This week, the Consumer Financial Protection Bureau (CFPB) announced its intent to regulate data brokers and bring them into compliance with the Fair Credit Reporting Act. Under the proposed rule, data brokers would be restricted from selling personal and financial information about American consumers, specifically information about income, credit history, credit scores, and debt repayment.

As reported by The Verge, the rule would require data brokers to comply with the FCRA, just as credit bureaus and background check companies must comply, and would limit their ability to obtain and use information about consumers. Data brokers would be required to obtain explicit consent for data sharing, in effect forcing them to obtain explicit permission to sell consumers' sensitive personal financial information.

CFPB Director Rohit Chopra directly referenced the massive national data breach that occurred earlier this year, in which over 200 million Social Security numbers were leaked and sold on the dark web. Director Chopra noted that because “data brokers [organizations that collect and sell detailed information about our personal and financial lives] make this data available to anyone who is willing to pay a price,” the threat actors have no way to obtain Americans' most sensitive data. He noted that there is no need to hack.

The CFPB's proposed regulations are aimed at private companies, not government operations, and a CFPB spokesperson said the agency is working to ensure that government agencies have adequate access to the information they need to conduct their business The CFPB will accept comments on the proposed rule until March 3, 2025, but However, a future change in administration could change the agency or its focus before this deadline.

With regard to data brokers and people-finding services, the difference between winning and losing is how much time you spend or whether you hire a service to do some of the work on your behalf. Realistically, some of your information will be available somewhere for a price. Your goal is to reduce it as much as possible, and your options are to do it manually or subscribe to a service that will do it for you.

Public sources already share information such as property records, court filings, voter registration, and birth, marriage, and death records. Data brokers pull information from social media, but much of that data comes from public records and is not something you can control. In other words, a realistic strategy is not to prevent data brokers from getting your information, but to prevent them from keeping it.

There are few laws restricting data brokers from buying and selling your information, and they usually apply very narrowly. California has responded to requests for companies not to post information about registered victims of domestic violence, stalking, and sexual assault. The FTC also recently prohibited certain data brokers (Mobilewalla and Gravy Analytics) from collecting and selling location tracking data linked to specific locations, such as medical facilities, churches, and schools, for public safety reasons.

The Fair Credit Reporting Act already prohibits the use of information from data brokers to screen potential employees, tenants, and insurance customers, but allows anyone to escape tracking by data brokers No such thing as a registry exists. In order to be deleted from the data broker's database, one must fill out an online form or use the mail (and sometimes fax).

Subscription-based privacy services such as DeleteMe and Privacy Duck will do this for you by submitting your information to dozens of data brokers at once for an annual fee. But there is also Surfshark's Icogni, a VPN provider. This one we rated highly in our review for its ease of setup and regular updates on the progress of data deletion.

When we tried this process, we recognized that it would not produce perfect results. Rather than reducing overall risk, it meant that some brokers would have to continue to collect new data or run some opt-out processes multiple times. This makes the subscription model particularly attractive over the DIY approach, which is incredibly time consuming.

To get started on your own, you want to start by searching for your name, phone number, email address, and mailing address and see what results come up. Just to be safe, it's not a bad idea to search for your own name and “address” or your own name and “phone number.”

Then you can try looking for your information on data broker sites (Spokeo, Intelius, Whitepages, etc.) to see what information they have and how accurate it is for you. You can also do a Google search on yourself or a Google image search and see what comes up. Data brokers have been free to collect Americans' personal data for years now, but their efforts will be greatly curtailed if this new rule is passed. Data brokers have been free to collect Americans' personal data for years, but if this new rule is passed, their efforts will be greatly curtailed.