The CFPB’s data broker proposal exposed a provenance gap that AI programs inherit

The week

On December 3, 2024, the Consumer Financial Protection Bureau, the federal agency that oversees consumer financial products, proposed to bring many data brokers under one of the oldest consumer protection laws in the country. Data brokers are businesses that collect personal information from public records, purchases, apps and other companies, stitch it into profiles and sell it. Most people have never heard of the companies that know their income bracket, their old addresses and their date of birth.

The idea had been in preparation for more than a year. In September 2023, under Director Rohit Chopra, the Bureau published an outline of the proposals it was considering, the first step in the small-business review that federal law requires before certain rules. The December proposal was published in the Federal Register on December 13, with comments due by March 3, 2025. That timetable meant any final rule would fall to the next administration.

That law is the Fair Credit Reporting Act, or FCRA. It governs consumer reporting agencies, the best known of which are the big credit bureaus. When a lender, insurer or employer uses a report about you to make a decision, the FCRA requires that the buyer have a “permissible purpose.” The information must be reasonably accurate, and you must be told if it counts against you. It is, in effect, the rulebook for anyone who sells a file on you that others use to judge you.

The proposed rule would have treated companies that sell certain personal information, such as income or financial tier, as consumer reporting agencies regardless of how the buyer used the data. The label would attach to the kind of data being sold, whatever decision it fed.

The text named the categories directly. A broker that sold information about a consumer’s credit history, credit score, debt payments, or income or financial tier would generally be treated as selling a consumer report. That would hold regardless of the purpose for which any specific sale was used. The proposal also said that an entity “assembles or evaluates” information about consumers in ways that make it a consumer reporting agency, and it addressed re-identification of supposedly de-identified data.

Several narrower provisions mattered as much to buyers. The proposal would have made clear that the “legitimate business need” permissible purpose does not cover marketing. It would have required that a consumer’s written authorization for a report be given on a separate signed form that states why the report is wanted, rather than buried in fine print. It also treated a consumer reporting agency as furnishing a report when it lets a client use the information for gain, even without handing over the file.

It also proposed treating “credit header” information held by the credit bureaus as part of a consumer report. The credit header is the identifying block at the top of a credit file. That covers identifiers such as names, addresses, birth dates and Social Security numbers, which could then not be sold without a permissible purpose. For years, that header data had circulated more freely than the credit history beneath it.

The Bureau framed the proposal around privacy, national security and the protection of groups such as domestic violence survivors and military personnel. For these people, a findable home address or a purchasable profile can be a matter of physical safety or security. It followed a year of public concern about brokers, including the National Public Data breach in August.

The proposal described the national security concern in concrete terms. It said countries of concern could obtain financial information about active military members, and that stalkers and abusers could use broker data to locate people, including domestic violence survivors. It also noted, in passing, that brokers may use the data they collect to train machine learning systems.

The CFPB was not acting alone that week. On the same day, December 3, the Federal Trade Commission announced proposed orders against two location data brokers, Gravy Analytics and Mobilewalla, over the collection and sale of sensitive location information. Earlier in 2024, a February executive order had directed the Justice Department to restrict bulk transfers of Americans’ sensitive data to countries of concern. A new federal law barring data brokers from selling sensitive data to foreign adversaries had been in force since June. The Justice Department had issued its proposed rule under the executive order in October and would finalize it before the year ended.

The proposal itself would not last. But it put a sharp question on the table for every organization that buys, shares or reuses personal data. That question has only grown more pressing as those same organizations pour data into artificial intelligence.

Read together, these actions came at the same problem from different directions. The CFPB’s proposal attached duties to certain kinds of data. The FTC’s orders attached them to certain sources and uses. The national security measures attached them to certain destinations. For an organization that buys or shares personal data, each one asked a version of the same thing: whether it knew where the data had been and where it was going.

Suppose a compliance officer at a mid-sized lender faces an exam question about a model that helps decide which applicants get a call back. What data was this built on, and were you allowed to use it that way? The data science team knows which tables they pulled. Procurement knows which vendors were paid. Legal knows what the contracts say. Nobody knows all three at once, and nobody can answer quickly.

