CBA Urges CFPB to Scale Back Data Rights Framework in Rule Reconsideration

The Consumer Bankers Association ("CBA") urged the CFPB to scale back its personal financial data rights framework, arguing the prior rule exceeded statutory authority by treating commercial data aggregators as consumers' representatives.

In an August 10, 2026, blog post, the association reiterated its October 2025 comments on CFPB Part 1033 ("Personal Financial Data Rights") as the agency's reconsideration of the measure moved to the White House Office of Information and Regulatory Affairs. The CFPB previously issued an advance notice of proposed rulemaking seeking input on who can serve as a consumer's "representative," fee limits, data security, and privacy (see prior coverage).

CBA argued that data aggregators and third-party fintechs acting for commercial purposes are not "consumers" or their "representatives" under Section 1033 ("Consumer rights to access information") of the Dodd-Frank Act. Because these entities operate in a business relationship rather than a fiduciary one with consumers, the association cautioned the CFPB against using that framework to impose obligations Congress did not expressly authorize.

The association also called for the CFPB to reverse the prior rule's prohibition on charging third parties and data aggregators for access to bank data-sharing systems. CBA stated that the statute does not bar fees and that a one-sided restriction could discourage continued investment in secure data infrastructure.

On security and privacy, the association urged the CFPB to explicitly prohibit screen scraping and to provide clearer third-party risk-management guidance consistent with prudential regulator expectations. The association supported retaining limits on how third parties use consumer data beyond the requested service, and called for clearer consent and revocation rules along with tighter limits on data aggregators.

Compliance dates for the rule are stayed by court order pending the CFPB's reconsideration.