When Your Financial Data Moves, Protections Should Follow

Open banking has made it easier for millions of Americans to connect their financial accounts to the apps and services they choose—whether they are budgeting, saving, investing, making payments, or applying for credit. Those benefits depend on consumers having confidence that strong protections follow their data wherever it goes.

As financial data moves among banks, data aggregators, fintech platforms, and other service providers, the rules and oversight that apply can differ depending on who is handling the information.

Testifying before the House Financial Services Committee in March, Laura MacCleery of UnidosUS described how differently the two sides of that connection are treated:

• “Banks were subject to GLBA privacy requirements, federal supervisory examinations, security standards, and state privacy laws. Data aggregators were subject to essentially none of these at the federal level."

The point is not to limit consumers' ability to connect their accounts to the services they want. It is to make sure consumers can use those services with confidence that meaningful protections follow their data wherever it goes.

Open banking works when consumers can trust the system

Secure data sharing allows consumers to budget, save, invest, make payments, and apply for credit using the services that work best for them.

But these benefits depend on trust. As account information moves across different financial services and platforms, consumers may not know how long it is retained, who else receives it, or who is responsible if it is exposed or used to commit fraud. In fact, a 2025 national survey by Consumer Reports, Aspen Digital, and the Global Cyber Alliance found that fewer than half of Americans were confident their personal data—including financial information—was private and not distributed without their knowledge.

Closing the gap requires consistent standards across the market: consent that is specific and simple to withdraw, collection limited to what a service needs, and responsibility for the data that reaches every company handling it, all while protecting the options consumers have already gotten used to. That principle has broad consumer support: In a 2025 ABA and Morning Consult survey, 76% of adults said all organizations holding consumer data should follow the same sharing rules.

What to watch in the 1033 proposal

Section 1033 of the Dodd-Frank Act gives consumers the right to access certain financial information and underpins the CFPB’s rules for how that data can be shared with apps and other third parties. The CFPB's revised Section 1033 proposal remains under White House review. 

When it is released, a durable framework will be one that preserves consumers' ability to use the financial tools they choose while ensuring strong protections and clear responsibilities follow their data across the entire ecosystem.

For more updates like this, sign up for The Ledger Project’s emails here.