Last Week, This Morning

March 24, 2025

Below you will find several key developments in the financial services industry, including related developments in information privacy and data security, from the past week. We add an "Amicus Brief(ly)¹" comment to each item, where we briefly (see what we did there?) note for friends (and again?) of CounselorLibrary the important takeaways from the developments outlined in the email. Our legal reporters - CARLAW, HouseLaw, InstallmentLaw, PrivacyLaw, and BizFinLaw - provide more comprehensive, real-time updates of federal and state laws, regulations, litigation, and other industry items of interest. For a personal guided tour and free trial of any of these legal reporters, please contact Michael Willer at 614-855-0505 or mwiller@counselorlibrary.com.

You're invited! If you have enjoyed receiving Last Week, This Morning® and would like to learn more about the capabilities of our legal reporter products, please consider joining us for a webinar featuring a demonstration of the CounselorLibrary website. Click here to sign up for a 30-minute webinar on Wednesday, March 26 at 1:30 ET.

On March 17, Idaho enacted House Bill 149, which amends the state's Residential Mortgage Practices Act to restrict the use of mortgage trigger leads. The bill defines "mortgage trigger lead" as a consumer report obtained pursuant to section 604(c)(1)(B) of the federal Fair Credit Reporting Act where the issuance of the report is triggered by an inquiry made with a consumer reporting agency in response to an application for credit but does not include a consumer report obtained by a lender or servicer that holds or services existing indebtedness of the applicant who is the subject of the report.

The new law - a violation of which constitutes a violation of the Idaho Consumer Protection Act - provides that if a company solicits a consumer for a residential mortgage loan that is based, in whole or in part, on information contained in a mortgage trigger lead, the solicitor is prohibited from:

• failing to clearly and conspicuously state in the initial phase of the solicitation that the solicitor is not affiliated with the lender or broker with which the consumer initially applied;
• failing to clearly and conspicuously state in the initial phase of the solicitation that the solicitation is based on personal information about the consumer that was purchased, directly or indirectly, from a consumer reporting agency without the knowledge or permission of the lender or broker with which the consumer initially applied;
• failing, in the initial solicitation, to comply with the provisions of the FCRA relating to prescreening solicitations that use consumer reports, including the requirement to make a firm offer of credit to the consumer; or
• knowingly or negligently using information from a mortgage trigger lead to solicit consumers who have opted out of prescreened offers of credit under the FCRA or to place telephone calls to consumers who have placed their contact information on a federal or state do-not-call list.

Arkansas enacted a similar law, House Bill 1184, on March 12.

Amicus Brief(ly): This short but impactful bill goes into effect on July 1, giving providers a couple of months to get compliance policies and procedures, including the required disclosures, ready for the effective date. Idaho follows a couple other states, including Arkansas (as noted in the summary above), in requiring certain disclosures to consumers about how and why they are receiving solicitations for a mortgage loan when they have already applied for a loan. In fact, Congress has been considering amending the FCRA to restrict the use of trigger leads more closely, purportedly to keep consumers from being inundated with solicitations (the bill has been stalled since December 2024). Idaho does not go that far in this bill, which requires disclosures that will give consumers context for the solicitation(s) and also requires companies making solicitations based on trigger leads to have a firm offer of credit ready.

The Texas legislature is considering a bill to regulate sales-based financing transactions. If passed, Senate Bill 2677 would be the first in the nation to cap the cost of sales-based financing. The bill would define the term "sales-based financing" to mean a transaction that is repaid by the recipient to the provider of the financing as a percentage of sales or revenue, in which the payment amount may increase or decrease according to the volume of sales made or revenue received by the recipient or according to a fixed payment mechanism that provides for a reconciliation process that adjusts the payment to an amount that is a percentage of sales or revenue. Unlike other laws regulating sales-based financing, the bill does not include an exemption for low-volume providers. If enacted, the bill would take effect on September 1, 2025, except for the broker registration requirement, which would take effect on January 1, 2026.

