US CFPB Takes Aim At Digital Marketing Providers With New Interpretive Rule – Financial Services – United States – Mondaq

On August 10, 2022, the Consumer Financial Protection Bureau (“CFPB” or “Bureau”) issued an interpretive rule clarifying its position that digital marketers providing consumer financial services companies with customer targeting and advertisement delivery services are subject to the Consumer Financial Protection Act (“CFPA”) as “service providers.” Critically, the rule takes the position that tech companies offering such marketing services fall within the scope of the Bureau's unfair, deceptive, and abusive acts or practices (“UDAAP”) enforcement authority. Interpretive rules are exempt from the notice-and-comment rulemaking procedures under the Administrative Procedure Act but also lack the force of law.
The CFPA, including its UDAAP prohibition, applies to “covered persons” that offer or provide consumer financial products or services. The CFPA also applies to service providers to covered persons. The CFPA defines “service provider” as “any person that provides a material service to a covered person in connection with the offering or provision by such covered person of a consumer financial product or service.” However, the term “service provider” does not include those providing either “a support service of a type provided to businesses generally or a similar ministerial service” or “time or space for an advertisement for a consumer financial product or service through print, newspaper, or electronic media.” The interpretive rule addresses the application of these exceptions to digital marketers.
The rule states that when digital marketers identify or select prospective customers and/or select or place content to affect consumer engagement, they are providing a significant and, therefore, “material” service to covered persons. The rule provides that such “material” service is beyond the scope of the “ministerial service” exception to the CFPA. The rule also explains that companies providing such services do not fall within the “time or space” exception because they are providing a service that goes beyond providing “airtime or physical space” for an advertisement. The interpretive rule states that digital marketers are increasingly more involved in the development of content strategy and, thus, are increasingly more likely to be service providers under the CFPA.
The rule provides a number of examples to illustrate the difference between “material” services and those that would qualify for an exception. For example, if a digital marketer offered a covered person the ability to choose to run an advertisement on a particular webpage or application of the covered person's choosing, with the advertisements seen by any user of that page or application, the rule suggests that such activity would fall within the “time or space” exception. However, if a digital marketer targets and delivers advertisements to specific users based on certain characteristics, even if those characteristics are specified by the covered person, the rule states it likely would amount to a “material” service. When a digital marketer itself determines or suggests which users are the appropriate audience for certain advertisements (based on, for example, the marketer's knowledge of users' characteristics and behavior), the interpretive rule states that this goes “well beyond” providing airtime or physical space and a marketer would typically be considered a service provider in these circumstances.
As noted above, one of the most significant aspects of this rule is that it sets forth the position that tech companies offering these types of marketing services fall within the scope of the Bureau's UDAAP supervision and enforcement authority. Earlier this year, the CFPB announced its view that discriminatory conduct in the offering or provision of a consumer financial product or service could constitute an unfair practice for the purposes of the UDAAP prohibition. The Bureau also has expressed concern over algorithmic bias and so-called “digital redlining.” Taken together, these developments suggest that the CFPB may be planning to rely on its UDAAP authority to target what it sees as potential discrimination resulting from tech companies' use of consumer data and algorithms to target ads to consumers.
Notably, the interpretive rule still leaves open how the CFPB intends to implement this new view of “service providers.” For example, will the CFPB seek to use its UDAAP authority (both supervision and enforcement) against platforms that publish targeted advertising created by other companies? If that is the intent, the rule does not explain the agency's position regarding how Section 230 of the Communications Decency Act might affect these efforts. That statue provides, “No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider” and has been interpreted by many courts to prohibit suits against digital platforms in connection with content created by third parties.
This interpretive rule should be taken as another signal to tech companies that the Bureau is paying close attention to their use of consumer data and algorithms. This attention may result in increased enforcement activity by the CFPB and possibly also by state regulators. In announcing the rule, Director Chopra stated: “When Big Tech firms use sophisticated behavioral targeting techniques to market financial products, they must adhere to federal consumer financial protection laws . . . [f]ederal and state law enforcers can and should hold these firms accountable if they break the law.” Additionally, in a speech to the National Association of Attorneys General Presidential Summit delivered on the same day the rule was issued, Director Chopra highlighted the rule and restated the Bureau's support of state enforcement of the CFPA.
Visit us at
Mayer Brown is a global legal services provider comprising legal practices that are separate entities (the “Mayer Brown Practices”). The Mayer Brown Practices are: Mayer Brown LLP and Mayer Brown Europe – Brussels LLP, both limited liability partnerships established in Illinois USA; Mayer Brown International LLP, a limited liability partnership incorporated in England and Wales (authorized and regulated by the Solicitors Regulation Authority and registered in England and Wales number OC 303359); Mayer Brown, a SELAS established in France; Mayer Brown JSM, a Hong Kong partnership and its associated entities in Asia; and Tauil & Chequer Advogados, a Brazilian law partnership with which Mayer Brown is associated. “Mayer Brown” and the Mayer Brown logo are the trademarks of the Mayer Brown Practices in their respective jurisdictions.
© Copyright 2020. The Mayer Brown Practices. All rights reserved.
This Mayer Brown article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.
  © Mondaq® Ltd 1994 – 2022. All Rights Reserved.

Passwords are Case Sensitive

Forgot your password?
Free, unlimited access to more than half a million articles (one-article limit removed) from the diverse perspectives of 5,000 leading law, accountancy and advisory firms
Articles tailored to your interests and optional alerts about important changes
Receive priority invitations to relevant webinars and events
You’ll only need to do it once, and readership information is just for authors and is never sold to third parties.
We need this to enable us to match you with other users from the same organisation. It is also part of the information that we share to our content providers (“Contributors”) who contribute Content for free for your use.
Mondaq uses cookies on this website. By using our website you agree to our use of cookies as set out in our Privacy Policy.


Leave a Reply

Your email address will not be published. Required fields are marked *