CFPB Helps Guide States to Fill Gaps in Protection Frameworks

This article was originally published in Bloomberg Law. Any opinions in this article are not those of Winston & Strawn or its clients. The opinions in this article are the authors’ opinions only.

Last month, the Consumer Financial Protection Bureau issued a roadmap for states to bolster their consumer protection laws, likely in the anticipation of Trump administration efforts to hobble the CFPB, which played out recently as the administration ordered layoffs, and the CFPB’s budget drew scrutiny.

The report emphasizes the historical collaboration between the federal government and the states in protecting consumers and described emerging challenges to the current consumer protection system. It also warns of the consequences when federal and state regulators fail to be vigilant—for example, the savings and loan crisis of the 1980s and the 2007–2008 mortgage crisis—and recommends states implement significant changes to their Unfair or Deceptive Acts or Practices laws.

According to the report, states have long used their police powers to regulate local commerce and protect consumers, working hand in glove with the federal government since the Federal Trade Commission first prohibited unfair and deceptive methods of competition in 1914. States have often filled gaps in federal regulation through their own consumer protection legislation.

Similarly, Congress has drawn from state-level consumer protection statutes in developing certain federal laws, such as the Truth in Lending Act. Congress granted states the authority to enforce federal consumer financial law as part of the Consumer Financial Protection Act. And the CFPB has worked directly with states to support consumer protection efforts, including through joint investigations and narrowly interpreting the preemptive scope of the Fair Credit Reporting Act.

But because most states enacted their consumer protection laws in the 1960s and 1970s, the CFPB argues laws need to be updated to account for “case law that has diluted their efficacy” and new technologies, practices, and economic changes that could threaten consumers. In particular:

•  Increasing economic concentration has positioned corporations to “gain leverage over consumers and coerce them into accepting low-quality services or paying high prices, or committing other unfair, deceptive, or abusive practices.
•  Growing risk from the “use and abuse” of consumer data, coupled with state laws that don’t permit consumers to recover for harms suffered because of data breaches may leave consumers under-protected.
•  The proliferation of “junk fees” across numerous areas of the economy has allowed an increase in revenue without a resulting “competitive backlash.”
•  The “decoupling” of contract doctrine from the reality of online commerce leaves consumers vulnerable, including through online contracts that are rarely read and are “largely unreadable by the general public,” despite carrying important clauses that waive causes of action, limit liability, or restrict consumer rights.

To respond to these challenges, the CFPB recommended states make significant changes to their consumer protection laws.

Incorporate the term “abusive” into state consumer protection law. States should incorporate a prohibition against “abusive” practices into their consumer protection laws and offered model language for states to follow. The CFPB reasoned that “abusive” does a better job than “deception” at capturing modern misconduct, such as the use of pop-ups, multiple click-throughs, or other “dark patterns” used to obscure or hide information or otherwise trick consumers into making certain choices.

Unlike “unfairness,” an “abusive” standard wouldn’t require the showing of consumer injury to establish liability. Adding an “abusive” standard would also allow states to target practices in areas beyond consumer financial products and services.

Strengthen remedies and tools for investigation and enforcement. State enforcers should have “robust investigative powers” such as allowing state attorneys general to issue subpoenas and civil investigative demands without petitioning a court. The CFPB also encouraged states to consider granting municipalities and cities the authority to bring consumer protection cases and floated the idea of providing state attorneys general with market-monitoring authority.

The CFPB advocated for greater access to equitable relief and punitive damages as well as holding corporate officers personally liable when it supports states’ consumer protection missions.

Eliminate requirements to prove monetary injuries. Recognizing that harms can be difficult to quantify in dollars, the CFPB recommended states eliminate requirements to prove ascertainable loss, reliance on a misleading or false claim, and monetary harm. It also recommended states make the “economic loss” doctrine of tort law inapplicable to claims under consumer protection laws.

Ensure consumer protections also cover businesses. Businesses might not receive the same protections as other consumers for the same harms, signaling a need to expand who qualifies for consumer protections. The CFPB encouraged states to adopt a model definition of “consumer” encompassing companies, organizations, and representatives acting on their behalf.

Some states have already made similar efforts; for example, Massachusetts has a cause of action for businesses harmed by unfair or deceptive acts or practices.

Revitalize private enforcement. Because once-robust private rights of action created by many states have been “severely constrained” by developments in case law and the growing use of arbitration clauses, the CFPB recommended states amend consumer protection laws to add private enforcement mechanisms, such as allowing representational or qui tam causes of action on behalf of the state, allowing private enforcers to enforce the law in spite of arbitration clauses as to individual claims, and allowing nonprofit and public interest organizations to bring damages cases against companies.

Provide strong and enforceable consumer data and privacy rights. Many state laws providing protections for consumer privacy and data include exemptions for financial institutions, financial data, or both. The CFPB’s suggested remedies to this shortcoming include giving consumers the right to delete data about themselves, ordering companies to collect only the minimum data required to provide their product or service, and prohibiting certain uses of data, such as using financial information for targeted advertising.

Create bright-line prohibitions of junk fees. While many so-called “junk fee” practices are already prohibited under general consumer protections, the CFPB proposed a bright-line prohibition on such fees to reduce their prevalence. The model language the CFPB supplied would expressly make the use of certain hidden fees, misleading fees, or price-gouging “captive customers” an unfair and deceptive practice.

Although framed in terms of changing legal and economic circumstances over decades, it’s hard to view this report as anything but an attempt to shore up consumer protection efforts in anticipation of a hobbled CFPB in the near future. In fact, the CFPB issued a compendium of guidance the same day, highlighting other agencies that are empowered to protect consumers, including the Federal Deposit Insurance Corporation, Office of the Comptroller of the Currency, Federal Reserve Board, National Credit Union Administration, Department of Justice, and Federal Trade Commission. Taken together, these moves strongly suggest that other federal regulators and state attorneys general can and should step in to fill certain regulatory gaps left by a weakened CFPB.

Many of the suggestions in the CFPB’s roadmap for states could have far-reaching implications. For example, adding qui tam actions to state consumer protection laws could expand the number of actions a company has to prepare for and defend against, which in turn could mean substantial increases in settlement and judgment payments. From 2019–2022, California’s Private Attorneys General Act alone brought in more than $378 million in settlements or judgments.

Of course, before any of these potential outcomes arise, states must act on the CFPB’s recommendations. It remains to be seen whether they will. But at least one state, New York, recently proposed regulations to cap overdraft fees and eliminate other “junk fees.”

In any case, if the current pace of change continues, financial institutions will need to be ready to weather major changes in the next few years—not over the next decade.

Reproduced with permission. Published February 21, 2025. Copyright 2025 Bloomberg Industry Group 800-372-1033. For further use please visit https://www.bloombergindustry.com/copyright-and-usage-guidelines-copyright/