Last month, the CFPB utilized its market monitoring authority to issue a series of orders to five companies offering “buy now, pay later” credit.  Buy now, pay later, or BNPL, is a deferred payment option that allows consumers to split a purchase into smaller installments, typically four or less, often with a down payment of 25 percent due at checkout.

As we detail in our sister blog here, the CFPB is seeking information on the risks and benefits of these “fast-growing” products over concerns about, among other things, data harvesting and data monetization in a consumer credit market already quickly changing with technology.  The CFPB provided to the public an example of the order issued to these companies. The order has 20 requests for information and data on several topics. Two key areas are discussed below.

Data Harvesting: The CFPB seeks data that the companies collect and retain as a result of BNPL product usage, the type of data that is generated from BNPL product usage, and the purpose associated with harvesting different data fields.  The information sought relates to “Direct Product Data” and “Indirect Product Data” and the kinds of data that the companies generate from this data.  “Direct Product Data” means data collected (and maintained) as a result of consumer’s use of BNPL.  “Indirect Product Data” is data that is both (1) generated, at least in part from Direct BNPL Data, and (2) about individual users of BNPL.

Data Monetization: The CFPB is also seeking information about how BNPL use data or data generated from BNPL data is used in connection with developing, selling, or marketing BNPL products or other products or services. The CFPB is also looking to understand third-party data sharing and related revenues, and use of BNPL use data or data generated from BNPL use data to sell advertising or targeted offers.

Putting it Into Practice:  While this is the CFPB’s first salvo directed at BNPL companies, all businesses should take this action as a prompt to conduct data inventories to assess whether they collect or disclose data sets that are subject to any federal and state regulations.  As part of the action items for 2022, companies would be well served to also thoroughly analyze who is receiving their data and how the relationship is characterized, including for online marketing and analytics purposes.