Under S.B. 2677, fees and charges paid or charged under a sales-based financing transaction count as interest under state usury law, regardless of the amount financed. Texas's usury cap adjusts between 18% and 28% and is currently 18%, according to the website of the Texas Office of Consumer Credit Commissioner. Because the bill does not require a cost-of-credit disclosure expressed as a rate, it is unclear how a provider should calculate the "interest rate" or APR of a sales-based financing transaction for usury purposes.

The bill specifies that a sales-based financing transaction is not an "account purchase transaction" (account purchase transactions are exempt from Texas usury law), regardless of the amount financed. An account purchase transaction includes factoring and, according to at least one Texas court, sales-based financing agreements. See Express Working Capital, LLC v. Starving Students, Inc., 28 F.Supp.3d 660 (N.D. Tex. June 24, 2014) (explaining that agreements to purchase future credit card receipts were account purchase transactions under Texas law, not loans). As a result, the bill amends Texas law to exclude sales-based financing from this statutory exemption from usury.

Like other laws regulating sales-based financing, S.B. 2677 requires a provider to give certain disclosures to a recipient before consummation of a transaction. The required disclosures include the amount financed, amount disbursed, finance charge, total repayment amount, estimated term, estimated payment schedule, list of non-finance charge fees, finance charges and fees payable upon prepayment, collateral requirements, and (for renewal financing) whether any part of the amount financed will be used to pay down finance charges or prepayment fees on a previous transaction. The bill requires these disclosures for a transaction with an amount financed greater than $500,000.

The bill requires brokers of sales-based financing transactions, but not finance providers, to register with the Texas Department of Banking and to renew their registrations annually by January 31. Finally, the bill provides for a maximum penalty of $10,000 per violation or $100,000 per series of violations. It also declares a violation to be a deceptive trade practice, indirectly granting a private right of action.

Amicus Brief(ly): Texas has been stuck on its current 18% rate cap for a long time for most consumer credit transactions, but that rate cap is a bad fit for sales-based financing transactions as providers currently arrange them. Couple the odd fit of a rate cap on a product that does not feature a finance rate with the absence of an estimated APR-type rate disclosure, and providers will understandably be concerned that compliance with this law will be difficult. The bill is not consistent with other states' laws regulating this alternative business finance product in that it does curiously require a "finance charge" disclosure without the corresponding expression of the finance charge as an annual rate. Expect the industry lobby to find legislators to discuss these and other concerns with the bill, which, if it passes, should look different from its current text.

On March 19, Virginia enacted House Bill 2659, which requires motor vehicle dealers to complete a buyer's order for each lease of a motor vehicle, in addition to the existing requirement that a buyer's order be completed for each motor vehicle sale. The new law provides that a dealer may, but is not required to, use separate buyer's order forms for a sale of a motor vehicle and a lease of a motor vehicle.

