September 26, 2025
Consumer Financial Services Bites of the Month - September 17, 2025 - "Come Sail Away CFPB"
Justin B. Hosie, Eric L. Johnson and Kristen Yarows
In this month's article, we share some of our top "bites" covered during the September 2025 webinar.
Bite 16: CFPB Publishes "Making Ends Meet" Survey Data
On August 20, 2025, the CFPB published reports from its annual "Making Ends Meet" Survey that examines consumers' evolving financial status through a series of studies. The survey program is a series of general financial surveys that cover financial decision-making, perceptions, expectations, well-being, marketing, and usage of different consumer finance products. The CFPB has released information and research based on these surveys and the related credit panel data for the last several years and is now making the microdata public. The CFPB indicated that it aims to facilitate analysis of consumers' financial behaviors and challenges, including their ability to manage expenses following loss in income.
Bite 15: CFPB Warns Staff of Possible Workforce Cuts Due to Funding
On September 10, 2025, it was reported that the CFPB sent emails to staff saying that it may eliminate some of its workforce due to the new funding limits imposed by Congress. The email from the CFPB's HR office apparently said it would not proceed with restructuring the CFPB until after the National Treasury Employees Union case against Acting Director Vought is litigated, but that CFPB is evaluating "workforce optimization opportunities" to match the new funding limits. The letter allegedly said that this "evaluation includes considering a possible reduction in force" and urged staff members to make sure their contact information is updated and updated resumes are on file with the agency in the event that their positions are eliminated. Two people familiar with the matter reported that staff at the CFPB are concerned that there might be insufficient cash on hand to meet payroll and severance costs in the new fiscal year starting next month.
Bite 14: CFPB Drops Investigation into Gun-Focused BNPL Company
On August 19, 2025, a parent company shared that the CFPB closed its investigation of its outdoor recreation and firearms-focused buy-now, pay-later subsidiary that had originally started in February 2021. The letter said that the CFPB "determined that this investigation exemplifies the type of weaponization against disfavored industries and individuals that President Trump and Acting Director Vought are committed to ending." The letter also said that the investigation was conducted in a biased manner that targeted the company's "exercise of its constitutional rights and facilitation of others' exercise of their constitutional rights." According to the letter, the this "investigation was not aimed at protecting consumers, but at suppressing activities protected by the First and Second Amendment." Likewise, the letter said that this "investigation also represents precisely the kind of unconstitutional targeting that President Trump prohibited in his Executive Order on debanking." The letter notes that the CFPB had sent a proposed settlement agreement in December 2024, but it targeted shutting down the company's firearm business, which was virtually the entirety of the company's business.
Bite 13: FTC Took Steps to Dismiss Appeals over Non-Compete Rule
On September 5, 2025 the FTC announced that it had voted 3-1 to dismiss appeals over the FTC Non-Compete Rule. The FTC voted 3-1 to dismiss the appeals and accepted a court's decision to invalidate the non-compete rule, rather than continuing to fight for it in court. When the FTC issued the Rule, current Chairman Ferguson and Commissioner Holyoak dissented on the grounds that the FTC lacked the statutory authority to issue the rule. The district courts found that the FTC lacked authority to issue the rule and prohibited enforcement. The 3-1 vote included Chairman Ferguson and Commissioner Holyoak issuing a statement, Commissioner Meador issuing a concurring statement, and Commissioner Slaughter dissenting. Chairman Ferguson and Commissioner Holyoak wrote that the FTC overreached its legal authority in promulgating the rule, and instead of using resources on the litigation over the Rule, the FTC will enforce the antitrust laws against noncompete agreements. Just a day before the FTC withdrew its appeals, the FTC issued a broad request for information to the public regarding non-compete clauses and brought an enforcement action against a national pet cremation company over its non-compete agreements.
Bite 12: CFPB Releases its Unified Rulemaking Agency
On September 4, 2025, the Office of Management and Budget published its semiannual unified agenda of regulatory and deregulatory actions, including 24 items from the CFPB—double the items from last fall. Some of the key items include: pre-rule activity to potentially clarify the statutory language with respect to unfair, deceptive, or abusive acts and practices; proposing to rescind the rule requiring registration of certain final public orders; proposing to adopt a standard to bind the CFPB in proceedings to designate nonbank covered persons for CFPB supervision when they "pose risks to consumers"; considering raising the thresholds for larger participant rules in auto finance, debt collection, consumer reporting, and international money transfer; planning to issue a proposed rule to reconsider the November 2024 final rule for the Section 1033 Personal Financial Data Rights Rule; and considering whether rulemaking would facilitate compliance with ECOA.
