Congress restores consumer data-protection rules CFPB had quietly withdrawn
H.J.Res. 179 — Providing for congressional disapproval under chapter 8 of title 5, United States Code, of the rule submitted by the Bureau of Consumer Financial Protection relating to the withdrawal of the rule relating to "Consumer Financial Protection Circular 2022-04: Insufficient Data Protection or Security for Sensitive Consumer Information". · Filed by Maxine Waters (D-CA) · Introduced May 7, 2026 · Referred to committee
Your members of Congress
Enter a ZIP to see where your representative and both senators stood on this bill.
Looked up on this device — your ZIP is never stored on our servers.
What it does
This resolution uses the Congressional Review Act to block a CFPB rule that withdrew a 2022 data-protection guidance. The net effect: disapproving the withdrawal restores the 2022 circular, requiring financial institutions to maintain adequate data security and protection for sensitive consumer information.
Why we flagged it
The bill's operative mechanism is a Congressional Review Act disapproval that restores a withdrawn CFPB data-security circular. It is a procedural instrument of regulatory restoration, not substantive rulemaking.
What the text implies
- Restoring the 2022 circular may trigger compliance costs for financial institutions, which could be passed to consumers through higher fees or reduced services—a secondary cost not apparent from the consumer-protection framing.
- The resolution does not specify whether the restored circular applies retroactively or prospectively, creating potential ambiguity in enforcement and liability for institutions that relied on the withdrawal.
- If the CFPB issues a new withdrawal rule after this disapproval, the same CRA process would be required again, creating a procedural loop that could delay or fragment data-protection enforcement.
Section numbers refer to the bill text the analysis read — linked under Primary records below.
Who it affects
Restoring the 2022 data-protection circular strengthens consumer safeguards against inadequate data security by financial institutions. Citizens regain explicit regulatory protections for sensitive financial information that the CFPB had withdrawn.
Named in the bill
Bureau of Consumer Financial Protection (CFPB), Consumer Financial Protection Circular 2022-04, Congressional Review Act (Chapter 8, Title 5, U.S. Code), House Committee on Financial Services, Rep. Maxine Waters
Where it stands
- May 7, 2026 — Introduced · Congress.gov: “Introduced in House”
- May 7, 2026 — Referred to House Committee on Financial Services · Congress.gov: “Referred to the House Committee on Financial Services”
Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.
How this was measured
Analysis — Quorum's AI read the bill text published by Congress.gov (1,477 characters) on Jun 3, 2026. Section numbers in the findings refer to that text, linked below; transparency and hidden-provision scores are compared against the median of 16,222 analysed bills.
Status and sponsors — Congress.gov's bill record — actions, committee referrals and cosponsors — loaded nightly. The timeline shows status changes, not every procedural action.
As of — page rendered 2026-10-20.
“Congress restores consumer data-protection rules CFPB had quietly withdrawn” QuorumCivic. https://share.quorumcivic.app/bill/119/hjres179 Report an error
The week in bills
One email, Sunday: what Congress passed, what it changed, and who paid.
One link arrives to confirm the address. It is used for this email and nothing else, and every issue carries an unsubscribe link.