If the dealer uses a separate buyer's order form for a lease of a motor vehicle when delivering to the customer a vehicle leased by the customer that is conditional on dealer-arranged leasing, the buyer's order must include the following notice, printed in bold type no less than 10 point: "IF YOU ARE LEASING THIS VEHICLE, PLEASE READ THIS NOTICE: YOU ARE PROPOSING TO ENTER INTO A LEASE AGREEMENT WITH THE DEALER. PART OF YOUR CONTRACT INVOLVES FINANCING THE LEASE OF YOUR VEHICLE. IF YOU ARE LEASING THIS VEHICLE AND THE DEALER INTENDS TO TRANSFER YOUR LEASE TO A FINANCE PROVIDER SUCH AS A BANK, CREDIT UNION, OR OTHER LENDER, YOUR VEHICLE LEASE DEPENDS ON THE FINANCE PROVIDER'S APPROVAL OF YOUR PROPOSED LEASE AGREEMENT. IF YOUR LEASE AGREEMENT IS APPROVED WITHOUT A CHANGE THAT INCREASES THE COST OR RISK TO YOU OR THE DEALER, YOUR LEASE CANNOT BE CANCELLED. IF YOUR LEASE AGREEMENT IS NOT APPROVED, THE DEALER WILL NOTIFY YOU VERBALLY OR IN WRITING. YOU CAN THEN DECIDE TO PAY FOR THE VEHICLE IN SOME OTHER WAY OR YOU OR THE DEALER CAN CANCEL YOUR LEASE. IF THE LEASE IS CANCELLED, YOU NEED TO RETURN THE VEHICLE TO THE DEALER WITHIN 24 HOURS OF VERBAL OR WRITTEN NOTICE IN THE SAME CONDITION IT WAS GIVEN TO YOU, EXCEPT FOR NORMAL WEAR AND TEAR. ANY DOWN PAYMENT OR TRADE-IN YOU GAVE THE DEALER WILL BE RETURNED TO YOU. IF YOU DO NOT RETURN THE VEHICLE WITHIN 24 HOURS OF VERBAL OR WRITTEN NOTICE OF CANCELLATION, THE DEALER MAY LOCATE THE VEHICLE AND TAKE IT BACK WITHOUT FURTHER NOTICE TO YOU AS LONG AS THE DEALER FOLLOWS THE LAW AND DOES NOT CAUSE A BREACH OF THE PEACE WHEN TAKING THE VEHICLE BACK. IF THE DEALER DOES NOT RETURN YOUR DOWN PAYMENT AND ANY TRADE-IN WHEN THE DEALER GETS THE VEHICLE BACK IN THE SAME CONDITION IT WAS GIVEN TO YOU, EXCEPT FOR NORMAL WEAR AND TEAR, THE DEALER MAY BE LIABLE TO YOU UNDER THE VIRGINIA CONSUMER PROTECTION ACT."

Amicus Brief(ly): As compliance nerds, we would like to see vehicle lessors in Virginia adopt a separate buyer's order for lease transactions to avoid confusion. The rights described in the new required notice for leases are similar, but not identical, to the rights described in the notice required for buyer's orders used in connection with conditional financed vehicle sales. Creating or adopting new form templates can be a handful, but if doing so can avoid customer confusion and employee documentation mistakes (experience tells us it can), then dealers can save some time, money, and headaches by adopting them.

The California Privacy Protection Agency recently finalized a stipulated order against an auto manufacturer alleging multiple violations of the California Consumer Privacy Act. The CPPA alleged that the company collected more data than it needed, made it difficult for consumers to use authorized agents to act on their behalf to assert their rights under the CCPA, made it difficult for consumers to understand how to control what information was being collected, and failed to maintain contracts with advertising technology vendors containing adequate privacy protections.

The CPPA alleged that the company unlawfully required consumers to provide more information than necessary to process requests to opt out of personal data sales and sharing by imposing improper identity verification requirements on opt-out requests. The company generally only needed two data points to verify a consumer's identity in its database. However, the company's online privacy request process required consumers to verify their identity by providing their first name, last name, address, city, state, zip code, preferred method to receive updates, email, and phone number before submitting requests to opt out of data sales or limiting the use of their sensitive personal information. While the CCPA requires identity verification before exercising access or deletion rights, it prohibits businesses from requiring verification for opt-out requests to ensure that consumers can limit certain uses of their data easily. In addition, the CPPA alleged that the company improperly required consumers to confirm their authorized agents' requests, though not required by the CCPA.

The CPPA also penalized the company for lacking a symmetrical means of turning advertising cookies on and off, requiring two steps to turn off a cookie and only one step to turn it back on. Finally, the CPPA claimed that the company failed to maintain contracts with advertising technology vendors that complied with the CCPA's requirements, putting consumer data at risk. The CCPA requires contracts with specific terms to be in place with service providers to protect consumer personal information.

