12 minute read | March.06.2025
Over the past four years, the Consumer Financial Protection Bureau has sought to strengthen state and local governments’ enforcement of consumer protection laws. The CFPB has engaged in numerous coordinated federal-state investigations and enforcement actions since its creation in 2011, and under the recent leadership of former-Director Rohit Chopra, the CFPB published two significant documents to provide the states with a roadmap on how to more effectively enforce state and federal consumer protection laws.
In 2022, the CFPB released an interpretive rule, Authority of States to Enforce the Consumer Financial Protection Act of 2010, which outlined the legal authority for states to enforce federal consumer protection laws directly—even without the intervention of the CFPB. And in January 2025, during the agency’s lame-duck period at the end of the Biden administration, the CFPB issued a report entitled Strengthening State-Level Consumer Protections which described how states can enhance their own laws to further the CFPB’s enforcement priorities.
The CFPB’s 2022 interpretive rule reaffirmed states’ authority under Section 1042 of the Dodd-Frank Act to act independent of the Bureau. While the Dodd-Frank Act is primarily known for creating the CFPB and establishing its broad UDAAP authority, Section 1042 empowers state attorneys general and state financial regulators to enforce Title 12 of the U.S. Code or any “regulations issued under” Title 12. This covers a wide swath of laws, including the Equal Credit Opportunity Act, Truth in Lending Act, Truth in Savings Act, Electronic Funds Transfer Act, Real Estate Settlement Procedures Act, and other core federal financial services statutes. If a state brings an action under Section 1042, it must notify the CFPB, and the CFPB retains the right to intervene and remove the action to federal court, be heard in the action, and “appeal any order or judgment, to the same extent as any other party in the proceeding.”
Beyond noting states’ authority to bring actions under these laws, the CFPB argued for states’ broad authority and independence under Section 1042 in two critical ways:
Beyond the authority of states to enforce federal consumer protection law discussed in the 2022 interpretive rule, in January 2025 the lame-duck leadership of the CFPB published a report recommending that the states make certain changes to their law enforcement priorities. While styling these as ways states can “modernize the standards of fair dealing using models already existing in state of federal law,” these recommendations identify seven areas where states could use state law to further the Chopra-era CFPB’s priorities.
The CFPB’s 2025 report augmented its recommendations with concrete actions and model statutory language for states to implement the suggestions. These seven proposals—discussed in greater detail below—would enable states to carry on the Biden-era priorities during the Trump Administration.
The CFPB recommended that states add the “abusiveness” language from the Dodd-Frank Act to their own state consumer protection laws. Such changes would prevent any act or practice that “materially interferes” with the consumer’s ability to understand financial products or “takes unreasonable advantage of” the consumer’s lack of understanding, inability to protect their own interests, or reasonable reliance upon a provider of financial products. The CFPB also recommended that states explicitly include a “rule of construction” that this language be interpreted in a way consistent with the CFPB’s 2023 policy statement on abusiveness. The CFPB points to California as a state that already has done this and New York as a state that has introduced legislation that would include this in its Consumer and Small Business Protection Act.
According to the CFPB, providing states with abusiveness authority would alter the consumer protection landscape in two important ways:
Specifically, the CFPB proposed that states consider adding the statutory language and rule of construction to state law to provide state enforcement agencies with abusiveness authority:
§ Abusive Acts or Practices Prohibited. Abusive acts or practices in the conduct of any trade or commerce are hereby declared unlawful.
§ Abusive Definitions. “Abusive” means an act or practice which:
§ Rule of Construction. It is the intent of the Legislature that, in construing Section 1, the meaning of the prohibition on abusive acts or practices will be consistent with the framework summarized in the Policy Statement on Abusive Acts or Practices issued on April 3, 2023.
The CFPB recommended that states amend their laws to provide expansive investigative authority and enforcement powers. Specifically, the CFPB recommended that state laws:
The report also recommends that states hold corporate officers personally liable and consider how officer liability generally plays a role in their programs. Finally, the report suggests states should consider creating funds similar to the CFPB’s Civil Penalty Fund.
States, like the federal government, have concentrated enforcement authority for certain statutes in specific agencies for consistency. If adopted, the CFPB’s recommendations would both increase state enforcement power and, through city and municipal authority, create a far broader and more diverse and uncertain consumer protection landscape.
The CFPB recommended that states permit UDAAP claims even when the party bringing the action cannot prove an ascertainable loss by consumers, reliance by consumers on a misleading or false claim, or monetary harm. The CFPB also recommended that states ensure parties can bring claims for non-monetary and harder-to-quantify claims for “lost time, loss of privacy, or loss of security” and that the “economic loss” doctrine that prevents parties from filing contract-based claims in tort not apply to state consumer protection statutes. Notably, the CFPB recommended these laws cover both “public or private” enforcers, potentially allowing any consumer who believes they have identified a harmful practice to bring a claim, even if that consumer cannot demonstrate actual harm.
By eliminating the requirement to show loss or monetary harm, the CFPB’s recommendations may conflict with federal law on standing, which requires plaintiffs to demonstrate that a defendant harmed them to file suit in federal court. In fact, the CFPB noted the conflict with federal standing in a footnote to its report and seemed to suggest that states should take a broader view on standing than the Supreme Court.