That scene is the real subject of this article. The proposal was ambitious and, as it turned out, short-lived. Its core question outlasted it: whether, for any piece of personal data it uses, an organization can say where the data came from and what it may be used for. That question had always applied to marketing and underwriting files. By late 2024 it applied with more force to AI programs. They combine data from many sources and keep copies in training sets and vector stores. They also use it for purposes no one had in mind when it was collected.

What “provenance” means, and why AI makes it harder

Provenance is a word borrowed from the art world, where it means the documented history of a painting: who owned it, when and how it changed hands. For data, it means the same thing: where a record came from, under what promise or license it was collected, who has handled it since and what the organization may do with it now.

In a traditional business system, provenance is fairly easy to follow. A customer fills in a form, the data sits in a database, and it is used for the purpose stated on the form. AI programs break that tidy picture in three ways.

• They mix sources. A model may be built from internal records, purchased datasets and data shared by partners, all blended together.
• They keep copies. Training is the process of showing a model many examples so it learns patterns; the examples are gathered into a training set, which is a copy that can outlive the original. Fine-tuning is additional training on a smaller, specialized set to adapt a general model to a particular task. A vector store is a kind of searchable index that holds documents converted into numerical form so an AI system can find relevant passages by meaning rather than by keyword.
• They create new uses. Data gathered to send a statement or process a claim may later be used to train a model that predicts something quite different.

Each of those is a place where the original permissions can be lost. A restaurant kitchen works the same way. Cooks who know where every ingredient came from and what it can safely be used in can handle an allergy question or a recall in minutes. Once ingredients have been decanted into unlabeled containers and mixed into sauces, they cannot.

Personal data moves relative to an organization in three ways. It enters, through purchase or licensing. It leaves, through sharing and sale. And it is repurposed inside, when data collected for one use is reused for another, including model training and retrieval. Every provenance question falls into one of these three, and each has a different owner: procurement for inbound data, privacy and legal for outbound, and data and AI teams for repurposing.

Lineage is not the same as permission

Many organizations already run data catalogs and lineage tools. They record that a column in one table was copied into another, transformed and loaded into a model’s feature store. That is technical lineage, and it is useful. It does not record the terms under which the data was obtained or the purposes for which it may be used. A lineage graph can show that a purchased income field fed a credit model without showing that the license said “marketing only.”

Closing that gap means attaching permissions to data as metadata, at the point of entry, and carrying them through each transformation. A dataset tagged “licensed for direct marketing; no eligibility use; no model training” can be blocked automatically from a training pipeline. A dataset with no tag should be treated as untrusted until someone supplies one. The engineering is modest. The hard part is getting procurement and legal to express contract terms in a form systems can read.

Copies that do not look like copies

AI systems also create derived forms of data that are easy to overlook. An embedding, the numerical form stored in a vector store, looks like a list of numbers rather than a name and address. Academic research has shown that text can often be substantially reconstructed from its embeddings, so they should be treated as personal data where the source was. Large language models can also memorize and repeat fragments of their training data, a behavior researchers have demonstrated repeatedly since at least 2021.

The consequence is that provenance has to follow derived artifacts as well as source files. Some data inventories list the customer database but not the vector index built from its documents, or the fine-tuned model trained on its call notes. Those inventories are missing the copies most likely to escape ordinary controls.

Data that enters: knowing what you bought

Banks buy data for marketing, fraud prevention, identity verification and underwriting. Health systems buy it for population health, outreach and patient matching. Agencies buy it for investigations, eligibility checks and analysis. Much of it comes from brokers that assemble records from many sources.

The FCRA already applies when data is used for eligibility decisions about credit, insurance, employment and certain other purposes. Those uses bring duties: permissible purpose, adverse action notices and reasonable accuracy procedures. An adverse action notice is the letter that tells someone they were turned down, or offered worse terms, partly because of information in a report, and how to dispute it. The proposal would have widened the set of regulated data.

Even without it, an organization should keep a register of purchased datasets that records the vendor, the license terms, the intended use and whether the data feeds any decision about an individual. Where it does, the organization should know whether the vendor acts as a consumer reporting agency. Public agencies face an additional question: whether buying data lets them obtain what they could not lawfully collect directly. Counsel should review those purchases.

