On August 10th, the Consumer Financial Protection Bureau issued guidance expanding its jurisdiction to reach digital marketing firms. CFPB issued an interpretive rule subjecting certain digital marketing companies to its authority regardless of whether those companies provide financial products or services to consumers. CFPB noted it could bring enforcement actions against digital marketing companies, including search engines and social media platforms, when those companies actively participate in developing content strategy or targeting ads for financial products to consumers based on their individual characteristics. The rule is one piece of a larger effort by CFPB to expand its jurisdiction.
I. CFPB's Authority Over "Service Providers"
In general, CFPB has broad authority over "covered persons" as defined by the Dodd-Frank Act.[1] A covered person is any person offering or providing one of eleven specified consumer financial products or services, such as making, brokering, and servicing loans, providing payment instruments or stored value, and providing payments products or services to a consumer by any technological means.[2] In addition to authority over covered persons that actually offer or provide the specified products or services, CFPB also has authority over certain "service providers" to those covered persons. A service provider is any person that "provides a material service to a covered person in connection with the offering or provision by such covered person of a consumer financial product or service."[3] Both covered persons and service providers must comply with the Dodd-Frank Act's prohibition on unfair, deceptive, or abusive acts or practices (UDAAP).[4]
II. CFPB's Interpretation That Digital Marketers are Service Providers
The new rule explains CFPB's view that modern digital marketing companies play a "dramatically different" role in consumer advertising as compared to traditional media sources like print newspapers or radio stations.[5] The agency contends digital marketers target and deliver ads to specific consumers using sophisticated analytical techniques, including machine learning and behavioral analytics, which process large amounts of consumer data. It believes digital marketing providers commingle the service of targeting and delivering advertisements with the activities typically performed by traditional media sources—providing airtime or physical space for advertisements.
CFPB concludes digital marketing companies can be service providers subject to its authority when they identify or select prospective customers or select or place content to affect consumer engagement. In CFPB's view, modern digital marketing companies that target advertising to consumers based on their individual behavior provide a "material service." These companies are service providers because they undertake many functions traditionally performed directly by consumer financial service providers, such as lead generation, customer acquisition, or marketing analysis or strategy.
CFPB acknowledges the Dodd-Frank Act definition of service provider excludes companies solely providing "time or space for an advertisement for a consumer financial product or service through print, newspaper, or electronic media."[6] CFPB believes this may not apply to digital marketing companies when they are actively involved in the development of digital content strategy. In such cases, they do more than simply provide "time or space" for an advertisement. Whether a digital marketing company is a service provider turns on whether it falls within the "space and time" exception. For example, a company targeting or delivering advertisements to consumers with certain characteristics would be a service provider even when the covered person placing the ads selects the particular characteristics to target. Likewise, the Bureau says digital marketers identifying specific customers by name or targeting ads to specific individuals at certain times based on their individual behavior would be service providers subject to its authority.
III. Potential Implications of the Interpretive Rule
CFPB announced this guidance in an interpretive rule rather than a legislative rule. Interpretive rules are "statements issued by an agency to advise the public of the agency’s construction of the statutes and rules which it administers."[7] They are intended to explain what existing law means, rather than create new law.[8] The rule expresses the Bureau's belief that digital marketing companies described above are currently subject to its authority as service providers and it already has authority to bring UDAAP enforcement actions against them.[9] Further, digital marketing companies that commit UDAAPs would be subject to suit by state Attorneys General because states also have authority to enforce the Dodd-Frank UDAAP prohibition.[10] The Bureau's Director Rohit Chopra gave a speech to the National Association of Attorneys General summarizing the rule the same day it was released, in which he reminded the states of this authority.[11]
The rule's release may suggest CFPB plans to bring enforcement actions against digital marketing firms. Enforcement is not guaranteed—the rule could simply be an attempt to use CFPB's "bully pulpit" to discourage digital marketing companies from unfair or deceptive practices related to consumer financial products that does not portend new complaints.
If UDAAP actions are filed against digital marketing companies, courts will decide whether they are service providers. Those courts may not agree with the Bureau's interpretation. And, they likely would not afford the rule Chevron deference because it is not a legislative rule that the agency put through notice and comment.[12] Ultimately, to avoid potential UDAAP liability, a digital marketing company would need to persuade the court that it solely provided time or space for an advertisement for a consumer financial product or service.