Last Week, This Morning

August 4, 2025

Below you will find several key developments in the financial services industry, including related developments in information privacy and data security, from the past week. We add an "Amicus Brief(ly)¹" comment to each item, where we briefly (see what we did there?) note for friends (and again?) of CounselorLibrary the important takeaways from the developments outlined in the email. Our legal reporters - CARLAW, HouseLaw, InstallmentLaw, PrivacyLaw, and BizFinLaw - provide more comprehensive, real-time updates of federal and state laws, regulations, litigation, and other industry items of interest. For a personal guided tour and free trial of any of these legal reporters, please contact Michael Willer at 614-855-0505 or mwiller@counselorlibrary.com.

On July 29, the Massachusetts Attorney General's Office issued updated business guidance and uploaded a prerecorded webinar providing further explanation of its final rule governing unfair and deceptive fees. The final rule, which is commonly referred to as the "Junk Fee Regulation," was published in March and becomes effective on September 2. The updated business guidance triples the length of the guidance initially published in March, concurrent with the final rule. The rule is aimed at curbing bait-and-switch and drip pricing practices and requires any advertisement or solicitation of a "product" (broadly defined to include tangible or intangible goods or services for sale, lease, or rent) that includes a price to disclose the total price of the product. The rule also imposes limits on trial offers and products with a negative option feature. The updated guidance and webinar respond to numerous questions raised since the publication of the final rule and are intended to provide additional clarity as to how to comply with its requirements.

Amicus Brief(ly): The updated business guidance provides helpful additional clarity regarding the scope of the Junk Fee Regulation. Among other things, the updated guidance clarifies that assignees of creditors that conduct their activities in compliance with the Truth in Lending Act and Regulation Z are also deemed to be in compliance with final rule, so long as the assignee regularly participates in the credit decision (for example, by setting the credit terms) or influences the credit decision (for example, by indicating whether it will purchase the credit obligation if it is consummated). The updated guidance also provides a similar allowance for lessors that act in compliance with the Consumer Leasing Act and Regulation M and assignees of lessors that have substantial involvement in the lease transaction. Providers should carefully review this updated business guidance to determine how to comply with the final rule, as its effective date is approaching fast.

On July 24, Oregon Governor Tina Kotek signed House Bill 3865, which amends provisions under the state's Unlawful Trade Practices Act governing unlawful telephone solicitations and solicitations using an automatic dialing and announcing device.

Specifically, the new law updates the definition of "telephone solicitation" to include text messages, in addition to telephone calls. The new law provides that a person engages in an unlawful trade practice if, among other current prohibitions: (1) the person initiates a telephone solicitation outside the hours of 8 a.m. to 8 p.m. or initiates a solicitation more than three separate times to a party within a 24-hour period, unless the person has an established business relationship with the party; or (2) during a telephone solicitation, the person misrepresents or falsifies: (a) the person's identity or the identity of another person on behalf of which the person makes the telephone solicitation; or (b) the purpose of the telephone solicitation.

HB 3865 also amends provisions governing calls using an automatic dialing and announcing device. The new law expands the definition of a "call" to include an attempt to contact an individual by means of a text message, in addition to by telephone. The law also provides that a caller that uses an automatic dialing and announcing device may use the device to call an individual only between the hours of 8 a.m. (previously 9 a.m.) and 8 p.m. (previously 9 p.m.) and may not call the individual more than three times in 24 hours. However, this restriction on the hours an individual may be called does not apply to a caller that: (1) has an established business relationship with the individual; (2) is a debt buyer or is subject to regulation under the Fair Debt Collection Practices Act; (3) is a representative of a public safety or law enforcement agency; (4) is a representative of a school district or school if the individual is an employee of the school district, a student, or the student's parent, guardian, or other family member; or (5) is responding directly to a message received from an individual.

Amicus Brief(ly): This Oregon development is a useful reminder about how states regulate business conduct in ways that suit their legislators. Some states are content to let the federal government do its thing. The federal Telemarketing Sales Rule and Telephone Consumer Protection Act regulate the behavior of telemarketers and impose limitations that are similar, but not identical, to the Oregon requirements. Compliance professionals face constant challenges when states impose requirements that differ from the federal requirements. Which law controls? Is there a federal preemption position? Can we comply with both the federal and the state requirements? It is simple enough for a telemarketer to comply with both these Oregon restrictions and the restrictions imposed under federal law - just use a narrower call window. However, it is not always that simple, and compliance professionals understand the dance.