Vendor diligence for data brokers differs from diligence for software. The key questions are how the broker sourced each field, whether the original data subjects were told it could be sold, how often records are refreshed and how errors are corrected. A broker that cannot describe its sources for a field is asking the buyer to accept that field’s legal and accuracy risk.

Consider a regional bank that buys an “estimated household income” field to target credit card offers. The marketing team sees a useful number. But if that same field later finds its way into a model that decides credit limits, the bank has moved from marketing into an eligibility decision, with all the FCRA duties that follow. Whether the broker’s estimate is accurate, how it was derived and whether consumers can correct it suddenly matter a great deal.

The FTC orders announced the same day as the CFPB proposal point at the same intake risk from another angle. They concerned brokers that collected and sold location data capable of revealing visits to sensitive places, such as medical facilities and places of worship. A bank, insurer or agency buying location-derived attributes from any broker inherits the question of how that data was gathered and whether the people it describes ever agreed to its sale.

What the proposal would have changed for buyers

The proposal’s practical effect would have landed on purchasers. If a broker selling income tiers became a consumer reporting agency, buyers would have needed a permissible purpose for every purchase and would have had to certify it. Marketing alone would not qualify. The FCRA does allow prescreening, in which lenders and insurers use credit data to select people for a firm offer of credit or insurance. That route carries its own conditions, including the firm offer itself and an opt-out notice.

For a bank or credit union, much of that machinery already existed in its card and lending marketing, so the change would have been about scope. For a health system, it would have reached revenue-cycle tools that estimate a patient’s ability or propensity to pay, some of which draw on credit data, and financial-assistance screening. For a public agency, it would have reached vendors that sell location and identity data used in investigations and fraud checks. Each would have needed to reexamine purchases it had treated as routine.

Public agencies buy what they cannot collect

Government buyers face a distinct issue. Agencies have bought commercially available data, including location data, that they might need legal process to obtain directly. A report to the Director of National Intelligence, declassified in 2023, described how much sensitive information about Americans the intelligence community could obtain this way. In 2024 the House passed a bill to restrict law enforcement purchases, which did not become law. State and local agencies buying data for fraud detection or investigations should have counsel review both the legal basis and the vendor’s sourcing.

Contract terms that carry provenance

The purchase contract is where provenance is cheapest to capture. Useful terms include a representation that the broker obtained each data element lawfully and gave any required notice, and a permitted-use clause that names model training explicitly, either allowing or excluding it. Add a duty to deliver suppression and deletion files when consumers opt out, a statement of refresh frequency and accuracy procedures, and an indemnity tied to sourcing failures. Few brokers will accept all of these, and the ones that refuse tell the buyer something useful about the data.

Data that leaves: knowing where it goes next

Financial institutions share data with affiliates and partners under Gramm-Leach-Bliley rules, the federal framework that governs how financial firms protect and share customer information. Health systems share it under HIPAA, the federal health privacy law, for treatment, payment and operations, and with business associates, the contractors that handle patient data on their behalf.

Many organizations also send data to advertising and analytics providers through website and app tracking tools. These are small pieces of code, sometimes called pixels or tags, that a marketing team adds to a web page so it can measure visits and target ads. They can send details such as a visitor’s identifiers and the pages they viewed to an outside company. In 2023 and 2024 the FTC and HHS brought actions and issued guidance on exactly that kind of leakage.

The outbound questions are what leaves, to whom and under what restrictions. Contracts with recipients should prohibit onward sale and reuse beyond the stated purpose, with audit rights to check. Tracking technologies on public pages should be inventoried, because they can transmit identifiers and browsing data without any contract at all. A simple test is uncomfortable but useful: could your own customers’ or patients’ data reappear in a broker’s dataset? If the answer is unclear, the outbound controls are incomplete.

Take a hospital system whose appointment booking page includes an analytics tag that the web team installed years ago. Every time a patient books with a particular specialist, the tag may transmit enough information for an outside company to infer something about that patient’s health. No one signed a data sharing agreement. No one thinks of it as “sharing.” Yet from the patient’s point of view, and potentially a regulator’s, the data has left the building.

