The Consumer Financial Protection Bureau (CFPB) recently filed actions against online lead aggregator D and D Marketing, Inc. d/b/a T3Leads and its co-founders alleging unfair and abusive practices in violation of the Consumer Financial Protection Act (CFPA). The CFPB alleges T3Leads resold loan applications containing sensitive personal data without assessing the sources of the leads or the purchasers they sold to. Thus, the CFPB is once again using its power to enforce violations of the CFPA’s broad prohibition on unfair and deceptive or abusive practices to pursue companies that are not directly engaged in consumer-facing transactions in the consumer finance industry.
Lead aggregators buy consumer information—leads—from websites that market financial products. This consumer information typically contains a consumer’s name, telephone number, home address, email address, references, and employment information. Then, lead aggregators resell this information to lenders and data brokers, who use the information to try to develop relationships with the customers.
The CFPB alleges that T3Leads: (1) bought leads from lead generators with no regard for whether the lead generators’ statements to consumers on how their information would be used was false or misleading; and (2) failed to properly vet the buyers of the lead information, who "steered consumers toward bad deals with lenders" and often did not comply with state usury laws. CFPB Director Richard Cordray said these lawsuits are "a reminder to the middlemen who buy and sell consumer loan applications: if you engage in this type of conduct, you risk the consequences for harming people."
The Federal Trade Commission also recently took its first enforcement action against a lead generator (Expand, Inc. d/b/a/ Gigats) and its founder for, among other things, misrepresenting how a consumer’s information would be used. Gigats claimed it was "pre-screening" job applicants for employers when it was actually gathering consumer information for lead generation for schools and career training or programs that paid kickbacks to Gigats.
Lead aggregators—and those buying and selling leads from them, or from "data brokers"—should recognize that regulators may hold them responsible for their business partners’ conduct.
