New State Laws and the Fight for Consumer Privacy: Insights from the CFPB Report

The Consumer Financial Protection Bureau (CFPB) has published a pivotal report highlighting the evolving dynamics of consumer financial data privacy. The report underscores that, while state privacy laws are empowering consumers, significant gaps persist in federal protections. It notes that many state laws exempt financial institutions and consumer financial data already covered by federal regulations, despite states having the authority to establish stricter standards. Consequently, financial data privacy often lags behind protections in other sectors. Furthermore, the report questions whether existing safeguards are adequate, given the increasing trend of financial institutions monetizing consumer data through advertising and marketing ventures.

Key Findings of the Report:

• Financial institutions are increasingly building business models around consumer data, using it as a key revenue source. These firms collect various forms of financial data, including information consumers disclose, such as income, expenses, and account balances. Additionally, financial institutions gather data from third-party services, such as credit scores and web browsing histories tracked through technologies like cookies and pixels. Beyond this, insights into consumer behavior, such as spending patterns and product usage, are also valuable. This growing wealth of financial data is being used for purposes far beyond traditional banking, enabling new business models and revenue streams.
• Consumers highly value their financial data and are particularly concerned about their privacy. This concern has prompted consumer advocates and lawmakers to question how financial institutions use the information they collect. Many institutions are sharing deidentified data with advertisers or hiring companies skilled in leveraging data to maximize the value of their own data sets. Additionally, some are developing new products and services that rely on consumer information. However, current federal privacy protections for financial data have clear limitations and may not shield consumers from the increasingly novel and pervasive methods financial institutions are using to collect and monetize data.
• Recent state laws have granted consumers new privacy rights, including the ability to know what data businesses hold, correct inaccuracies, transfer data to other businesses, or request its deletion. Data from January 2018 shows that eighteen states passed new consumer data privacy laws, providing important protections, often for the first time. These laws regulate the collection of personal data and impose obligations on businesses that handle it. Businesses are required to inform consumers of their rights and assess their cybersecurity measures, but these laws do not apply to publicly available or deidentified data that cannot be traced back to individuals.
• State policymakers should examine gaps in existing data privacy laws to provide comprehensive protections for their citizens. Current exemptions prevent consumers in states with new privacy laws from accessing the same rights they enjoy in other areas of their economic lives, particularly regarding financial data collected or shared by exempted institutions. Federal law offers opportunities for states to establish stronger protections. Policymakers should craft state laws that address the shortcomings of federal regulations, ensuring robust privacy rights for all consumers.

As states enact new consumer privacy laws, the CFPB’s report highlights the ongoing challenges and opportunities in protecting consumer financial data. It emphasizes the need for a stronger framework that empowers consumers while holding financial institutions accountable for their data practices. The interaction between state and federal laws will be pivotal in ensuring consumer privacy remains a priority in an increasingly data-driven economy.

Discover the latest developments in consumer finance at our webcast: Consumer Finance 2025: Managing Risks and Opportunities in a Shifting Landscape