Destination as a test of its own

The national security measures of 2024 added a question most outbound reviews had never asked: where, in the end, the recipient is. The Justice Department rule finalized at the end of that year prohibits data brokerage transactions involving bulk sensitive personal data with countries of concern and people tied to them. It restricts vendor, employment and investment arrangements that would give them access. A bank or health system that has never sold data can still be caught through an offshore software developer, a data annotation contractor or a cloud support arrangement.

That turns a contract question into a diligence question. Organizations need to know the ownership and location of the vendors and subcontractors that touch bulk personal data, including the firms that label training data or host model operations. Many vendor files record a headquarters address and little more. The rule’s categories, which include precise geolocation, health, financial and biometric data and certain government-related data, give a useful starting list for where to look first.

Outbound rules differ by sector

The rules for data leaving an organization vary more than those for data coming in. Banks and credit unions follow the Gramm-Leach-Bliley privacy rules, which require privacy notices and, for most sharing with nonaffiliated third parties, an opportunity to opt out. Health care providers and plans face HIPAA, which generally requires a patient’s authorization for marketing uses and for the sale of protected health information. Substance use disorder records held by federally assisted programs carry stricter rules under the regulation known as Part 2.

Agencies are bound by the Privacy Act of 1974 at the federal level, which limits disclosures to published routine uses and governs computer matching between agencies. States hold motor vehicle records under the Driver’s Privacy Protection Act, which permits some disclosures and has made state motor vehicle departments a significant upstream source of commercial data. An agency head who thinks the agency does not “sell” data should check what its motor vehicle, licensing and court record systems release in bulk.

Tracking tags and AI vendors as outbound channels

The legal ground on tracking technologies shifted during 2024. HHS had issued guidance in late 2022, updated in March 2024, on the use of tracking technologies by HIPAA-regulated entities. In June 2024, a federal court in Texas vacated part of that guidance, the portion dealing with certain unauthenticated public web pages. The FTC’s actions against GoodRx and BetterHelp in 2023, under its own authority, showed that health data leaving through advertising tools could bring enforcement outside HIPAA as well.

AI services have created a newer outbound channel. When staff paste a member’s file into a hosted AI assistant, or an application sends customer records to a model provider through an interface, personal data leaves the organization. The contract with that provider should state whether inputs are retained, whether they can be used to train the provider’s models, where they are processed and how long logs are kept. Those answers belong in the same register as tracking tags and data sharing agreements.

Data repurposed inside: knowing what models were built on

The third movement is the newest and the least governed. Models are trained, fine-tuned and evaluated on data, and retrieval systems pull documents into model prompts at runtime. Retrieval here means the AI assistant looks things up in the organization’s own documents while answering a question, then uses what it found to compose a reply. Each use can involve personal data from purchased, shared or internal sources, collected under terms that never contemplated AI.

Provenance matters here for legal and technical reasons. Legally, a license for purchased data may not permit model training. Data collected under a specific consent, such as a research authorization, may not extend to building a commercial model. Technically, data of unknown origin can carry errors and bias that are hard to detect once embedded in a model. Once a model has learned from data, you cannot simply pull one ingredient back out of the sauce.

The control is a training data record for each model: the datasets used, their sources, the permissions attached, sensitive categories present and the date of each version. Model risk management teams in banks will recognize it as documentation they already expect for traditional models. Model risk management is the discipline, long established in banking, of checking that statistical models are built soundly, used as intended and monitored over time.

Retrieval needs the same discipline at runtime. A model that can search a document store can surface personal data to users who would not otherwise have access, or combine sources in ways the original permissions did not allow. Access controls on the underlying documents must carry through to what the model can retrieve. Deletion must carry through too. When a consumer exercises a deletion right, the request should reach vector stores and fine-tuning sets as well as the system of record, meaning the main database that is treated as the official source.

Say an insurer has an internal assistant that answers staff questions by searching shared folders. A claims handler asks about a policy and receives a helpful answer that quotes, in passing, from a medical report in a folder the handler could never open directly. The assistant did nothing malicious. It simply was not told to respect the folder’s permissions.

