The CFPB’s data broker proposal exposed a provenance gap that AI programs inherit

The week

On December 3, 2024, the Consumer Financial Protection Bureau proposed a rule under the Fair Credit Reporting Act aimed at data brokers. It would have treated companies that sell certain personal information, such as income or financial tier, as consumer reporting agencies regardless of how the buyer used the data. It also proposed treating “credit header” information held by the credit bureaus as part of a consumer report. That covers identifiers such as names, addresses, birth dates and Social Security numbers, which could then not be sold without a permissible purpose. The Bureau framed the proposal around privacy, national security and the protection of groups such as domestic violence survivors and military personnel. It followed a year of public concern about brokers, including the National Public Data breach in August, which an earlier article in this series discusses.

The proposal was ambitious and, as it turned out, short-lived. Its core question outlasted it: for any piece of personal data an organization uses, can it say where the data came from and what it may be used for? That question had always applied to marketing and underwriting files. By late 2024 it applied with more force to AI programs. They combine data from many sources and keep copies in training sets and vector stores. They also use it for purposes no one had in mind when it was collected.

Personal data moves relative to an organization in three ways. It enters, through purchase or licensing. It leaves, through sharing and sale. And it is repurposed inside, when data collected for one use is reused for another, including model training and retrieval. Every provenance question falls into one of these three, and each has a different owner: procurement for inbound data, privacy and legal for outbound, and data and AI teams for repurposing.

Data that enters: knowing what you bought

Banks buy data for marketing, fraud prevention, identity verification and underwriting. Health systems buy it for population health, outreach and patient matching. Agencies buy it for investigations, eligibility checks and analysis. Much of it comes from brokers that assemble records from many sources.

The FCRA already applies when data is used for eligibility decisions about credit, insurance, employment and certain other purposes. Those uses bring duties: permissible purpose, adverse action notices and reasonable accuracy procedures. The proposal would have widened the set of regulated data. Even without it, an organization should keep a register of purchased datasets that records the vendor, the license terms, the intended use and whether the data feeds any decision about an individual. Where it does, the organization should know whether the vendor acts as a consumer reporting agency. Public agencies face an additional question: whether buying data lets them obtain what they could not lawfully collect directly. Counsel should review those purchases.

Vendor diligence for data brokers differs from diligence for software. The key questions are how the broker sourced each field, whether the original data subjects were told it could be sold, how often records are refreshed and how errors are corrected. A broker that cannot describe its sources for a field is asking the buyer to accept that field’s legal and accuracy risk.

Data that leaves: knowing where it goes next

Financial institutions share data with affiliates and partners under Gramm-Leach-Bliley rules. Health systems share it under HIPAA for treatment, payment and operations, and with business associates. Many organizations also send data to advertising and analytics providers through website and app tracking tools. In 2023 and 2024 the FTC and HHS brought actions and issued guidance on exactly that kind of leakage.

The outbound questions are what leaves, to whom and under what restrictions. Contracts with recipients should prohibit onward sale and reuse beyond the stated purpose, with audit rights to check. Tracking technologies on public pages should be inventoried, because they can transmit identifiers and browsing data without any contract at all. A simple test is uncomfortable but useful: could your own customers’ or patients’ data reappear in a broker’s dataset? If the answer is unclear, the outbound controls are incomplete.

Data repurposed inside: knowing what models were built on

The third movement is the newest and the least governed. Models are trained, fine-tuned and evaluated on data, and retrieval systems pull documents into model prompts at runtime. Each use can involve personal data from purchased, shared or internal sources, collected under terms that never contemplated AI.

Provenance matters here for legal and technical reasons. Legally, a license for purchased data may not permit model training. Data collected under a specific consent, such as a research authorization, may not extend to building a commercial model. Technically, data of unknown origin can carry errors and bias that are hard to detect once embedded in a model. The control is a training data record for each model: the datasets used, their sources, the permissions attached, sensitive categories present and the date of each version. Model risk management teams in banks will recognize it as documentation they already expect for traditional models.

Retrieval needs the same discipline at runtime. A model that can search a document store can surface personal data to users who would not otherwise have access, or combine sources in ways the original permissions did not allow. Access controls on the underlying documents must carry through to what the model can retrieve. Deletion must carry through too. When a consumer exercises a deletion right, the request should reach vector stores and fine-tuning sets, not only the system of record.

An organization that can trace data across all three movements can adapt to whichever rule arrives next, federal or state. One that cannot will repeat the same discovery exercise for each new requirement.

With hindsight

The CFPB withdrew the proposal in May 2025, alongside other withdrawals under new leadership. The federal effort stopped there; state activity did not. Under California’s Delete Act, consumers could send one deletion request to all registered data brokers through the state’s DROP platform from January 1, 2026. Brokers had to begin processing those requests on August 1, 2026. Other states kept adopting privacy laws that address the sale of personal data. A Justice Department rule restricting bulk transfers of sensitive personal data to countries of concern, finalized in late 2024, took effect in April 2025 and added a national security test to outbound sharing. For organizations, each of these reached a different movement of data, which is the practical case for tracing all three in one register.