Five ways the CFPB could rein in Facebook

June 28, 2022 2:45 PM

Rohit Chopra, the director of the Consumer Financial Protection Bureau, is laying the groundwork to rein in Facebook and other Big Tech companies with expanded oversight — and potentially a public rebuke — on how they collect and sell consumer data.

Meta Platforms’ Facebook has long been in Chopra’s sights. He wrote a scathing rebuke of what he called Facebook’s “illegal data practices” in 2019 while serving on the Federal Trade Commission.

At the time, Chopra lamented that the FTC’s $5 billion settlement with Facebook for privacy violations was too small given the social media giant’s status as a repeat offender of regulatory orders. Chopra wanted CEO Mark Zuckerberg and COO Sheryl Sandberg to be held personally liable and has called for more restrictions on the tech giant’s ad-driven practices.

Consumer Financial Protection Bureau director Rohit Chopra, center

Since taking control of the CFPB in October, Chopra has made several moves to bolster the CFPB’s authority to designate Facebook or any other Big Tech firm as posing a risk to consumers.

“It’s clearly one of Director Chopra’s desires to bring the Big Tech companies within the purview of the CFPB’s regulatory oversight,” said Jenny Lee, a partner at ArentFox Schiff. “It’s a new emphasis and there are a half a dozen ways to go after Big Tech.”

For the past few months, Chopra has laid out an arsenal of tools against large financial firms that were informed by his analysis of the FTC’s Facebook settlement. He has dug into the CFPB’s broad authority, found obscure new mechanisms to use and highlighted existing Dodd-Frank Act rules to shine a light on Facebook’s consumer practices.

The CFPB declined to comment for this story, and Facebook did not respond to a request for comment.

Taking action any Facebook, which had $86 billion in revenue last year, appears to be a priority though it could strain the CFPB’s resources and may come at the expense of other enforcement actions.

“It looks like he’s taking his time to set up the chess pieces on the board,” said Richard Horn, co-managing partner at Garris Horn and a former CFPB senior counsel and special advisor. “That’s probably why we haven’t seen a lot of enforcement actions, in terms of quantity, because those investigations take a ton of research and back-and-forth between CFPB attorneys and Big Tech companies in general.”

Here are the five main ways the CFPB could use its authority to enforce laws against Facebook and other technology firms.

The no-longer-dormant nonbank supervisory authority

In April, Chopra announced that it will ratchet up examinations of nonbank financial companies that specifically pose risks to consumers. The CFPB invoked what it called a little-used provision in its regulatory toolbox though it has had the authority to do so since 2013 but never used it.

That authority empowers Chopra to publicly declare a specific nonbank to be a risk to consumers, known as a risk determination. For Facebook, a risk determination would likely focus on its ad-driven business model of collecting, harvesting and selling consumer data and payments information.

“The ultimate issue is where the consumer risk is,” said Tony Alexis, a partner at Goodwin Procter and a former CFPB assistant director and head of enforcement. “Facebook or Meta has several different platforms including a payment system. As an aggregator selling that data to different institutions, there may be risks associated with the data.”

Alexis noted that the CFPB already has broad authority under the Dodd-Frank Act to supervise nonbanks in the mortgage, payday and private student loan markets. The bureau also has oversight of large depository institutions that have $10 billion in assets or more.

The dormant authority is a third category of entities whose activities pose risks. Chopra said the authority itself is not particular to any specific product or service, though he did cite the rapid growth of nonbanks. He also has said that the ability of large tech firms to rapidly scale up in payments is alarming.

“This authority gives us critical agility to move as quickly as the market, allowing us to conduct examinations of financial companies posing risks to consumers and stop harm before it spreads,” Chopra said.

Though supervisory information is not public, the CFPB wants to publicize the name of any company that poses a risk to consumers, thereby giving consumers a warning that doing business with the company may not be in their best interest.

“They changed the rule to make the decision public, and the CFPB could actually be using that authority now and no company would want this publicized,” Horn said. “Can you imagine the company out there that the CFPB says is posing a risk to consumers and what happens when the CFPB publicizes it?”

Any company that is given a “risk determination” by the CFPB has roughly a week’s notice to respond to the CFPB. Chopra gets to decide if a final order against any company should be publicly released on the bureau’s web site, with proprietary information redacted.

“The statute allows them to pursue this additional flavor of supervisory reviews,” Lee said. “But it’s important to issue public announcements in order to place the industry on alert.“

Opening up Facebook’s ‘black box’ algorithms

Just last week, Facebook agreed to settle claims by the Justice Department that alleged it engaged in discriminatory advertising. Facebook’s parent Meta agreed to pay a fine of roughly $115,000, the maximum allowed under the Fair Housing Act.

The settlement was hailed as one of the first significant federal actions involving allegations that Meta used algorithms to determine which Facebook users would receive housing ads based on characteristics such as race, sex and national origin, in violation of the FHA.

Chopra has told financial firms repeatedly that he thinks there are problems with artificial intelligence and machine learning, the type of predictive analytics that forms the core of Facebook’s behavioral advertising business model.

“The CFPB’s focus is likely to include the reliance on data algorithms and proprietary technologies in relation to consumer-facing products and services,” said Lee.

