Federal: AFC Letter to Russell Vought on CFPB Collection Use and Monetization of Consumer Data Request for Information

The Honorable Russell Vought
Acting Director
Consumer Financial Protection Bureau
1700 G Street, NW Washington, DC 20552

Re: Request for Information Regarding the Collection, Use, and Monetization of Consumer Payment and Other Personal Financial Data—CFPB2025-0005

Dear Acting Director Vought,

On behalf of The American Fintech Council (AFC), I am submitting this comment letter in response to the Consumer Financial Protection Bureau’s (CFPB or the Bureau) Request for Information Regarding the Collection, Use, and Monetization of Consumer Payment and Other Personal Financial Data (RFI).  

AFC is the premier trade association representing the largest financial technology (Fintech) companies and innovative banks who power them. Our mission is to promote a transparent, inclusive, and customer-centric financial system by supporting responsible innovation in financial services and encouraging sound public policy. AFC members foster competition in consumer finance and pioneer products to better serve underserved consumer segments and geographies. Our members are lowering the cost of financial transactions, allowing them to help meet demand for high-quality, affordable products.

In principle, AFC supports the goals of the RFI and the underlying U.S. Government Accountability Office (GAO) recommendation that, in part, underlies the RFI.  AFC, and its members strongly support consumers’ rights to make their own choices regarding their data and to grant access to data providers that they deem beneficial. Ensuring the proper data disclosure, either through CFPB’s model privacy form or other means, is critical aspect of the ability for consumers to make their own choices regarding their data. Thus, AFC recognizes the importance in the Bureau engaging in the issues discussed within the RFI.

However, the general tone of the RFI and its questions reveal a potential bias that may negatively impact the form and substance of the responses the Bureau receives related to this RFI. Specifically, the RFI’s Overview section, which details the CFPB’s perspectives on industry activities related to consumer data collection, use, and monetization, relies on limited data that is not generalizable to broader market practices.  Further, the Overview section of the RFI infers how consumer data is being used and makes claims about the data governance practices of firms without sufficient detail.  In contrast to the claims made in the RFI, our members have used consumer-provided and permissioned data to successfully improve access to financial services, particularly to those that have been historically underserved, and increase competition in the financial services industry.  It is with our members’ data collection and use practices in mind, that AFC draws concern with the RFI as written.

Also, the RFI’s questions seem to presume nefarious industry practices, and insufficient consumer protections under the existing Gramm-Leach-Bliley Act (GLBA) consumer data privacy regulatory framework (Regulation P). It is important to remember that the original congressional intent of the CFPB was “to ensure that: 1. consumers have, understand, and can use the information they need to make responsible decisions about consumer financial products or services; 2. consumers are protected from abuse, unfairness, deception, and discrimination; 3. markets for consumer financial products or services operate fairly and efficiently with ample room for sustainable growth and innovation; and 4. traditionally underserved consumers and communities have access to financial services.”  AFC, and its members consistently have engaged with Bureau leadership to explain emerging innovative financial products and services in order to accurately describe the benefits and risks associated with a given product or service, and help to develop a pragmatic regulatory framework that allows for the development of responsible innovation for the benefit of consumers. Any CFPB request for information should be grounded in the original congressional intent of the Bureau. While AFC recognizes the critiques of Regulation P as it relates to consumers’ understanding of data privacy disclosures the Bureau’s presumption of nefarious industry practices, characterization of Regulation P, and leading questions on the matter seem inappropriate for a pragmatic, unbiased request for information that fits within the congressional intent of the Bureau.

Thus, AFC respectfully requests that CFPB carefully and critically evaluate the responses it receives, and, if the Bureau intends to pursue the matters covered in the RFI further, that it do so by re-issuing a request for information that does not contain the potential bias that permeates the current RFI.

Building on AFC’s concerns regarding the potentially biased nature of the RFI, we respectfully request that the Bureau critically evaluate responses it receives to ensure that any actions taken based on RFI responses seek to regulate and reform Regulation P in accordance with actual harms, not potential or perceived harms.

AFC has publicly advocated for standards or clear and consistent regulatory frameworks for innovative financial services and products that avoid duplicative or diverging requirements and accurately reflect the nuances of the innovative service.  Further, AFC consistently advocates for a strong, unified approach to regulation that properly balances consumer protections with innovation that ensures regulators protect against actual, not perceived, harms to consumers.

In the context of modern data collection and usage practices, customers are offered significant benefits, such as the ability to access affordable loans and other banking services not previously available to them. Innovative fintech companies are able to offer these products responsibly to consumers by leveraging the consumer-provided data collected on the fintech company’s platform. As evidenced in multiple government, industry, and academic reports these activities have provided significant consumer benefits to consumers, particularly those in traditionally underserved areas, such as low- and moderate-income communities.  Access to customer data has been crucial to the development of online platforms and lending for our members to improve their services for the benefit of their consumers. Today, fintech platforms are making sure that consumers and businesses can readily access the capital they need to thrive and grow. Platforms are reaching borrowers with more cost effective, convenient, and transparent credit options, made possible in part by the ability of customers to securely share their financial information with online platforms without fear of abuse of their data.