Without admitting or denying liability, the company agreed to pay an administrative fine in the amount of $632,500 and implement compliance reforms, including:

• modifying its consumer privacy request procedures to ensure compliance with CCPA requirements, including eliminating improper verification for opt-out requests;
• updating its cookie management system to provide a "Reject All" option to ensure symmetry in consumer choice;
• implementing required contracts with third-party advertising technology vendors to comply with the CCPA's requirements; and
• providing employee training on CCPA compliance and reporting updates to the CPPA.

Amicus Brief(ly): The CPPA began the privacy enforcement sweep in mid-2023, and this is the first published enforcement action flowing from that effort. It is noteworthy that the alleged violations of the CCPA at issue in this stipulated order are not unique to vehicle manufacturers - they can arise in other industry sectors involving data use. Data harvesting and sales by vehicle manufacturers have been a focus in other states and at the Consumer Financial Protection Bureau, but this stipulated order does not even mention connected vehicles specifically. There are a number of important compliance takeaways from this stipulated order for companies doing business involving consumer data in California.

On March 18, the American Financial Services Association submitted a comment letter asking the Consumer Financial Protection Bureau to withdraw its proposal to launch a survey of auto loan borrowers. On January 17, the CFPB published a notice and request for comment in the Federal Register seeking approval for the new auto loan survey. According to the Federal Register notice, the survey "will solicit information on the consumer's experience related to auto purchases and loans including choosing a vehicle and financing, experiences with major vehicle expenses, experiences with loan servicing, and, if applicable, loan modification and repossession."

In its comment letter, AFSA states that the survey, as it is currently described, seeks subjective information about matters that are outside of the CFPB's authority. Moreover, AFSA states that the CFPB, through its enforcement, supervision, and research authorities, as well as through its consumer complaint portal, has already collected significant amounts of data concerning consumers and providers of consumer financial products and services, including data about vehicle financing.

According to AFSA, "[a]s described, the Survey seeks subjective information from consumers, which is an inappropriate basis for the Bureau's decision making. Consumers with extreme experiences tend to respond to surveys at a higher rate than the average consumer experience, thereby skewing the results. This can lead to policies and decisions not based on the actual market, but a biased view of the market. The information collection request announcing the Survey also fails to provide the questions to be asked, which makes it impossible to assess whether the Survey is appropriate. ... [I]t seems that the Bureau is interested in things that are beyond its authority, such as consumers' experiences in purchasing vehicles, how consumers choose vehicles and how consumers manage their household finances for vehicle-related expenses outside of vehicle financing." "The best information about consumers' experiences with vehicle finance transactions is the quantitative data that the Bureau collects when it operates its supervision activities. That data provides objective insight into the transactions consumers enter, how the transactions are serviced, and how those transactions perform over time. The Bureau would help AFSA and the public by explaining clearly why this objective data already in the Bureau's possession is inadequate to serve the Bureau's legitimate needs."

Amicus Brief(ly): AFSA's effort to get the CFPB to withdraw its proposal for gathering consumers' feedback on their vehicle purchase and financing experiences will probably find a sympathetic ear at the new-look CFPB. And AFSA is right - the CFPB has access to tomes of data from supervised entities and even more data through its complaint portal that tell the CFPB how some consumers feel about their experiences. The logical outcome of the survey, like several before it, would be some form of report or guidance indicating that "some" consumers in the survey reported negative experiences in their vehicle purchase and finance transactions that, whether real or imagined, could give the CFPB issues to chase in examinations and investigations. And AFSA is right that the CFPB does not have the statutory authority to regulate vehicle purchase transactions. Because the survey request pre-dates the new administration (by a few days), and because its objectives may not align with those of new CFPB leadership, this survey may not lead to a published report, but hats off to AFSA for submitting these comments to the CFPB to highlight these concerns.

---

¹ For the unfamiliar, an “Amicus Brief” is a legal brief submitted by an amicus curiae (friend of the court) in a case where the person or organization (the “friend”) submitting the brief is not a party to the case, but is allowed by the court to file the brief to share information or expertise that bears on the issues in the case.