November 29, 2021

Volume XI, Number 333

Advertisement
Advertisement

CFPB Orders Six Tech Companies to Provide Information on Payment Systems Data Practices

On October 21, 2021, the Consumer Financial Protection Bureau (“CFPB”) issued orders to Google, Apple, Facebook, Amazon, Square and PayPal requesting detailed information about their business practices in relation to payment systems they operate. The CFPB issued the orders pursuant to its statutory authority under the Consumer Financial Protection Act.

In issuing the orders, the CFPB seeks to understand the following practices:

  • Data Harvesting: whether the companies share payment data with third parties, including data brokers, and/or combine payment data across product lines;

  • Data Monetization: whether the companies use or share payment data with third parties for behavioral targeting;

  • Access Restriction and User Choice: whether the companies have taken any steps to restrict merchants and other companies from accessing and using their payment systems, and whether the companies encourage or require users of their other products or services to use their own payment systems; and

  • Other Consumer Protections: whether the companies prioritize robust consumer protection in line with consumers’ expectations and under financial privacy laws, including the Gramm-Leach-Bliley Act and the Electronic Fund Transfer Act.

In an official statement, CFPB Director Rohit Chopra indicated that the CFPB also will study the payment system practices of major Chinese payment platforms, such as Alipay and WeChat Pay, to further inform the agency’s work in this area.

The deadline for companies to comply with these orders is December 15, 2021. The information provided pursuant to these orders may also be used in connection with potential rulemaking under Section 1033 of the Dodd-Frank Wall Street Reform and Consumer Protection Act.

Copyright © 2021, Hunton Andrews Kurth LLP. All Rights Reserved.National Law Review, Volume XI, Number 308
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement

About this Author

In today’s digital economy, companies face unprecedented challenges in managing privacy and cybersecurity risks associated with the collection, use and disclosure of personal information about their customers and employees. The complex framework of global legal requirements impacting the collection, use and disclosure of personal information makes it imperative that modern businesses have a sophisticated understanding of the issues if they want to effectively compete in today’s economy.

Hunton Andrews Kurth LLP’s privacy and cybersecurity practice helps companies manage data and...

212 309 1223 direct
Advertisement
Advertisement
Advertisement