Dodd-Frank Act Section 1033 and CFPB Personal Financial Data Rights Rule
Section 1033 Rule
Financial
Section 1033 gives consumers a right to access their financial account data. The CFPB's 2024 rule would require providers to share data through interfaces and would limit third parties' collection, use, and retention of that data to what the consumer requested. Compliance dates (originally April 1, 2026 to April 1, 2030) are stayed, and the CFPB opened a reconsideration (ANPR, Aug. 22, 2025).
- Where
- Federal
- Citation
- 12 U.S.C. 5533; 12 CFR Part 1033
- Status
- Blocked by a court
- In force since
- 2025-01-17
- Enforced by
- Consumer Financial Protection Bureau
- People can sue
- No
- Penalties
- CFPA penalties would apply, but the rule's compliance dates were stayed by court order on Oct. 29, 2025 (Forcht Bank, N.A. v. CFPB, E.D. Ky.) while the CFPB reconsiders the rule.
- Applies to
- Covered data providers: depository institutions and card issuers and payment facilitators offering covered accounts
- Authorized third parties and data aggregators accessing consumer financial data
What a privacy notice must say
- Third parties must give an authorization disclosure and obtain the consumer's express informed consent.12 CFR 1033.401, 1033.411
Rights it gives people
- Data providers must make covered data available to consumers and authorized third parties on request.12 U.S.C. 5533(a); 12 CFR 1033.201
Practices it requires
- Third parties must limit collection, use, and retention to what is reasonably necessary to provide the product the consumer requested; secondary uses such as targeted advertising or data sales are barred.12 CFR 1033.421(a)(1)-(2)
Security duties
- Third parties must apply GLBA-level information security to covered data.12 CFR 1033.421
Sources
- Official text
- 12 CFR Part 1033 (eCFR)
- 12 U.S.C. 5533 (OLRC)
- CFPB, Personal financial data rights compliance page (stay notice)
- CFPB, Personal Financial Data Rights Reconsideration ANPR, 90 FR 40986 (Aug. 22, 2025)
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: 12 CFR 1033.401 and 1033.411 wording and the GLBA-security requirement in 1033.421 were not re-read (1033.421(a) was) | Status 'enjoined' reflects a court stay of compliance dates; the statute itself remains in force
Research reference, not legal advice.