In a letter to Consumer Financial Protection Bureau (CFPB) acting director Russel Vought, Sen. Ruben Gallego (D-Ariz.) urged the bureau to reconsider the withdrawal of a rule that would have prevented private, personal data from being collected and sold without the consumer’s consent.

The proposed rule “Protecting Americans from Harmful Data Practices” was issued in December 2024 by former CFPB Director Rohit Chopra and would have clarified that data brokers were subject to the Fair Credit Reporting Act (FCRA), meaning they had to obtain consumer content before selling or sharing sensitive private data including financial information, Social Security numbers, income data and health history.

“Instead of moving forward with this urgently needed consumer protection, the bureau quietly withdrew the proposal by notice in the Federal Register, stating that it is no longer ‘necessary or appropriate’ under the bureau’s current interpretation of the FCRA,” Gallego wrote. “This decision came despite receiving more than 600 public comments on the rule — many from experts, advocates, and everyday Americans urging the bureau to rein in a predatory and opaque industry.”

He called the rule withdrawal “deeply troubling,” pointing out data brokers are making personal and private information available for sale, “exposing individuals to scams, surveillance, threats, and reputational harm at the hands of bad actors.”

Gallego cited examples, including one data broker who provided data on 30 million people to entities later indicted for fraud and a company that admitted its role in a senior-targeted scam that led to $9.5 million in losses.

He also expressed concern that the rule’s withdrawal comes while the CFPB’s capacity to protect consumers has been radically diminished, as 1,400 CFPB employees were terminated last month, leaving the agency with 300 staff members.

“The CFPB was created to serve as an independent watchdog for the American consumer. Backing away from oversight of data brokers — especially while the public remains in the dark about how their information is being used — abandons that mission,” Gallego wrote.

“I urge you to reconsider the withdrawal of this rule and to recommit to the bureau’s foundational mission. The American people cannot afford a regulatory vacuum that allows private actors to exploit their data with impunity. If the bureau will not act, Congress must.”