August 29, 2025

2025 State Enforcement Recap

Anastasia V. Caton

Until the Dodd-Frank Act, the states were at the forefront of consumer credit regulation and enforcement. The arrival of the federal Consumer Financial Protection Bureau gave the states, which typically operated within tight budget constraints, some breathing room, allowing them to focus resources elsewhere. During the first Trump administration, perceiving a waning of federal enforcement, many states created or enhanced consumer credit enforcement divisions. However, Trump's Director Kraninger provided to be a serious regulator who zealously carried out the agency's statutory mission. Under Biden's Director Chopra, the agency frequently teamed up with state attorneys general, allowing the states to leverage the agency's substantial resources to bring enforcement actions. Chopra's CFPB also routinely issued non-rule guidance (a controversial practice) in various forms: supervisory highlights, bulletins, and advisory opinions. State regulators also relied on these interpretations and guidance to interpret state law, including state trade practices laws.

But in early 2025, the new Trump administration upended this decade-long balance by bringing the CFPB's work to a grinding halt, ending investigations, closing out exams, dismissing lawsuits, reversing settlements, and attempting to effectively dismantle the agency by firing nearly all of its staff. Now, over six months since former Director Chopra was fired and replaced first with Treasury Secretary Bessent and then with OMB Director Vought (currently serving in a dual capacity), we thought it would be useful to recap how the states have attempted to fill the gaping hole left by the CFPB.

Junk Fees

Republican and Democratic AGs are challenging the notion that "junk fees" were merely a fixation of the Biden Administration. Junk fees and related marketing and advertising practices are a politically popular target, as these actions demonstrate:

• Maryland Attorney General Brown settled with a dealership group over claims that the dealership allegedly improperly charged consumers "sales commission" fees and other markups, and charged consumers for add-on products without their knowledge, which resulted in consumers paying more than the vehicle's advertised price. The AG's order requires the dealership to refund sales commission fees charged to consumers and charges for add-on products that the consumer did not knowingly purchase. The order also requires the dealership to refund consumers who submit valid claims for the difference between the advertised price and the sale price of the vehicle. The order includes 15 paragraphs of injunctive relief addressing (among other issues) fees, advertised prices, and the disclosure of fees in advertisements and contracts.
• The Massachusetts Attorney General's new "junk fee" rule goes into effect on September 2, 2025. The new rule requires the disclosure of an all-in price that includes all mandatory fees (similar to the Federal Trade Commission's new junk fee rule). The rule also imposes requirements and restrictions on recurring fees and subscriptions, trial offers, and products with a negative option feature.
• Pennsylvania Attorney General Sunday entered into a settlement with a dealership group over its allegedly deceptive sales practices, including, according to the AG, inflating vehicle prices with add-on costs. Under the terms of the settlement, the dealerships will pay $130,000 in total, $100,000 of which represents restitution for impacted consumers.
• Texas AG Paxton entered into a $9.5 million settlement with an online hotel booking company over its allegedly deceptive marketing of hotel room prices by omitting mandatory fees.

New York

New York earned its own category in this roundup. Both Attorney General James and the Department of Financial Services responded almost immediately to the CFPB's work stoppage by taking aggressive action to push for a stronger consumer protection law, pick up litigation dropped by the CFPB, and hire up former high-ranking officials from the CFPB:

• Both houses of New York's legislature passed the FAIR Business Practices Act and, as of this writing, the bill is expected to go to Governor Hochul's desk soon. If signed into law, the FAIR Business Practices Act would amend New York's consumer protection law, which currently prohibits only deceptive trade practices, to also prohibit unfair and abusive acts or practices, adopt the Federal Trade Commission's definition of "unfairness" and the CFPB's definition of "abusiveness," and vest authority in the AG to enforce the prohibition on unfair or abusive acts or practices. AG James and others have repeatedly cited the attempted dismantling of the CFPB as the impetus for this legislation.
• AG James sued a national bank and its holding company for the bank's alleged practices relating to its offering of online savings accounts. The federal Consumer Financial Protection Bureau previously brought a lawsuit against the bank with similar allegations, but voluntarily dropped the suit after the change in administration. This is a fairly obvious attempt to pick up where the Bureau left off.
• AG James entered into consent orders with eight franchise motor vehicle dealers operating in the state, securing $2.8 million in consumer restitution and $400,000 in penalties. The consent orders related to the dealers' lease buyout practices. Specifically, AG James claimed that, when consumers sought to exercise the purchase option on their leased cars, the dealerships added "junk fees" or misrepresented the buyout price of the vehicle, resulting in, according to the AG, consumers paying higher costs for lease buyouts. The AG claimed that "dealership fees" and "administrative fees" added to the lease buyout were "junk fees." This action follows on the heels of seven other actions by AG James in 2024 against other franchise dealers in New York for their lease buyout practices.
• AG James has sued earned wage access providers, claiming that their products are loans with usurious interest rates and that the providers misrepresented the costs of the products in advertisements.
• AG James settled with a revenue-based finance company, alleging that the company disguised loans as purchases of future revenues. Specifically, the AG claimed that the company collected fixed amounts directly from the borrowers' bank accounts every day, and that these collections had "little connection" to the borrowers' revenues. According to the AG, the company claimed that it would reconcile the collections with the borrowers' revenues, but did not do so. The result, alleged the AG, were loans with interest rates that, in some cases, exceeded the usury limit by 50 times. Between debt cancellation, restitution, and other relief, the total judgment exceeded $1 billion, the largest consumer settlement ever obtained by the New York AG acting alone.
• The Department of Financial Services entered into an eye-popping $40 million settlement with a peer-to-peer money transmission service over its allegedly inadequate BSA/AML compliance program, which, DFS claimed, violated DFS's money transmitter and virtual currency regulations.
• In March, DFS announced that it had appointed Gabriel O'Malley, a more than decade-long veteran of the CFPB, to lead DFS's Consumer Protection and Financial Enforcement Division.

