CFPB Issues Request For Information Regarding The Collection, Use And Monetization Of Consumer Payment And Personal Financial Data

On Jan. 10, 2025, the Consumer Financial Protection Bureau ("CFPB") issued a notice and request for information ("RFI") regarding the collection, use, sharing and protection of consumer financial data by companies offering or providing consumer financial products or services, such as data obtained from payments.¹ The CFPB is requesting public input on the nature and impact of these data collection practices in relation to existing privacy laws, specifically the Gramm-Leach-Bliley Act ("GLBA") and its implementing Regulation P.²

Background

Enacted in 1999, the GLBA includes several privacy provisions designed to protect consumers' nonpublic personal information, including provisions that restrict the disclosure of such information to nonaffiliated third parties and limit its further use and disclosure by downstream recipients of such data.³ These privacy provisions apply to "financial institutions", which is broadly defined to include most companies engaged in