Bartlett Naylor, a financial policy analyst at Congress Watch, a unit of consumer advocacy group Public Citizen, wants the CFPB to determine how Facebook exploits and sells consumer transaction data. He cited the tech giant’s plans in 2019 to launch a cryptocurrency called Libra, which it quickly abandoned in part after pushback from Washington, as part of its larger effort to monetize its roughly 2.4 billion monthly users.

“Facebook could dominate not only the payment system, but broader commerce,” Naylor said. “It might favor one vendor over another, or begin selling its own products using the knowledge it gains from data about other transactions to push out competitors. How will consumers be protected?”

The CFPB could use its existing authority to conduct oversight of algorithms and machine learning and determine whether the models reveal biases particularly in marketing to protected classes.

But it remains unclear how, or even if, fair lending laws that prohibit redlining and discrimination would apply to payment service providers. Chopra has claimed that machine learning can be anti-competitive and could lead to “digital redlining” and “robo-discrimination.”

Most of the large tech firms are not extending credit yet to consumers in the form of loans. Rather they are using algorithms and operating as third-party service providers to thousands of companies.

Consumer portability and data access rules

The CFPB is working on a rule that will set the parameters around how much control consumers should have over their financial data. Chopra is extremely skeptical of technology companies’ motives though criticism of Facebook appears to be in a realm of its own.

“This thirst for data has led the company to harvest intimate, personal details about tens of millions of Americans on a scale and scope that are almost unimaginable,” Chopra wrote of Facebook in 2019.

The rule is expected to place data aggregators and third-party vendors under the direct supervision of the CFPB. The bureau expects in November to release an outline of its data access rule, known as Section 1033 of the Dodd-Frank Act. The rule is expected to set standards that would allow consumers to give third-party companies access to their bank transaction data.

While at the FTC, Chopra alleged that Facebook’s tactics involved “tricking users into sharing excessive amounts of personal data and getting paid by third parties to target individual users.”

Lawmakers on both sides of the aisle have shown a keen interest in the rule. At a recent House Financial Services Committee hearing, Rep. Sean Casten, D-Illinois, asked if the CFPB was investigating Facebook.

“Do you have the authority, can you see inside to see how those algorithms work?” Casten asked Chopra. “Facebook said that once you import all the data into their platform — your age, your race, your address, your income levels, your purchasing history — they can’t even keep track of where all the data goes.”

Several lawmakers also cited data showing consumers have little, if any, understanding of how their data is used, sold and monetized. Many urged Chopra to act.

Issuing civil investigative orders

In October, Chopra made waves by publicly demanding that Amazon, Apple, Alphabet’s Google, Meta’s Facebook, PayPal and Square turn over reams of information about consumer payments.

The CFPB also has been issuing civil investigative demands asking for information and gathering data for enforcement, supervision and rulemaking.

“They are doing a lot of prep work, they’ve done a ton of [requests for information], the Buy Now Pay Later research orders and are doing a lot to expand who they can examine,” Horn said.

But data gathering may not necessarily be producing the information that the CFPB is looking for to make a legal case.

“It really depends on if the companies responded to the types of information [Chopra] asked for and he’s asking for a lot of information,” said Alexis, the former CFPB enforcement director.

In 2019, when Chopra was the FTC, he cited “multiple inconsistencies and deficiencies in Facebook’s responses to questions,” raising concerns that the company was less than forthcoming in producing information. He also claimed that FTC “would have limited visibility,” into Facebook’s conduct.

Some suggest that whatever data the CFPB does uncover in its data requests could be used to enforce its general federal prohibition on “unfair, deceptive and abusive acts and practices,” known as UDAAP.

“Facebook is one of the most threatening corporations to consumers and is so big that fines don’t cause management to change,” said Naylor, who cited reports of the tech giant’s data being used by Cambridge Analytica, the political consulting firm, in 2018 to target voters.

Chopra has lambasted tech companies generally for collecting massive amounts of data on a consumer’s purchasing and web browsing activity.

“Even when companies like Facebook dispute that they are engaging in activities akin to mass surveillance or manipulation, their business incentives strongly motivate them to do so and their technology enables it, regardless of whether or not it is a deliberate business decision,” Chopra wrote at the FTC.

In-house adjudication proceedings

Like many federal agencies, the CFPB is allowed to sue companies that violate the law in federal court or through an in-house administrative proceeding, where the matter is initially decided by an administrative law judge. Ultimately the CFPB’s director’s issues a final decision.

In February, Chopra made a number of changes to adjudication procedures, expanding the powers of the director to decide disputes. Some suggested the changes signal that the bureau may start bringing more enforcement cases in-house.

“They are spending time investigating large institutions and they are spending time changing the rules on administrative adjudications to give the director new authorities that weren’t in the rules before,” Hunt said.

One of the changes would allow the director of the CFPB to split a case into two stages to promote efficiency. But the result would be that Chopra would have the authority to issue a decision on whether a company violated the law at the first stage, and at the second stage, to issue a final decision and determine any remedies.

Many lawyers defending financial firms initially cited the changes to the CFPB’s administrative authority as a sign that the bureau would engage in more administrative actions.

But in May, the U.S. Court of Appeals for the Fifth Circuit threw cold water on the CFPB’s plans. The court ruled that the Security and Exchange Commission’s administration proceedings are unconstitutional, leading many to expect the CFPB would be challenged in trying to bring administrative cases.