The Consumer Financial Protection Bureau (CFPB) collects data from American consumers all across the financial landscape, including information on credit cards, mortgages, and other financial products. Such records are usually demanded by the CFPB during enforcement actions against U.S. financial institutions and the agency's powerful supervision authority, forcing these institutions to comply with the request or face possible legal sanctions.

  • Independent fact-checkers concur that the CFPB “is collecting information, even 10 years’ worth of some data, involving millions of Americans,” and that it was being done “through third parties without consumers’ knowledge.”

  • U.S. Senator Mike Enzi (R-WY) has compared CFPB's bulk data collection to the National Security Agency’s (NSA) surveillance program. “The NSA claims it is protecting you from terrorists,” he said. “The Consumer Protection Bureau claims it is protecting you from banks.  At what point does ‘protection’ become power or control?”

No Explanations, No Opt-Out,
and No Changes

The CFPB claims that individuals’ names and addresses are not included in the database, minimizing the potential for abuse or theft of records. Critics counter that the program’s secrecy makes such claims impossible to verify.

Deputy Director Steve Antonakes defended CFPB’s actions, claiming that such actions allow the Bureau to "understand markets” and "protect consumers." He has also claimed that the CFPB makes every effort to collect data in an efficient manner while safeguarding the security of the information.

During a 2013 Senate Banking Committee hearing, CFPB Director Richard Cordray also defended the need to collect consumer's information saying, "it is important for us to have data so we can analyze it and we’re not dependent on asking the financial institutions what they think.”

However, Mr. Cordray admitted that the CFPB may have trouble keeping customer data secure. Responding to congressional inquiry, Mr. Cordray could not personally guarantee that the consumer information collected is completely secure.