Specifically, consumer-permissioned data, used by AFC members, is reshaping how fintechs serve diverse communities by leveraging transactional behavior, employment history, and other non-traditional metrics to assess eligibility for loans and other financial products. This innovative approach, like cash flow underwriting, has already empowered AFC members to extend loans to millions of consumers with limited or no credit histories. By bridging the financial gap for these overlooked populations, fintechs directly support equitable access to financial services and create a more inclusive financial ecosystem.

AFC is cognizant that some consumers may feel uncomfortable with the fact that companies collect, retain, and use their data to provide innovative products and services. However, as noted above, the original congressional intent of the Bureau to ensure consumers have the choice to engage with financial products and services as they see fit. Ultimately, AFC believes that the ability for consumers to share their full financial lives with the entities they choose will provide significant benefits to their access to financial services and increase competition within the financial services industry.

Specifically, as AFC has previously advocated,  data practices, such as the secondary use of data for cross-selling and targeted advertising can actually provide benefits to consumers by enabling fintech companies and the innovative banks who power them to more easily reach consumers and offer them improved products and services based on the consumer-permissioned data they receive. Thus, AFC encourages the CFPB to consider an appropriate balance of oversight to keep consumers and their information safe without inadvertently hurting compliant innovative practices.

Further, reforming Regulation P or other data privacy rules on the basis of perceived practices stemming from the potential ways that industry participants could collect, use, and retain data would be misaligned with pragmatic regulatory practices. In reality, clear and conspicuous opt-out provisions, which already exist under Regulation P, and a prudent enforcement regime are sufficient for ensuring that industry participants who decide to actualize these perceived practices are confronted with the appropriate agency actions.

* * *

AFC appreciates the opportunity to comment on CFPB’s Request for Information Regarding the Collection, Use, and Monetization of Consumer Payment and Other Personal Financial Data. We thank you for your consideration of our comments.

Sincerely,

Ian P. Moloney
SVP, Head of Policy and Regulatory Affairs
American Fintech Council

‍

[1]AFC’s membership spans technology platforms, non-bank lenders, banks, payments providers, loan servicers, credit bureaus, and personal financial management companies.
[2] Consumer Financial Protection Bureau, “Request for Information Regarding the Collection, Use, and Monetization of Consumer Payment and Other Personal Financial Data”, Fed. Reg. 90, no. 9 (Jan. 15, 2025): 3804.
[3] GAO recommended that the Bureau’s model privacy form that, if feasible, “would include more comprehensive information about third parties with whom financial institutions share consumer personal information”. U.S. Government Accountability Office, Consumer Privacy: Better Disclosures Needed on Information Sharing by Banks and Credit Unions, GAO-21-36, (Oct. 22, 2020), available at https://www.gao.gov/products/gao-21-36.
[4] Ibid, RFI, Pages 3805 to 3807.
[5] Ibid.
[6] Erik Dolson and Julapa Jagtiani, Which Lenders AreMore Likely to Reach Out to Underserved Consumers: Banks Versus Fintechs VersusOther Nonbanks, Journal of Alternative Finance (2023), available at https://journals.sagepub.com/doi/10.1177/27533743231218019 and AFC, “Modernizing Financial Services throughInnovation and Competition”, Statement for the Record On Behalf of the AmericanFintech Council before The Subcommittee on Digital Assets, Financial Technologyand Inclusion of the House Committee on Financial Services United States Houseof Representatives, 118th Congress, (Oct. 25, 2023), available at https://www.fintechcouncil.org/advocacy/modernizing-financial-services-through-innovation-and-competition.
[7] HR 111-367, at Page 90, available at https://www.congress.gov/congressional-report/111th-congress/house-report/367/1.
[8] See Federal Reserve Bank ofPhiladelphia, Which Lenders Are More Likely to Reach Out to UnderservedConsumers: Banks versus Fintechs versus Other Nonbanks, (2021), page 29, availableat https://www.philadelphiafed.org/-/media/frbp/assets/working-papers/2021/wp21-17.pdf,; Federal ReserveBank of St. Louis, Unsecured Personal Loans Get a Boost from Fintech Lenders,(2019), available at https://www.stlouisfed.org/publications/regional-economist/second-quarter-2019/unsecured-personal-loans-fintech; Federal ReserveBank of San Francisco, Community Development Innovation Review, Fintech,Racial Equity, and an Inclusive Financial System, (2021), available at https://www.frbsf.org/wp-content/uploads/sites/3/fintech-racial-equity-inclusive-financial-system.pdf. See also, U.S.Department of the Treasury, Impact of New Entrant Non-Bank Firms onCompetition in Consumer Finance Markets, (2022), pages 75-79, availableat https://home.treasury.gov/news/press-releases/jy1105.
[9] American Fintech Council, “CommentLetter to CFPB on Proposed Required Rulemaking on Personal Financial DataRights implementing Section 1033,” available at https://www.fintechcouncil.org/advocacy/comment-letter-responding-to-the-proposed-required-rulemaking-on-personal-financial-data-rights-implementing-section-1033.