Mortgage Lending and Servicing

Nearly 20 years after the subprime mortgage bubble burst, resulting in the foreclosure crisis, regulatory scrutiny of mortgage lending and servicing practices continues:

• Massachusetts AG Campbell entered into a $2 million settlement with a mortgage loan servicer, alleging violations of state consumer protection, foreclosure prevention, and debt collection laws. The AG claims that the servicer required consumers to pay large upfront payments to enter into a loan modification, failed to comply with notice requirements for foreclosure prevention notifications, and made collection calls in excess of Massachusetts's two-call-per-week limit.
• Ohio Attorney General Yost sued a wholesale mortgage lender, alleging that the company worked with a network of brokers that, the AG claims, "funneled" nearly all mortgages to the company. The AG alleges that the company misrepresented to consumers in its marketing that the brokers were independent of the company, and instead owed loyalty to the borrower. The AG also claims that the arrangement between the company and its network of brokers resulted in higher fees and rates for borrowers. The AG's lawsuit accuses the company of violating Ohio's Consumer Sales Practices Act, Residential Mortgage Lending Act, and Corrupt Practices Act. It seeks injunctive relief and restitution for affected consumers.
• Former Pennsylvania Attorney General Henry (who has, since this action, been succeeded by AG Sunday) sued a mortgage broker and its manager over an alleged kick-back scheme in which real estate agents, according to the AG, directed potential home buyers to the brokers in exchange for sporting event tickets, dinners, and other kickbacks. The AG alleges that the broker and manager violated Pennsylvania's trade practices law, the federal Consumer Financial Protection Act, and RESPA.
• The Illinois Department of Financial and Professional Regulation ("IDFPR") revoked the license of and assessed a fee against a mortgage lender for allegedly retaining unlicensed mortgage loan originators, facilitating their unlicensed loan origination activities, and accepting loan files from the unlicensed mortgage loan originators that contained false or fabricated information without correcting it. In addition to revoking the mortgage lender's license, the IDFPR assessed a fine of $100,000.

Privacy

Some of the most substantial and highly publicized actions in 2025 have been in the privacy space. For example:

• Four Republican Attorneys General to date (Arkansas, Indiana, Nebraska, and Texas) have sued an auto manufacturer and its subsidiary (in four separate actions) over their alleged collection and sharing of consumers' driving data with third parties, including insurance companies. The AGs claim that the defendants sold the driving data to insurance companies, which then used the data to deny consumers insurance coverage, cancel their existing coverage, or raise their rates. The AGs further allege that the defendants used deceptive tactics, including to obtain the data, and that dealership employees were incentivized to enroll customers in the defendants' connected car services, in some cases without getting the customer's consent. While the claims involve data sharing and use, these are all bread-and-butter unfairness and deception cases, brought under state unlawful trade practices and consumer protection statutes.
• Connecticut Attorney General Tong is in the midst of a sweep to begin enforcing compliance with the state's Data Privacy Act. AG Tong has sent over two dozen cure notices in total to companies operating in Connecticut identifying deficiencies in their privacy notices. Companies that failed to cure have been the subject of enforcement actions.
• California Attorney General Bonta entered into the state's largest California Consumer Privacy Act ("CCPA") settlement to date with a website publisher for $1.55 million. AG Bonta alleges that the company's online tracking technology violated the CCPA because the company, according to the AG, failed to allow consumers to opt out of targeted advertising, shared consumer data with third parties without following the CCPA's purpose limitations, failed to ensure that its advertising contracts had the privacy protections required by the CCPA, and deceived consumers about its privacy practices by not disabling cookies at the consumer's request.
• Texas AG Paxton settled with a large tech company for $1.375 billion over the company's alleged practices of tracking and collecting Texans' private geolocation and biometric data and incognito searches. The AG claims these practices violated Texas's privacy laws, and the AG retained an outside law firm to help handle the case.

What to Expect: This Fall and Beyond

We are aware, anecdotally, and through public announcements, that former CFPB staffers are fanning out to state attorneys general and regulator offices, bringing with them a wealth of experience, expertise, and motivation. Their backgrounds range from supervision to enforcement, market research, and rulemaking. They will likely bolster state consumer credit regulation and enforcement, including by potentially helping the priorities of the Chopra CFPB spread across the states. Even with the notable uptick in state activity in 2025, we likely are not yet seeing the full impact of these former CFPB staffers in state roles. Stay tuned for more to come!

Join us for a webinar highlighting anticipated state AG enforcement trends on September 17, 2025 at 2:00 pm ET. Click here to learn more about Hudson Cook's State Enforcement Practice.