Regulators have ordered models destroyed

Repurposing has a remedy that ordinary data misuse does not. The FTC has, in several orders, required companies to delete models and algorithms developed from data they were not entitled to use. Its 2021 settlement with Everalbum, a photo app, required deletion of facial recognition models built from users’ photos. Its 2022 settlement over the WW (Weight Watchers) Kurbo app required deletion of algorithms built on children’s data. Its December 2023 order against Rite Aid barred the company from using facial recognition for surveillance for five years.

That shifts the economics. If a model is built partly on data the organization had no right to use for training, the exposure can include the model and everything built on it, on top of any fine. A training data record is what lets an organization show which models are clean and isolate the ones that are not.

How the rules differ by sector

Banks already have a framework that reaches this question. Supervisory guidance on model risk management, issued by the Federal Reserve and OCC in 2011, expects documentation of data sources and their suitability. Lenders also face adverse action duties under the Equal Credit Opportunity Act. The CFPB said in circulars in 2022 and 2023 that using complex algorithms does not excuse a creditor from giving specific, accurate reasons for a denial. A lender that cannot explain which inputs drove a decision cannot meet that duty.

Health systems work under different terms. HIPAA allows covered entities to use protected health information for health care operations, which can include some internal analytics. Research uses generally need an authorization, a waiver from an institutional review board or privacy board, or properly de-identified data. A model built for a research project and later deployed in operations has changed purpose, and the authorization behind it may not stretch that far.

Federal agencies have the Privacy Act’s purpose limits and OMB guidance, issued in 2024 and revised in 2025, that requires them to inventory AI use cases and apply extra safeguards to higher-risk ones. State and local agencies have a patchwork of state laws and their own data-sharing agreements, many of which predate AI and say nothing about model training.

Deletion is cheap in retrieval and expensive in training

The architecture choice matters for provenance. In a retrieval system, deleting a person’s documents from the index removes them from future answers within hours. In a fine-tuned model, the person’s data has shaped the weights, and removing its influence generally means retraining. Techniques for “machine unlearning” exist in research but are not a reliable compliance process.

That suggests a design rule. Personal data that may be subject to deletion requests, consent withdrawal or license expiry should reach models through retrieval rather than training wherever the use case allows. Where training on personal data is necessary, training sets should be versioned and retrained on a schedule, so that deletions take effect at the next version rather than never.

One purchased list, followed all the way

Follow a single piece of data on its journey. Take a credit union and a purchased list of “likely new movers” with names, new addresses and estimated income bands.

Entering. The credit union’s marketing team buys the list to send welcome offers to people who have just moved into its area. Procurement signs the license, which permits direct marketing. Nobody records where the broker got the income bands, or whether the people on the list were ever told their details might be sold. At this point the risk is modest, because the use is modest.

Repurposed. A year later, its data team builds a model to predict which members are likely to fall behind on loan payments. Looking for useful signals, an analyst finds the movers list in a shared folder and adds the income band as an input. The model performs a little better in testing and goes live. Now a purchased marketing field is influencing decisions about real members’ credit. The license may not allow this. The broker’s estimate may be wrong for many people. And if a member is treated less favorably partly because of that field, the credit union may owe that member an explanation it cannot easily give.

Leaving. Meanwhile, the credit union’s website uses an analytics tag on its loan application pages. When members who arrived through the welcome campaign apply for a loan, the tag sends identifiers and page details to an advertising platform. The data that came in from a broker is, in a sense, flowing back out into the wider data economy.

Deleted, or not. Finally, a member asks the credit union to delete their data. Customer service removes them from the main member database. Their record remains in the movers list, in the training set behind the payment model and in whatever the advertising platform collected.

No single person at the credit union acted badly. Each step was reasonable on its own. The problem is that nobody could see the whole path. A register could have caught each step as it happened. It would have recorded the license at purchase, flagged the field when it entered a decision model, listed the tracking tag and routed deletions to every copy. It would have cost very little compared with untangling it afterward.

What the register entry would have said

The fix in that story is not elaborate. At purchase, the entry would record the broker, the contract reference, the fields bought, the permitted use (“direct marketing to new movers”), the exclusions (“no eligibility decisions, no model training”) and an expiry date. When the analyst added the income band to the payment model, the training data record would have required a source and a permission for each input, and the mismatch would have surfaced before launch.

