On January 12, the California Department of Financial Protection and Innovation (DFPI) issued a second invitation for comments on potential regulations under the California Consumer Financial Protection Law (CCFPL) that would require registration and reporting by firms engaged in consumer reporting and related data activities. Comments are due by February 26.
This is a pre–rulemaking process, but it is an important signal that DFPI is preparing to extend its new CCFPL registration regime to consumer reporting and data players operating in California.
Background
In 2020, Assembly Bill 1864 created the CCFPL, significantly expanding DFPI’s authority over nonbank financial services in California. Among other things, the law authorizes DFPI to require “covered persons” to register and report information, even if they are not otherwise licensed by DFPI.
In October 2024, DFPI finalized its first CCFPL registration and reporting regulations, effective February 15, 2025. Those rules created a new registration regime for four categories of previously unregistered providers:
- Income-based advance providers;
- Private postsecondary education financing providers;
- Debt settlement service providers; and
- Student debt relief service providers.
In October 2024, DFPI issued an initial invitation for comments on whether and how to extend registration and reporting to additional categories of “covered persons.” DFPI received only four comment letters. With this second invitation, DFPI is signaling continued interest in expanding CCFPL registration. Specifically, DFPI is seeking input on requiring registration and reporting from persons that “collect, analyze, maintain, or provide” consumer report information or other account information used in connection with decisions about consumer financial products or services.
Key Issues DFPI Wants Comment On
Although DFPI poses nearly 30 questions, there appears to be four main themes:
- Consumer and Market Concerns.
DFPI asks what practices by consumer-reporting providers benefit consumers and which cause harm. It seeks input on concerns that justify prioritizing supervision of this sector, whether particular segments (such as specialty reporting) warrant special attention, and what risks are presented by data brokers, aggregators, and other intermediaries in the consumer-data chain. DFPI also asks how potential rulemaking could address those concerns. - Definitions and Coverage.
The DFPI specifically wants feedback on how the CCFPL definition in § 90005(k)(9) compares to definitions in federal and state laws such as the Consumer Financial Protection Act, the Fair Credit Reporting Act (FCRA), and California’s Consumer Credit Reporting Agencies Act (CCRAA). It asks whether terms like “consumer report,” “consumer report information,” “account information,” and “consumer financial product or service” should be further defined or clarified in the consumer-reporting context, and whether exemptions in the CCFPL should be clarified as applied to consumer reporting agencies, data brokers, aggregators, resellers, and furnishers. - Registration, Reporting, and Oversight Requirements.
DFPI is also testing what an eventual registration regime for consumer-reporting providers would look like. It asks whether:- Existing CCFPL registration rules should be modified for this sector;
- “Gross income from consumer-reporting services” needs clarification;
- Consumer-reporting providers should be required to maintain specific records, and if so, which ones; and
- Bonding or other financial responsibility requirements are appropriate, and whether waivers should be permitted.
- Reasonable Alternatives and Scope.
Finally, DFPI invites suggestions on reasonable alternatives, including whether some other product or service (other than consumer reporting) should be the subject of this rulemaking, and whether there are less burdensome but equally effective ways to achieve the CCFPL’s purposes (such as promoting consumer welfare, fair competition, and transparency).
Comment Process and Deadlines
This is a pre‑rulemaking invitation for comments, not a formal proposed regulation, but DFPI will use this input to shape any later rule text. Written comments must be received by February 26, 2026.