Bite 11: FTC Launches Inquiry into AI Chatbots as Companions
On September 11, 2025, the FTC issued orders to seven companies that provide consumer-facing AI chatbots. The FTC issued these orders under its 6(b) authority, which is an investigative tool that allows the FTC to request answers to specific questions about organization, business, conduct, practices, and management. The AI chatbots may use generative AI technology to simulate human-like communication and interpersonal relationships with users including mimicking human characteristics, emotions, and intentions. The FTC seeks to understand what steps, if any, companies have taken to evaluate the safety of their chatbots when acting as companions, to limit the products' use by and potential negative effects on children and teens, and to tell users and parents of the risks associated with the products. The FTC indicated that it is particularly interested in the impact of the chatbots on children, including what actions the companies are taking to mitigate potential negative impacts and compliance with the Children's Online Privacy Protection Act ("COPPA") Rule. The FTC is asking how companies monetize user engagement; develop and approve characters; monitor compliance with company rules and terms of service, including community guidelines and age restrictions; and use or share personal information obtained in conversations.
Bite 10: CFPB Proposes Rule Narrowing Nonbank Supervisory Authority
On August 26, 2025, the CFPB published a proposed rule for nonbank supervision proceedings. The proposal adopts a standard definition of "risks to consumers" that will bind the CFPB in these proceedings. Section 1024(a)(1)(C) of the Consumer Financial Protection Act authorizes the CFPB to supervise a nonbank covered person that the CFPB "has reasonable cause to determine . . . is engaging, or has engaged, in conduct that poses risks to consumers with regard to the offering or provision of consumer financial products or services." The CFPB does not currently define what constitutes risks to consumers. The CFPB lists three concerns about the status quo including: (1) the CFPB's application of "risks to consumers" may not be consistent between orders, (2) the CFPB may depart from existing precedent from prior orders, and (3) without a binding framework on the meaning of "risks to consumers," the CFPB may not conform to the best reading of section 1024(a)(1)(C) in individual cases. The proposed rule would explain that "conduct that poses risks to consumers" would consist of conduct that: (1) presents a high likelihood of significant harm to consumers, and (2) is directly connected to the offering or provision of a consumer financial product or service. So far, the CFPB has only exercised this supervisory authority on fewer than twenty covered entities, and it expects that this proposed rule will make it even less likely to designate an entity for supervision. Comments on the proposed rule must be received on or before September 25, 2025.
Bite 9: CFPB Takes Action Against Fintech Bank Partner
On August 21, 2025, the CFPB commenced an adversary proceeding and filed a complaint and proposed stipulated final judgment in connection with Chapter 11 bankruptcy proceedings for a fintech serving as a service provider for other fintechs and their bank partners. This entity was providing certain services including advertising, deposit account maintenance, offering debit cards and services, bill payment, and funds transfers. The CFPB alleged that the fintech engaged in unfair acts or practices in violation of the Consumer Financial Protection Act for failing to properly maintain records of consumer funds held at partner banks and that the fintech's records did not align with the records maintained by the banks, with a shortfall estimated at between $60 and $90 million. The alleged discrepancies were discovered during initial bankruptcy proceedings against the fintech resulting in partner banks freezing consumer accounts, which prevented some consumers from accessing their accounts for up to eight months. The stipulated final judgment and order would require the fintech to pay a nominal $1 fine in redress (as a means for the CFPB to access the civil penalty fund); ban the fintech from participating in, assisting with, or receiving any consideration in connection with deposit-taking activities, the transmission of funds, or acting as the custodian of funds. The stipulated final judgment and order would also prevent the fintech from selling customer information. The court entered the final judgment and order on September 12.
Bite 8: Appeals Court Orders Reinstatement of FTC Commissioner
On September 2, 2025, the Court of Appeals for the D.C. Circuit ruled that former FTC Commissioner Slaughter was wrongfully removed from her position in March. The order dissolved the administrative stay that was entered on July 21st and denied the motion for a stay pending appeal. The appeal analyzed whether the statute providing the Commissioners for-cause removal protection unconstitutionally infringed on the President's Article II power. The opinion cited to Humphrey's Executor v. U.S. and wrote that the "government is not likely to succeed on appeal because any ruling in its favor from this court would have to defy binding, on-point, and repeatedly preserved Supreme Court precedent." The opinion reasoned that a duly appointed Commissioner may be removed by the President only "for inefficiency, neglect of duty, or malfeasance in office." The panel ruled 2-1, and the dissent argued that the courts should have permitted President Trump to remove Commissioner Slaughter while the litigation was pending.
Bite 7: Chief Justice Roberts Pauses FTC Commissioner's Reinstatement
On September 8, 2025, media outlets reported that Chief Justice Roberts issued an order temporarily staying the reinstatement of FTC Commissioner Slaughter while the Trump Administration brings the case to the Supreme Court. Just six days earlier, the Court of Appeals for the D.C. Circuit ruled that former FTC Commissioner Slaughter was wrongfully removed from her position in March. U.S. Solicitor General D. John Dauer submitted an application asking the Court to pause a D.C. district court's order to reinstate Commissioner Slaughter. The Chief Justice's order did not provide any rationale and stayed the reinstatement pending a further order from the court and called for Slaughter to file her opposition to the government's application by September 15.
