On January 14, 2025, the Consumer Financial Protection Bureau (CFPB) issued a report titled Strengthening State-Level Consumer Protections (the Report) as the agency prepares for the change in presidential administrations. The CFPB offers recommendations to states to strengthen their consumer protection laws and increase enforcement activity against certain companies, including banks and other financial services companies. The Report was accompanied by a lengthy Compendium of Recent CFPB Guidance, which includes a significant amount of the agency’s Biden-era guidance, stating that it is the CFPB’s hope that these “guidance documents implementing the federal consumer financial laws prove useful to the courts in their interpretation of those laws, as well as to the various enforcers of them.”

While the ultimate fate of much of the CFPB’s Biden-era guidance remains uncertain, we anticipate that the new administration and a new CFPB director will reverse a range of actions undertaken by the prior leadership team at the CFPB, and the agency may take a more restrained approach to enforcement. In seeming acknowledgment of the upcoming changes, the Report calls on states to take steps to facilitate increased consumer protection activity, both by states and by private actors, and provides recommended statutory language for states to consider. Key recommendations to the states are detailed below.

Incorporate “Abusive” Into State Consumer Protection Statutes

Similar to the prohibition on “abusive” practices or acts found in the Consumer Financial Protection Act (CFPA), the Report urges states that have not done so to incorporate “abusive” into their own consumer protection laws. The CFPB asserts that doing so will help states fill gaps that exist in existing prohibitions on unfair or deceptive practices. For example, the CFPB suggests, an “abusive” claim requires no showing of consumer injury to establish liability, unlike an unfairness claim, and the CFPB argues that the “abusive” standard is better tailored to target conduct that leads to indirect consumer harm.

Strengthen Remedies and Tools for Investigation and Enforcement

The Report asserts that many states do not provide sufficiently expansive authority to state attorneys general to adequately investigate and enforce consumer protection laws. The Report recommends that state enforcement agencies have a relatively unimpeded process to initiate consumer protection investigations, including by removing requirements that states petition a court prior to issuing a subpoena or civil investigative demand. Additionally, the Report recommends that state lawmakers provide state attorneys general with market-monitoring authority (similar to the CFPB’s authority), authorize city enforcement entities to bring consumer protection claims, and ensure that states have flexibility to seek equitable relief, punitive damages and penalties for consumer protection violations.

Eliminate Requirements to Prove Monetary Harm and Reliance

The Report notes that some consumer harms may be hard to quantify or are nonmonetary in nature and calls for states to ensure that their laws can be enforced without a requirement to prove ascertainable loss. Further, the Report urges states to remove requirements to prove reliance on a deceptive or misleading statement. The Report states that in the age of digital advertising, a reliance requirement is ill-suited to protect consumers who are deceived, because there are practical difficulties in demonstrating who viewed or received a particular version of an advertisement. Notably, the Report suggests that states implement these changes for private litigants, seemingly suggesting a regime in which class action and other plaintiffs could pursue cases without the need to show that they were affected by challenged conduct.

Extend Consumer Protection Laws to Businesses

The Report recommends that states expand consumer protection laws to business-to-business transactions. It notes that businesses, particularly small businesses, are not immune from unfair or deceptive practices of another business and argues that consumer protection laws should protect those businesses in the same way they would individual consumers.

Enhance Private Enforcement

The Report contends that arbitration clauses used by companies have diminished the ability of consumers to vindicate their own rights. It calls for states to authorize causes of action that allow private individuals to enforce the law even if there is an arbitration clause as to the consumer’s individual claims and, seemingly, absent a viable individual claim by the plaintiff itself. The Report points to California’s False Claims Act and its Unfair Competition Law, as well as the District of Columbia’s Consumer Protection Procedures Act, as examples of laws to enhance private enforcement. For example, the CFPB recommends that states incorporate qui tam mechanisms to enforce consumer protection laws, which could expand possible avenues for consumers to seek relief against companies.

Provide Enforceable Consumer Data and Privacy Rights

The Report acknowledges that many states have passed laws to provide residents with additional rights and protections but notes that many of these state laws specifically exempt financial institutions, financial data or both. The Report calls for states to enact a number of protections with respect to consumer data, including:

• Give consumers a right to delete data about themselves.
• Require that companies only collect the minimum data necessary to provide their product or service.
• Prohibit the use of collected data for reasons other than providing the consumer a product or service they have requested.
• Prohibit the sale or transfer of personal data to third parties (including data brokers) that are unrelated to the provision of a requested product or service, with limited exceptions like credit bureaus.
• Prohibit certain uses of data, including (1) use of personal data of minors for purposes of advertising, (2) use of information about medical debts for credit underwriting, (3) use of financial information for targeted advertising or product pricing, and (4) use of public records for purposes of determining eligibility for receipt of public utilities or other essential services.
• Enshrine protections to ensure that consumers can meaningfully exercise their rights, such as imposing time limits on companies to respond to consumers’ data-related requests, prohibiting companies from retaliating against consumers for exercising their data privacy rights, prohibiting conditioning the provision of services on consenting to certain data uses, and requiring specific consent for the collection, use and sale of consumer data.
• Remove exemptions in state consumer data privacy laws for financial institutions or data covered by the Gramm-Leach-Bliley Act.

Create a Bright-Line Prohibition of “Junk Fees”

The Report argues for a bright-line prohibition on any “junk fee” that impairs consumers’ ability to easily compare prices among different providers. The Report states that junk fees “often take the form of unnecessary, unavoidable, or fake fees, but can also take the form of an add-on or ancillary service that a company can overprice because the customer is captive.” The Report then provides specific recommended statutory language to combat such fees. The proposed statutory language aligns with the Federal Trade Commission’s proposed rule on unfair or deceptive fees, which would generally require clearly and conspicuously disclosing the total price of a good or service and prohibit misrepresentations about a fee’s nature or purpose, including the refundability of the fee.

Conclusion

Much of the Report focuses on legislative or policy changes the CFPB proposes that states adopt. There is no doubt that many of these changes, if pursued, could substantially alter the consumer enforcement landscape for financial services companies and potentially others. Expanded investigative authority and remedies provisions in state laws, for example, would strengthen state attorneys general and other state regulators. Likewise, the removal of basic requirements for private state-law causes of action could significantly expand the scope and frequency of consumer protection litigation. For example, the removal of an injury requirement would directly implicate the concept of standing in state court, potentially opening the door to far more litigants who would otherwise lack standing under current precedent. Relatedly, given the inherent fact-based inquiry of the “abusive” standard, the inclusion of such a standard would significantly increase the ability for a claim to survive a motion to dismiss. Whether states elect to pursue changes along the lines the CFPB proposes remains to be seen.

We note that even absent changes of the kind the CFPB proposes in the Report, states are already authorized to pursue claims for certain violations of the CFPA, as the CFPB has previously noted in a separate Interpretive Rule. While the CFPA does not grant states expanded investigative authority or authorize claims by private litigants, the authorization to pursue such claims provides an additional tool that state regulators may seek to expand use of in the coming years.

We will continue to monitor changes across the consumer protection landscape in the coming months at both the federal and state levels. Companies impacted by such changes should also stay abreast of the shifting landscape and, to the extent possible, engage with relevant agencies on proposed changes to ensure their interests are appropriately considered.