Last week, the Consumer Financial Protection Bureau (CFPB) issued an interpretive rule addressing the activities of digital marketing providers who provide services for financial firms. The ruling establishes that digital marketers involved in the identification or selection of prospective customers or the selection or placement of content to affect consumer behavior will be considered “service providers” and, thus, subject to the Consumer Financial Protection Act of 2010 (CFPA), including its prohibition on unfair, deceptive, or abusive acts or practices (UDAAPs). Accordingly, such marketers can be held liable by the CFPB, the states and or other consumer protection enforcers.

By way of background, the CFPA establishes the Consumer Financial Protection Bureau (CFPB) as the Federal government's primary regulator of consumer financial products and services. Similar to the FTC Act, the Consumer Financial Protection Act prohibits "unfair, deceptive, or abusive," acts or practices, though the CFPB's jurisdiction is limited to practices in connection with "any transaction with a consumer for a consumer financial product or service, or the offering of a consumer financial product or service." The Act further establishes that “any person that provides a material service to a covered person in connection with the offering or provision by such covered person of a consumer financial product or service” shall be considered a “service provider,” also covered by the Act.

However, the Act contains an exception for companies that solely provide time or space for an advertisement for a consumer financial product or service through print, newspaper, or electronic media: the so-called “time or space exception.”  The CFPB’s ruling establishes that this “time or space” exception does not cover firms that are “materially involved in the development of content strategy.” As the CFPB’s press release states, “[d]igital marketers… seek to maximize individuals’ interactions with ads. They may harvest personal data to feed their behavioral analytics models that can target individuals or groups that they predict are more likely to interact with an ad or sign up for a product or service.”  Such marketers are, “ play[ing] …a…significant role in determining which specific users see digital advertisements.”

These activities distinguish them from marketers that simply “try to purchase time and space for a TV commercial on the most watched station or show”  or “traditional media sources such as newspapers or radio” who are simply “selling airtime or physical space” and acting as “passive conduits of information provided by their customers.” Notably, the ruling also makes clear that digital marketers engaged in ad targeting and delivery may operate the websites or platforms on which ads appear, or they may not. But, in either case, through their targeting activities, they “serve as an intermediary between the financial services company and consumers.” This is true if they target and deliver advertisements to users with certain characteristics based on their algorithms and data, even if those characteristics are specified by “the covered person,” i.e., their client.

The ruling itself does not address when specific ad targeting activities will be considered unfair, deceptive or abusive.  As the press release simply notes, “depending on how these practices are designed and implemented, behavioral marketing and advertising could subject firms to legal liability.” However, the ruling’s reference to the 2019 action against Facebook by the U.S. Department of Housing and Urban Development is a hint. That action alleged that “[b]ecause of the way Respondent designed its advertising platform, ads for housing and housing-related services are shown to large audiences that are severely biased based on characteristics protected by the Act.”  (In June, in its first case challenging algorithmic bias under the Fair Housing Act, the Justice Department announced a settlement with Meta, formerly Facebook, resolving allegations that Meta’s housing advertising system discriminates against Facebook users based on their race, color, religion, sex, disability, familial status and national origin.)

This ruling is, of course, limited to an interpretation of the CFPA and to the activities of those entities under its purview. However, as we know from a previous CFPB ruling, that does not just mean banks. But even companies engaged in targeting and behavioral marketing outside of the realm of financial services would be wise to take note.  As the FTC itself has made clear, the use of targeting and marketing techniques that have a disproportionate impact on consumers of color or other historically disadvantaged groups, or that are otherwise discriminatory or unduly invasive of consumers’ privacy, can be subject to its scrutiny, and potentially an enforcement action if determined to be an unfair or deceptive act or practice.