CFPB seeks input on protections for digital payments, crypto

With under two weeks before the end of the Biden administration, the Consumer Financial Protection Bureau issued two actions on Friday aimed at providing privacy protections in digital payments and crypto assets offered by Big Tech companies and video gaming platforms. 

The actions are widely expected to be rescinded by a new incoming acting CFPB director appointed by President-elect Trump. 

Both actions — a nonbinding interpretive rule on how existing law applies to digital payments, and a request for information on how payments companies use consumer data to create personalized pricing — are aimed at Big Tech companies.

President-elect Trump has embraced cryptocurrency, signaling a lighter regulatory touch for crypto, stablecoins and other forms of digital payments. Banking experts have warned of the dangers of digital assets firms being permitted to engage in banklike activities without facing the limitations — and costs — associated with bank regulatory regimes.

The CFPB’s proposed interpretive rule asks for public comment on how the Electronic Fund Transfer Act, which provides consumers with protections against errors and fraud, applies to digital payments offered by large technology companies and video gaming platforms including stablecoins and other digital currencies. 

CFPB Director Rohit Chopra said the bureau wants input on how data collected by tech firms is being used to create specialized pricing for consumers. Comments on the interpretive rule are due by March 31.

“When people pay for their family expenses using new forms of digital payments, they must be confident that their transactions are not tainted by harmful surveillance or errors,” CFPB Director Rohit Chopra said in a press release. “The CFPB is seeking public input on how to apply longstanding consumer and privacy protections to new and emerging payment mechanisms.”

The bureau also issued a request for information on privacy protections in digital payments. The bureau said that comments to the RFI will help the agency better understand how companies are using and selling consumer data collected from digital payments. Comments to the RFI are due by April 11, 2025.

The CFPB said it is trying to protect consumers using digital payments including those offered by video game platforms that use so-called “proprietary currencies” that players use to purchase and sell items and services. 

In the proposed interpretive rule, the bureau said that some gaming platforms have “developed elaborate economies where the platforms accept U.S. dollars in exchange for virtual currency that can be transacted among players and other platform participants, and even exchanged back to U.S. dollars in certain circumstances.”

Some consumers have experienced losses in their accounts through hacking attempts, account theft, scams and unauthorized transactions, the bureau said.

The issue of digital payments is complicated, experts say, because the Electronic Fund Transfer Act of 1978 is woefully out of date. Most consumers do not know that there is a difference between sending digital or instant payments that are not connected to an underlying bank account and do not have the same consumer protections as credit cards.

The CFPB said that its proposed interpretive rule on the Electronic Fund Transfer Act “would ensure that consumers can consistently invoke their rights under federal law, while also assisting market participants developing these payment mechanisms.”

The bureau said it also released the public comment notices “to ensure that traditional banks and credit unions are not put at a competitive disadvantage when new market entrants seek to circumvent federal law.”

In November, the CFPB finalized a rule to supervise the largest nonbank companies that offer digital funds transfers and payment wallets. While the bureau did not name the companies, experts identified payment giants Apple, Google, PayPal and others that the CFPB has long sought supervisory authority over to conduct proactive examinations to make sure that the companies are complying with the law. The CFPB already has enforcement authority over large payments companies.

Currently, the federal framework for financial data privacy protections consists largely of the Gramm-Leach-Bliley Act, which is largely built around disclosures and opt-out requirements that experts have said do not fully address the challenges posed by modern payments companies.