Your bank holds a record of every coffee you bought in 2023. Under federal law, that record is supposed to be yours to take elsewhere. Getting from "supposed to" to "can" has taken fifteen years so far, and the paperwork is not finished.

What the rule is meant to do

Section 1033 of the Dodd-Frank Act, enacted in 2010, says that a covered entity such as a bank must make transaction data and other information about your financial product available to you on request. It does so subject to rules from the CFPB. It also calls for standards that promote standardized data formats, which is a polite way of saying the data should arrive in a shape another company can read.

The CFPB finalized its personal financial data rights rule on October 22, 2024. As described by the agency, it lets consumers unlock their data and transfer it to another provider at their request, free of charge. The stated aim is easier switching and easier comparison of rates and service.

The rule reaches data tied to checking and prepaid accounts, credit cards, payment apps, and digital wallets. Access is meant to run through secure interfaces that data providers maintain, rather than through consumers handing over their login credentials. A footnote-minded reader will find the details in 12 CFR 1033, which the CFPB points to on its personal financial data rights page.

Where the rule stands now

A rule can be final and still not be in force. On October 29, 2025, a court stayed the rule's compliance dates in Forcht Bank, N.A., et al. v. CFPB. A stay pauses when obligations begin, so what providers must do, and when, is uncertain. The CFPB has said it plans to propose extending the dates.

There is more. On August 22, 2025, the agency issued an Advance Notice of Proposed Rulemaking on reconsidering the rule. It raises four issues: who may act as a consumer's representative, whether fees may be charged, data security, and data privacy. In June 2025, the CFPB also asked a federal court in the Eastern District of Kentucky to vacate the 2024 rule, arguing it exceeded statutory authority and was arbitrary and capricious.

The sources reviewed here do not report how either effort ended. Treat the rule's final form as open, and check the CFPB's status page and the court record rather than a summary written on a given Saturday.

How fees fit into the picture

The 2024 rule, as described, requires access at no charge and bars data providers from charging for it. Consumer Reports has argued that fees would make the right available only to people who can afford it.

The August 2025 notice asked whether fees should be allowed to offset the cost of responding to customer-driven requests. Asking is not deciding. The sources do not say how any future fee would be set, or whether the no-fee approach survives.

In practice, a demand for payment to see your own account data is not automatically allowed. Whether it is depends on which version of the rule applies at the time. A quick check of the CFPB page before paying anything seems cheap by comparison.

Your protections when a third party gets your data

Under the rule as described, a third party seeking your data must get your express consent. It may use the data only to provide the service you asked for, and it must let you revoke access. Using the data for unrelated purposes is prohibited. One summary adds that businesses had to delete personal information after revocation, and that third parties could not use the data to advertise products you did not request.

All of this is subject to the same review as the fee question. The sources also say little about specific security safeguards beyond consent and revocation. So the habits are modest ones: read what a service says it will do, keep a note of what you agreed to, and revoke access you no longer use.

Questions to ask and warning signs

Start with a plain question, then work through the rest in order.

  1. Is my data access governed by the 2024 rule, the stayed version, or a revised one?
  2. Has the third party obtained my express consent?
  3. Will it use my data only for the service I asked for?
Hands on a kitchen table comparing a printed bank statement with handwritten notes beside a mug of coffee and reading glasses.
A consumer comparing a data-sharing consent screen against notes on which permissions were granted

A few more questions belong on the same page, mostly about money and exit routes.

  1. How do I revoke access, and who confirms it is done?
  2. Is there a fee to get my own data?
  3. If so, is that fee permitted under the current rule status?

Warning signs follow from the answers. Be wary of requests for more data than the service needs, marketing you never asked for, and any fee you cannot confirm is allowed. For next steps, the CFPB and the FTC are the official places to look. This article is educational and is not advice for your situation.

Please seek a professional. This article is general information, not financial, tax or insurance advice. Please seek a licensed financial, tax or insurance professional about your own situation.