Bite 6: FTC Takes Action Against AI Developer
On August 21, 2025, the FTC announced an action against an AI developer, alleging that it deceptively marketed its AI decision tool. Specifically, the FTC issued a final decision and order against this AI developer over allegations that the company falsely marketed its AI content detection tool as predicting with 98% accuracy whether text was created by generative AI programs. The FTC alleged that the company did not substantiate this claim. Back in April, the FTC had announced a proposed consent order and a 30-day public comment period. The final decision and order prohibits the company from making unsubstantiated or misleading claims about the accuracy of AI detection tools unless supported by competent and reliable evidence, including competent and reliable scientific evidence when appropriate. The order also requires the company to notify all current and recent customers about the settlement, submit annual compliance reports for three years, and create and retain compliance-related records for up to ten years. The order is effective for 20 years and subjects the company to ongoing monitoring.
Bite 5: FTC Takes Action Against Robot Toy Maker
On September 2, 2025, the FTC filed a complaint and proposed stipulated order against a technology company that develops programmable toy robots marketed to children ages 6 to 14. The company required the use of a companion mobile app to control and program the toy, and the FTC alleged that the company's Android app collected precise geolocation data from children without parental notice or consent. The FTC alleged violations of Section 5 of the FTC Act and the COPPA Rule. The proposed stipulated order requires the company to delete unlawfully collected data, implement clear and conspicuous parental notice practices, obtain verifiable parental consent before collecting children's personal information, and comply with recordkeeping and reporting obligations for 10 years. The proposed stipulated order also includes a permanent injunction and civil penalty of $500,000.
Bite 4: FTC Takes Action Against Online Video Platform Operator
On September 2, 2025, the FTC announced an action against an online video platform operator, alleging that an operator failed to designate videos as "made for kids." The large entertainment company operates online video channels and uploads child-directed videos to a video sharing platform. The FTC alleged that the company violated the FTC Act and the COPPA Rule. The FTC alleged that the company failed to properly mark certain videos as child-directed, and collected children's personal information without parental notice or consent, contrary to COPPA requirements. The FTC alleged that in some cases, children received targeted advertisements. The proposed stipulated order requires the company to implement a robust audience designation program to ensure videos are correctly identified as "made for kids," provide direct notice to parents, and obtain verifiable parental consent before collecting, using, or disclosing children's personal information. The proposed stipulated order also includes a permanent injunction and a $10 million civil penalty.
Bite 3: FTC Takes Action Against Fitness Company over Cancellation Policy
On August 20, 2025, the FTC announced an action against a fitness company over its cancellation policy, alleging violations of the FTC Act and the Restore Shoppers Confidence Act ("ROSCA"). The FTC claimed the company's cancellation process created challenges for consumers who sought to cancel their memberships. According to the complaint, consumers seeking to cancel their membership were required to either go to the gym and cancel through specific employees with restricted hours or by mailing a cancellation form via certified or registered mail. The complaint alleged that the cancellation practices violated the FTC Act's prohibition on unfair acts or practices. The complaint also alleged that the gym failed to notify consumers that they could cancel add-on amenities and services (like towel services and cryotherapy) individually in violation of ROSCA. The complaint seeks a permanent injunction to prevent the gyms from future violations of the FTC Act and ROSCA, monetary relief, and any additional relief as the court deems just and proper.
Bite 2: FTC Takes Action Against Debt Relief Operation Owners
On September 11, 2025, the FTC announced an action against debt relief operation owners, who agreed to the orders and permanent industry bans. The FTC had alleged that the companies charged upfront fees for debt relief services and falsely claimed to be affiliated with the Department of Education. According to the complaint, the debt relief operation misrepresented that consumers' monthly payments would be applied towards their student loans and that consumers who purchased the debt relief services would receive loan forgiveness. Two individual defendants agreed to settle the FTC's charges with proposed orders that permanently ban them from engaging in the debt relief industry. One of the individuals is banned from engaging in telemarketing, while the other is prohibited from violating the Telemarketing Sales Rule. The proposed orders impose a monetary judgment of more than $45.9 million that will be partially suspended, due to the defendants' inability to pay, after they pay more than $1.6 million and turn over approximately $560,000 in personal and business assets. The litigation involving the companies and one other individual defendant is ongoing.
Bite 1: FTC Takes Action Against Education Technology Provider
On September 15, 2025, the FTC settled a case with an education technology provider over allegations that the company made it difficult (and in some cases, nearly impossible) for customers to cancel recurring subscriptions and continued charging consumers after they submitted cancellation requests. The FTC alleged that the company continued to charge nearly 200,000 consumers after they submitted cancellation requests. The FTC also alleged that the cancellation processes for various subscription services were buried on the company's website, requiring consumers to navigate through several pages to find and initiate the self-cancellation process. The complaint alleged that despite overwhelming consumer feedback and internal recognition that consumers had difficulties with their cancellation process, the company didn't improve the visibility of the cancellation of the cancellation link. The FTC alleged that the company violated the FTC Act and ROSCA. The proposed order requires the company to pay $7.5 million, which will be used to provide refunds to consumers, and also requires the company to maintain simple cancellation mechanisms for negative option features.
Still hungry? Please join us for our next Consumer Financial Services Bites of the Month. If you missed any of our prior Bites, request a replay on our website.