The tracking tag would appear in a separate inventory owned by privacy, with a note of what it transmits and to whom. The deletion workflow would read the register to find every system holding the member’s data, including the movers list and the training set, rather than relying on customer service to know where to look. Each control is ordinary. What makes them work is that they share one register and one set of identifiers.

Housekeeping with a price tag

For a senior leader, provenance can sound like housekeeping. It is closer to a balance sheet item.

• Legal exposure. Using data outside its license or consent can breach contracts and privacy laws. Feeding unvetted data into eligibility decisions can bring FCRA duties the organization did not plan for.
• Cost of change. Rules about personal data change often, at federal and state levels. An organization that can already trace its data adapts cheaply. One that cannot pays for a fresh discovery exercise each time.
• Model quality. Data of unknown origin is data of unknown accuracy. Models built on it can be wrong in ways that are expensive to discover after launch.
• Trust. Customers, patients and citizens react strongly when they learn their data went somewhere they did not expect. Groups such as domestic violence survivors and military personnel, highlighted in the proposal, show that the harm can be physical as well as reputational.

Accuracy carries its own price. When a purchased field is wrong, the cost shows up as disputes, complaints, mistaken denials and the staff time needed to fix them. Under the FCRA, consumers can dispute inaccurate information in a consumer report, and the agency must investigate. Data that never passed through that machinery has no such correction route. Errors in it persist until someone notices the damage they do.

The case against investing in provenance

The strongest objection is cost. Full provenance for every personal data element in a large bank or health system is not achievable, and attempts at completeness tend to stall. A second objection is that much broker data comes from public records and lawful commercial sources, so tracing it adds paperwork without reducing much risk. A third is that the federal rule that prompted the concern was withdrawn, so the regulatory pressure eased.

Each objection has force, and each points toward a narrower program rather than none. Provenance work can be tiered: full records for personal data that feeds decisions about individuals, crosses organizational boundaries or trains models, and lighter treatment for internal operational data. Public-record sourcing reduces legal risk but not accuracy risk, and accuracy is what hurts when the data drives a decision. And the withdrawal of one federal proposal left the FCRA itself, state privacy laws, FTC enforcement and contract terms all in place.

A further objection deserves a straight answer. Provenance controls slow down data science, and teams under pressure to deliver AI results will route around them. That risk is real. The response is to make the compliant path the fast one. A catalog of pre-cleared datasets, with their permissions recorded, lets a data scientist start work immediately on data known to be usable. Anything new gets a short, predictable review.

Tracing all three movements

Organizations that manage this well tend to have a few things in place.

• A single register that traces personal data entering, leaving and being repurposed, with a named owner for each movement.
• Purchase records that capture license terms, intended use and whether the data feeds decisions about individuals.
• Sharing contracts that ban onward sale, backed by audit rights and an up-to-date inventory of tracking tools on public pages.
• A training data record for every model, updated with each version.
• Deletion processes that reach copies, including vector stores and fine-tuning sets.

The failures mirror these. Teams assume that because data was paid for, it can be used for anything. Marketing tags are treated as a web design matter rather than a data transfer. AI pilots copy data into experimental environments that never appear in any inventory. Deletion requests are honored in the main database while copies live on in training sets. And each function, procurement, legal and data science, holds one piece of the picture without anyone assembling the whole.

Owners, evidence and sequence

The ownership split works best when each function owns one movement and a single register binds them. Procurement owns intake: no personal data purchase is approved without a register entry. Privacy owns outbound: data sharing agreements, the tracking inventory and AI vendor terms. The model risk or AI governance function owns repurposing: no model goes into production without a training data record. A data governance lead owns the register itself and the identifiers that join the three.

The evidence an examiner or auditor would ask for follows from that. They would want the register itself and a sample of purchases traced to their licenses. They would look for training data records for production models and a tracking inventory with a date of last review. They would test a handful of deletion requests through every system they touched. Simple measures show progress: the share of purchased datasets with recorded permissions, the share of production models with complete training records, and the time taken to complete a deletion across all copies.

