A federal proposal that could have expanded credit-reporting protections to some data brokers is no longer moving forward. The Consumer Financial Protection Bureau (CFPB) withdrew it in May 2025. As of June 12, 2026, the proposed expansion is not in effect, though existing federal and state rules still apply in some circumstances.

  1. December 13, 2024: The CFPB published a proposal called Protecting Americans from Harmful Data Broker Practices. It would have brought some data brokers under the Fair Credit Reporting Act, or FCRA.
  2. Public comments: The agency extended the comment period. One account says it ran through April 2, 2025, and reports that the CFPB received more than 600 comments.
  3. May 2025: The CFPB withdrew the proposal. The withdrawal notice appeared in the Federal Register on May 15, 2025, although some reporting describes a May 14 filing.
Folded paper document and reading glasses on a worn wooden desk in soft side light, suggesting a quiet review of a withdrawn federal proposal.
The CFPB withdrew the proposed expansion before it took effect.
  1. What did not happen: The proposal did not make data brokers subject to the proposed new FCRA requirements.
  2. What remains: The FCRA still applies to consumer reporting agencies and activities covered by the law’s existing definitions.
  3. What is unsettled: A company’s legal status depends on what it does and how the law applies, not just on whether it calls itself a data broker.

What the CFPB proposed and why it mattered

A data broker collects or combines personal information and sells or shares it with others. The CFPB’s proposal would have treated certain brokers as consumer reporting agencies under the FCRA when they sold sensitive information for specified purposes. The law already governs companies that compile and sell consumer reports, but the proposal sought to clarify how its protections could reach some data broker activity.

The information at issue could include income, credit history, debt-payment details, Social Security numbers, and “credit header” data. That term generally refers to identifying details drawn from credit files, such as a person’s name, address, date of birth, and Social Security number. The proposal would have required covered businesses to follow FCRA rules, including limits on who could receive the data and for what permitted purposes. It also would have added requirements for handling consumer disputes. A summary of the proposal and withdrawal is available from Consumer Financial Services Law Monitor.

The distinction matters in an ordinary household context. A credit report used in a lending decision is not the same thing as a list of names, addresses, and other identifying details sold for another purpose. The proposal was meant to address some information flows that, according to the CFPB’s approach, could fall outside the established protections consumers associate with credit reporting.

What the withdrawal changed

The CFPB said rulemaking was “not necessary or appropriate at this time” and that it would take no further action on this proposal. It also left open the possibility of revisiting the subject. If the agency decides to pursue a new rule, it said it would propose one and seek public comment. The withdrawal therefore ended this particular proposal, rather than settling every question about data brokers and consumer reporting.

The agency also withdrew several FCRA-related guidance documents. Guidance describes how an agency interprets a law; it is not the law itself. Its withdrawal does not erase the FCRA or cancel protections the statute already provides. For the notice’s publication date and details, readers can consult the Federal Register and CFPB materials directly. A legal summary of the withdrawal is also available from Foley & Lardner.

How the existing law still applies

The FCRA continues to govern traditional consumer reporting agencies and the activities included in its definitions. The withdrawn proposal would have expanded the agency’s intended reach to some data brokers, but that expansion never took effect. A people-search website, data broker, or identity-verification vendor cannot be confidently classified just by its label. Whether the FCRA applies depends on the company’s activities and the statute’s current definitions, assessed case by case.

Credit header data is one reason the boundary can be hard to see. Industry has generally treated identifying details drawn from credit files as outside the FCRA when they are sold separately from a full credit report. That treatment can mean those details are not subject to the same permissible-purpose limits that apply to a report covered by the law. The proposed rule aimed to change how certain sales of sensitive information were treated, but its withdrawal left the existing framework in place.

State rules and the federal policy debate

Federal requirements did not all disappear with the CFPB proposal. The Federal Trade Commission’s requirements remain, and data broker laws cited as still in effect include laws in California, Oregon, Texas, and Vermont. The rules differ, and which ones apply can depend on where a person lives and what a company does. The sources available for this article do not spell out each state law’s requirements, so readers seeking details should check official state sources.

The policy debate also remains open. Consumer advocates warn that markets for sensitive personal information can expose people to misuse, including fraud and stalking. Industry groups have argued that tighter limits could make fraud prevention and law enforcement harder. Those competing concerns were part of the public debate over the proposal. The CFPB’s withdrawal means this rule did not resolve them.

What consumers can and cannot infer

The withdrawal does not establish that every data broker is free from privacy rules, nor does it establish that every broker is covered by the FCRA. It also does not, on the information reviewed here, explain how to find out whether a particular broker holds someone’s information or how to request access or deletion. Those procedures can vary. Official regulator and company privacy pages are the appropriate places to check for current processes.

The available sources do not establish a change to credit scores, credit reports, or the consumer-facing services of the major credit bureaus. Readers should not infer a score effect from the rule’s withdrawal alone. The agency said it could revisit the topic, but this article’s sources do not confirm a later federal action. For an individual situation, check current CFPB and Federal Register materials, state requirements, or consult a qualified professional. This article is educational and is not legal, financial, or tax advice.

Please seek a professional. This article is general information, not financial, tax or insurance advice. Please seek a licensed financial, tax or insurance professional about your own situation.