October 31, 2022

Attention Digital Marketers of Financial Products and Services: The CFPB Wants to Be Friends

Look out, digital marketers! The Consumer Financial Protection Bureau just sent you a friend request.

Last month, the CFPB published a press release and an interpretive rule—"Limited Applicability of Consumer Financial Protection Act's 'Time or Space' Exception with Respect to Digital Marketing Providers." All indications point to the CFPB's intent to subject digital marketers to its jurisdiction in certain circumstances. According to CFPB Director Rohit Chopra, "[a]dvances in technology should help our economy and society advance, rather than incentivizing a rush to seize our sensitive financial data and to allow tech giants to evade existing laws that other firms must comply with."

Under the Consumer Financial Protection Act, both "covered person[s]" and "service provider[s]" to covered persons are subject to the Act. A person is a "covered person" under the CFPA if it offers or provides a "financial product or service" for use by consumers primarily for personal, family, or household purposes. The term "covered person" also includes any affiliate of a person described above if the affiliate acts as a service provider to the person.

"Financial products and services" include extending credit and leases, engaging in deposit-taking activities, providing financial advisory services, assisting with debt management or settlement, collecting debt related to consumer financial products or services, and providing consumer report information.

The CFPA defines "service provider" as "any person that provides service to a covered person in connection with the offering or provision by such covered person of a consumer financial product or service." This definition includes participating in designing, operating, or maintaining the consumer financial product or service or processing transactions related to the consumer financial product or service (other than unknowingly or incidentally transmitting or processing financial data in a manner that such data is undifferentiated from other types of data of the same form as the person transmits or processes).

The definition of "service provider" contains two exceptions. First, the term "service provider" does not include a person offering "a support service of a type provided to business generally or a similar ministerial service." Second, the term "service provider" does not include a person offering "time or space for an advertisement for a consumer financial product or service through print, newspaper, or electronic media."

Because of this second exception, marketers were not historically subject to the CFPA if they simply provided the time or space for an advertisement. For example, a newspaper running an ad for a bank is not subject to the CFPA because it is only giving ad space to a covered person. However, the CFPB's interpretive rule discusses the role digital marketers play and intends to extend its jurisdiction over digital marketers that take certain actions on behalf of covered persons.

Director Chopra noted that "when it comes to modern digital marketing platforms, these companies are not providing space on a static billboard. Instead, they are identifying and analyzing potential users' personal data, and often getting paid for converting interactions with users into revenue for the financial firm."

In the interpretive rule, the CFPB explains that digital marketing companies engaged in targeted advertising services are "service providers" under the CFPA and that they don't fall under the exception for providing "time or space for an advertisement." The CFPB reasons that entities engaging in targeted advertising go beyond simply providing "time or space for an advertisement ... through print, newspaper, or electronic media" because they are involved in the "identification or selection of prospective customers" or the "selection or placement of content to affect consumer engagement." The interpretive rule notes the following in a footnote: "Of course, nothing in this interpretive rule precludes a digital marketing provider from being considered a covered person based on its acts and practices. Indeed, by engaging in consumer data collection, tracking, analysis, and maintenance activities, digital marketing providers may be covered persons."

After studying the interpretive rule, it appears that the questions to ask when determining whether a digital marketer is within the CFPB's focus include:

• Does the digital marketer aggregate data?
• Does the digital marketer analyze data?
• If yes to either, does the digital marketer then use that information to:
  • decide when (what day and time) to deliver ads?
  • decide which ads to deliver?
  • decide to whom to deliver ads?

The interpretive rule appears to gloss over a couple of key discussions. First, the CFPB explains in great detail why the exception for "time or space for an advertisement" does not apply, but it does not attempt to explain why targeted advertising is outside the other exception for "a support service of a type provided to business generally or a similar ministerial service." The CFPB also does not discuss the notion that if Congress meant for the CFPA to cover advertisers targeting potential users of financial products and services, it would have said so, given that regulators were well aware of the practice in 2010, when the CFPA was passed.

The interpretive rule appears to be an attempt by the CFPB to assert its intention to be a tech regulator. The quotes from Director Chopra refer to platforms that amass personal data, tech giants, and Big Tech. What does this mean for dealers? Well, the CFPB just might be sending a friend request to your digital marketing firm.