The sequence matters. Starting with the models already in production, and tracing their inputs back, finds the highest-risk gaps fastest. Building intake controls for new purchases comes second. A full historical inventory of every dataset ever bought can come last, or not at all, if the forward-looking controls are working.

An organization that can trace data across all three movements can adapt to whichever rule arrives next, federal or state. One that cannot will repeat the same discovery exercise for each new requirement.

The questions below are deliberately addressed to three functions at once. The answers are only useful when they agree.

What to ask procurement, legal and data science

1. Which personal datasets do we buy, from whom, and what are we allowed to do with each?
2. Does any purchased data feed a decision about an individual, such as credit, insurance, employment or eligibility? If so, do we treat it accordingly?
3. What tracking tools run on our public websites and apps, and what do they send, to whom?
4. For each AI model we use or build, can we list the data it was trained on and show we had the right to use it that way?
5. When someone asks us to delete their data, does that request reach every copy, including those used for AI?

With hindsight

The CFPB withdrew the proposal on May 15, 2025, alongside other withdrawals under new leadership, with Russell Vought as acting director. The withdrawal notice said legislative rulemaking was “not necessary or appropriate at this time,” and that the proposal did not align with the Bureau’s current reading of the FCRA. It added that commenters had questioned its statutory authority. The Bureau said it would issue a new proposal if it later decided a rule was needed. The federal effort stopped there; state activity did not.

The withdrawal changed less for buyers of data than it might seem. The FCRA itself was untouched. Data used for credit, insurance or employment decisions still brought the same duties. The question of when a broker becomes a consumer reporting agency remained open for courts and enforcers to address case by case.

Enforcement elsewhere showed the issue was alive. In January 2025, the FTC announced a proposed order against General Motors and OnStar over the collection and sale of drivers’ location and driving behavior data. The order included a five-year ban on sharing it with consumer reporting agencies. The same month, the Texas attorney general sued Allstate and its data subsidiary Arity over driving data gathered through mobile apps. Both cases turned on data collected for one purpose reaching insurance decisions, the repurposing problem in its clearest form.

Under California’s Delete Act, consumers could send one deletion request to all registered data brokers through the state’s DROP platform from January 1, 2026. Brokers had to begin processing those requests on August 1, 2026. For consumers, that turns what used to be an exhausting chore, contacting broker after broker, into a single step. For organizations that buy from brokers, it means the datasets they license may become less complete over time, and records they already hold may no longer match what the broker can lawfully keep.

The mechanics are specific. According to the California Privacy Protection Agency, one request through the platform reaches more than 600 registered data brokers. From August 1, 2026, brokers must access the platform at least once every 45 days and process the deletions it holds. Organizations that license data from brokers should expect suppression and deletion files to become a routine part of the relationship, and should make sure their contracts require them to be passed on.

Other states kept adopting privacy laws that address the sale of personal data. A Justice Department rule restricting bulk transfers of sensitive personal data to countries of concern, finalized in late 2024, took effect in April 2025 and added a national security test to outbound sharing. The rule covers countries of concern including China, Russia, Iran and North Korea, prohibits data brokerage transactions with them, and allows certain vendor, employment and investment agreements only under security requirements. Its due diligence, audit and reporting requirements applied from October 6, 2025. That rule turned a question many firms had treated as commercial, who are we sending this data to, into one with national security consequences.

For organizations, each of these reached a different movement of data, which is the practical case for tracing all three in one register. The California rules bear on data entering from brokers. The Justice Department rule bears on data leaving. And the growing use of AI keeps raising the stakes on data repurposed inside.

What did not happen is also informative. Federal regulation of data brokers through the FCRA stalled, and no comprehensive federal privacy law was enacted. Organizations hoping for one national standard did not get it. The burden of tracing data therefore stayed with each organization, applied against a growing set of state laws, sector rules and contract terms rather than one federal rulebook.

The withdrawn proposal is therefore a useful marker rather than a dead end. Whatever the fate of any single federal rule, the direction of travel has been toward more questions about where personal data comes from and where it goes. Leaders who invest once in being able to answer those questions are spared the cost of scrambling every time a new law, regulator or customer asks.