Published September 29, 2026

Who does our financial data belong to?

Who do you think your financial data belongs to? Your $2,000 paycheck from last week, the $50 you sent your sister yesterday, the $100 you paid Xfinity this morning, your mortgage payment, your rent, all of the financial data that your bank statement would hold? Who owns it? Is it you or your bank? I really hope you think it's your bank, because the only regulatory body that thinks it should be you is on the brink of collapse.This is a story about the CFPB and the tug of war they had (and are still having) with the banks over who owns our financial data.

You probably recognize Plaid because you've used it to connect your bank account to Venmo or a budgeting app. Plaid was founded because the founders wondered why accountants needed to be emailed your bank statements at month end instead of fetching transactions in real time. The idea completely took off, and more of these "aggregators" like Plaid started to pop up: Yodlee, MX, and Finicity, to name a few.

When the CFPB heard about the increase in companies like Plaid yet no regulatory oversight existed for them, they began writing papers, speaking to experts, and asking for public opinion on how third parties can be regulated to keep accessing our financial data on our behalf in a safe and controlled way while also protecting consumers.

Sure enough, while they were mulling this over, guess what happened! The Equifax data breach of 2017 was announced to the public. Do you remember the one that impacted 175M Americans' financial data? And they said sorry, we fired a bunch of people so it's never going to happen again, here's free credit monitoring juuuust in case somebody in China stole your identity, so sorry! That one.

By 2024, the CFPB had filed a regulation mandating that every financial services provider work with aggregators to provide consumers with their financial data. The regulation also prohibited banks from charging aggregators fees, even if consumers would share said financial data with the banks' competitors. All financial services providers would need to be compliant with the rule by January 17th, 2025.The same day the CFPB released the final version of this rule, the Bank Policy Institute, an organization every large bank belongs to, sued them.

Guess whose inauguration was three months later? Our current president's! Trump came in, fired the previous director of the CFPB, and installed a new acting director. The acting director closed the headquarters and told the Federal Reserve the CFPB didn't need any money for that quarter (mind you, the Fed is the SOLE funding source of the CFPB), and ever since then, it's basically been in zombie mode.

Because the CFPB and the banks were still not on the same page about this rule, the CFPB asked to pause the lawsuit so they could tweak the rule. In October of 2025, the judge presiding over the lawsuit granted an injunction, thus blocking enforcement of the rule. Shortly after, Plaid, Yodlee, and other data aggregators were reported to have signed contracts with JPMorgan agreeing to pay for your data. Some reports say JPMorgan started the negotiations at $300M/year with Plaid, but we don't know the final figures.

Perhaps you're wondering why the CFPB is preventing aggregators from paying to access our data. Wouldn't this make the data more valuable and promote competition? In 2010, when Congress created the CFPB, one of the rules they gave it to uphold and protect was Section 1033.

Title X, Sec. 1033 of the Dodd-Frank Act: "that subject to rules prescribed by the Bureau of Consumer Financial Protection (Bureau), a consumer financial services provider must make available to a consumer information in the control or possession of the provider concerning the consumer financial product or service that the consumer obtained from the provider"

In other words, it says we must always be able to access the financial data that a financial services provider has about us. My understanding is that the CFPB sees this new rule as a natural extension of Section 1033. However, the judge presiding over the lawsuit argues that the rule didn't cover aggregators and other fintechs that may have a fiduciary-like relationship with consumers, and therefore the CFPB has zero statutory authority to enforce it.

Today, banks already share our data with credit bureaus monthly, voluntarily, and at no cost. Of course, this is to "punish" and "reward" how we handle the loans they issue us. Yet aggregators are not afforded the same type of access.A bank's business model is predicated on deposits and, as a byproduct, data. Certainly, if all banks could access our data, it could be used to poach us. But isn't that simply a function of the free market?

Thus we return to my original question: who does our financial data belong to? Is it ours to authorize who can access it? Is it for the bank to determine who pays for it and who doesn't? Is it our financial data, where we take turns making decisions? Or is it just entirely the banks'?

Further Reading / Citations