas: TDPSA
- Oregon: OCPA
- Delaware, Iowa, Montana, New Hampshire, New Jersey, Tennessee, Maryland, Minnesota, Nebraska, Rhode Island, Indiana, Kentucky, and more — comprehensive privacy statutes in effect or phasing in through 2026
3. Enforcement Still Happens — Just Through Other Channels
Even without the CFPB rule, the Federal Trade Commission continues to bring individual enforcement actions against brokers under Section 5 of the FTC Act. In recent years the FTC has fined X-Mode Social, InMarket Media, Kochava, and others for selling location data without adequate consent. See our guide to FTC data broker enforcement actions for the full timeline.
4. You Still Have to Opt Out One-by-One (Or Automate It)
The most concrete impact for consumers is that the federal “consent-first” model died. In its place, the burden remains on you to identify every broker that has your data and file individual opt-out requests — often across hundreds of sites, each with their own form, verification requirements, and 30–45 day response windows. Then you have to monitor for re-listing, because brokers regularly re-ingest your data from public records.
The practical reality in 2026
With federal reform stalled, the fastest way to control your data is to (1) exercise your rights under whichever state law applies to you, (2) use California’s DROP platform if you qualify, and (3) automate the rest with a removal service so you are not filling out 100+ forms every quarter.
Skip the manual work
PrivacyOn removes your personal information from 100+ data broker sites and keeps it removed — automatically.
Start your free scan★★★★★ 4.8/5 · Trusted by thousands of families
What Could Come Next?
- State-level pressure will keep building. More states are expected to pass comprehensive privacy laws in 2026–2027, and California-style delete platforms are being proposed in Texas, New York, and Illinois.
- Congressional action is possible but unlikely. The bipartisan American Privacy Rights Act (APRA) has resurfaced in various forms but has never advanced to a floor vote.
- Executive orders on national security are the wildcard. The Biden-era Executive Order 14117 restricting bulk sensitive data sales to countries of concern remains in force, and 2026 Department of Justice rules under it are being implemented.
- A future CFPB may revive the rule. The withdrawal is not a repeal — it is a decision not to finalize this proposal. A future Bureau leadership could restart the process.
How to Protect Yourself Now (Without Federal Help)
The withdrawal makes proactive self-defense more important, not less. A practical 2026 plan:
- File a state-law deletion request with the biggest brokers — Acxiom, LexisNexis, Epsilon, CoreLogic, and Oracle Data Cloud — citing the law that applies to you.
- Opt out of consumer people-search sites like Spokeo, Whitepages, BeenVerified, TruePeopleSearch, and FastPeopleSearch.
- Use the California DROP platform if you are a California resident.
- Freeze your credit with all three bureaus — it is free and blocks new-account identity theft even if brokers still leak your data.
- Enroll in continuous monitoring so you catch re-listing and dark-web exposure quickly.
How PrivacyOn Helps Fill the Federal Gap
PrivacyOn was built for exactly the world the CFPB withdrawal left in place. It automatically submits opt-out requests across 100+ data brokers and people-search sites, monitors for re-listing so brokers cannot silently republish your data, and adds 24/7 dark web monitoring so leaked records surface immediately. Family plans cover up to 5 people starting at $8.33/month. When federal regulators step back, you still have a way to shrink your data broker footprint — without spending weekends filling out removal forms.
Frequently Asked Questions
Did the CFPB pass its data broker rule?
No. The CFPB withdrew the proposed rule on May 15, 2025 (published in the Federal Register that day, filed May 14). The rule — which would have brought data brokers under the Fair Credit Reporting Act — was never finalized and is not in effect in 2026.
Why did the CFPB withdraw the data broker rule?
The Bureau said rulemaking was “not necessary or appropriate at this time” and cited new agency policies plus industry comments arguing the proposal exceeded the CFPB’s statutory authority under the FCRA. The Small Business Administration’s Office of Advocacy formally requested the withdrawal in April 2025.
What law regulates data brokers in 2026 without the CFPB rule?
Federally, the FTC Act (Section 5) still lets the FTC bring individual enforcement actions, and the FCRA still covers traditional credit reporting agencies. There is no comprehensive federal data broker law. In practice, state privacy laws — especially California’s CCPA/CPRA/Delete Act, Virginia’s VCDPA, Colorado’s CPA, Connecticut’s CTDPA, and more than a dozen others — are doing the regulating.
Can data brokers still sell my Social Security Number and income data?
Under federal law, largely yes — the exact restrictions depend on which broker and what data. The CFPB rule would have added FCRA-style consent and dispute rights to those transfers, but that never took effect. Under state privacy laws you can request deletion, and you can dispute inaccurate records with credit reporting agencies under the existing FCRA.
Will the CFPB data broker rule ever come back?
Possibly. Withdrawal is not repeal — a future CFPB leadership could restart the rulemaking process. Congress could also legislate directly (the American Privacy Rights Act has been proposed in multiple forms), and state-level pressure keeps building. But there is no active federal rulemaking to bring data brokers under FCRA-style rules as of 2026.
Is there a service that removes my data from brokers without waiting for federal action?
Yes — PrivacyOn is our top recommendation. Rather than waiting for a federal consent rule that keeps getting withdrawn, PrivacyOn actively submits opt-out requests to 100+ data brokers on your behalf, monitors for re-listing, and adds 24/7 dark web monitoring, all from $8.33/month with family plans for up to 5. Run a free scan first to see where your data is currently exposed.