Specifically, the CFPB proposed that states consider adding the language below so state enforcement agencies can bring UDAAP claims without needing to prove monetary damages:
§ Burden of Proof. A public or private enforcer need not prove the following in order to establish a claim under § [cross-reference to state UDAAP standard]:
(a) Ascertainable loss to consumers or the class;
(b) Reliance by consumers on a misleading or false claim;
(c) Monetary harm.
The CFPB recommended that states revise the definition of “consumer” in their consumer protection statutes to include “an individual, company, or organization, or an agent, trustee, or representative acting on behalf of an individual, company, or organization.” The CFPB reasoning — that a business-to-business practice can have “follow-on effects on individuals” — would capture both solo entrepreneurs and small businesses tied closely to their owners, as well as potentially businesses of any size.
At the federal level, the FTC’s UDAP authority covers practices that affect consumers and businesses. However, a 5-member commission supported by professional staff trained in consumer protection, antitrust, and economics moderates the FTC’s authority. When combined with the above proposal to eliminate the economic harm doctrine, empowering both government agencies and private parties to bring claims business-to-business transactions would significantly expand both enforcement and litigation risk for companies.
The CFPB recommended that states expand the definition of “consumer” under their UDAAP statutes using the language below:
Consumer. The term “consumer” means an individual, company, or organization, or an agent, trustee, or representative acting on behalf of an individual, company, or organization.
In 2017, the CFPB issued a rule banning arbitration clauses in financial contracts. Congress struck down that rule through a Congressional Review Act resolution, which also prevents the CFPB from issuing a “substantially similar” rule. Now the former administration of the CFPB is asking the states to do what it cannot: limit the use of arbitration clauses. The Bureau recommended that state legislatures amend their UDAP statutes in the following ways:
These recommendations attempt to leverage areas where the Supreme Court has permitted private litigation under state law theories, notwithstanding the Federal Arbitration Act and mandatory arbitration clauses in consumer contracts.
To further incentivize private litigation on consumer claims, the CFPB also suggested that states implement attorney fee-shifting provisions, treble and statutory damages, and variable compensation based upon recovery to consumers. While the CFPB recommended that state attorneys general maintain oversight and objections rights for actions brought on behalf of the state, it is unclear if this will result in state agencies limiting claims brought by private plaintiffs—or if attorneys general will use this authority to push for even higher penalties from companies.
Echoing concerns the CFPB raised when issuing its proposed data broker rule in December 2024, the CFPB indicated that consumer data is at risk from “scammers, stalkers, or even hostile foreign powers.” The CFPB recommended that states enact privacy rights similar to those in the California Consumer Protection Act and the other 18 general state privacy laws in effect, including:
Notably, the CFPB criticized existing state privacy law exemptions for financial institutions and financial data under the Gramm-Leach-Bliley Act (“GLBA”) and called for those exemptions to be removed. While some states, such as California and Oregon, do not provide blanket entity-level GLBA exemptions for financial institutions, most do. Further limits to the GLBA exemption could shift the financial services landscape.
Continuing the Biden era criticism of certain revenue streams for financial services businesses, the CFPB recommended that states prohibit companies from imposing “junk fees,” which the CFPB defines as hidden fees, misleading fees, or “price gouging.” The CFPB defined price gouging as charging for “add-ons, concessions, or ancillary services” that exceed the reasonable costs of providing additional services when these services are not available from multiple providers, engaging in revenue-sharing from third-party providers for additional services, or charging fees for goods or services that consumers would “reasonably expect to be part of the originally purchased good or service.”
The CFPB stated that there is a need for greater clarity and a “bright-line prohibition” of junk fees. However, the CFPB also acknowledged that state laws already address this area and did not address why certain practices, such as revenue sharing, should be prohibited. The need for such action is also unclear, as several states are already focused on fee issues; in January, for example, the New York Department of Financial Services issued proposed regulations that would limit overdraft and insufficient funds fees for state-chartered banks subject to its jurisdiction.
To address so-called junk fees, the CFPB recommended that states add the following language to state law:
§ Prohibition of Junk Fees
(a) Hidden Fees Prohibited. It is an unfair and deceptive practice for any business to offer, display, or advertise any price of a good or service without clearly and conspicuously disclosing the total price.
(b) Misleading Fees Prohibited. It is an unfair and deceptive practice for any business to misrepresent the nature and purpose of any amount a consumer may pay, including the refundability of such fees and the identity of any good or service for which fees are charged.
(c) Price Gouging Captive Consumers Prohibited.
(1) It is an unfair and deceptive practice to charge consumers who have already purchased a good or service more for any additional goods or services (including add-ons, concessions, or ancillary services) than a reasonable approximation of the costs to the business of providing that additional good or service, if the consumer cannot purchase the additional good or service from multiple providers.
(2) If additional goods or services are provided by a third-party partner, it is an unfair and deceptive practice to receive kickbacks or revenue sharing from that third-party partner.
(3) It is an unfair and deceptive practice to charge fees for additional goods or services that consumers reasonably expect to be part of the originally purchased good or service.
While it is too soon to fully grasp whether the CFPB’s efforts in providing a roadmap of policy priorities, draft statutory language, and guidance will ultimately be effective, it illustrates an aggressive, state-centric framework for enforcement that is likely to persist under the current Trump administration. Additionally, state financial regulators and attorneys general have a long history of effectively working together on enforcement matters, regardless of the CFPB’s priorities.
For more information and coverage on developments related to the CFPB, visit Orrick’s “CFPB Pause: Where From Here?” resource center, which is updated daily with the latest news and analysis, and follow our InfoBytes Blog for the latest consumer financial services news.