On July 28, the New Jersey Office of the Attorney General announced that the Division of Consumer Affairs sent letters to more than 3,000 motor vehicle dealers located in the state to remind them of their obligation to help prevent unauthorized access to sensitive consumer information stored on vehicles when accepting vehicles for resale or lease.

When consumers link mobile devices to a vehicle's infotainment system, personal information can be stored by the vehicle's computer system. In January 2024, New Jersey enacted a law (AB 4723) that requires a dealer, whenever taking possession of a vehicle from a consumer for the purpose of resale or lease, to offer to delete the consumer's personal information from the vehicle's computer system, including, but not limited to, navigation history, paired phones, and garage door codes. Under the law, dealers are permitted, but not mandated, to charge a reasonable fee for data deletion services, but the fee must be disclosed to the consumer prior to performing the service. The dealer must also advise consumers that they may attempt to delete the personal information themselves or through another vendor.

The letters sent by the Division of Consumer Affairs specify the requirements under the law for carrying out the data deletion process, including performing data-clearing procedures by following manufacturer-specified techniques or by using a menu option on the vehicle to reset the vehicle's computer system to its original factory settings. The letters also advise dealers that failure to comply with the law could result in civil penalties of $500 for a first offense and $1,000 for each subsequent offense.

Elizabeth Harris, Acting Director of the Division of Consumer Affairs, states in the AG's news release: "While the public has become increasingly aware of the data privacy risks associated with discarded computers, cell phones, and other electronic devices, many people are unaware they face the same risks when they surrender their vehicle to a dealership[.] By requiring New Jersey dealerships to offer to delete this information for the consumer, we're raising awareness of this growing security risk and providing consumers with a way to protect themselves from unauthorized disclosure of personal information."

Amicus Brief(ly): New Jersey adds an important new angle to a conversation that Texas and other states started over the past couple of years. Specifically, the harvesting and use of consumer data by vehicles in ways that consumers largely do not understand. While Texas (and others) took this on by enforcing state laws, including through investigation and litigation, New Jersey takes the next step to make sure that any data collection or sharing stops after the sale or trade in of a vehicle that has the capacity to store data. Consumers may have little awareness of their vehicles' capacity to gather, store, and share data, so it may not occur to them to try and "wipe" that data when they sell or trade in a vehicle, like it might with a mobile phone, tablet, or laptop. So, New Jersey puts the onus on car dealers, which cover a large portion of the used car purchase-and-sale market. While it adds a compliance burden to dealers, this is a useful consumer protection measure.

Connecticut Governor Ned Lamont recently signed Senate Bill 1396 into law, amending the Connecticut Small Loan Law by subjecting earned wage access providers to the law's licensing requirements. The new law takes effect on October 1, 2025.

Connecticut regulators had addressed EWA products nearly two years ago. In September 2023, the Connecticut Department of Banking issued industry guidance regarding the licensing requirements for EWA providers under state law. When asked whether EWA providers should be licensed as small loan lenders, the Department responded that "advances of money on future wages or salary that have been earned but not yet paid, commonly referred to as 'earned wage access' products, are generally covered by the Small Loan Lending and Related Activities Act."

With the enactment of SB 1396, the Connecticut Small Loan Law now defines the term "small loan" to include an advance of money on a borrower's "earned but unpaid wage or salary income." Accordingly, EWA providers are now explicitly required to be licensed under the Small Loan Law. In addition, the new law requires EWA providers to:

• provide at least one no-cost option and clearly disclose the procedure for electing a no-cost EWA option;
• ensure the amount advanced equals at least 75% of the consumer's earned but unpaid income for the pay period and limit advances to one advance per period;
• make clear and conspicuous disclosures of the charges;
• fully and clearly disclose cancellation and complaint procedures with related website links;
• use mandatory income verification procedures;
• obtain a consumer attestation regarding transaction limits;
• satisfy scheduling limitations for payment;
• reimburse consumers for overdraft or insufficient funds fees caused by payment attempts that vary from disclosed terms;
• make transaction details "readily available" to consumers;
• allow no-fee cancellation at any time;
• implement specified measures to prevent multiple EWA transactions from being issued to a consumer with an outstanding EWA transaction; and
• implement policies and procedures related to questions and complaints.

SB 1396 prohibits EWA providers from:

• soliciting tips without first disclosing the amount approved;
• setting any tip amount greater than zero dollars as the default option;
• sharing finance charges with employers;
• requesting early payment;
• accepting card payments;
• charging for failure to pay;
• engaging in certain collection practices; and
• using credit reports for eligibility or reporting purposes.

The new law also limits the total finance charge on an EWA transaction to $4.00 per advance or $30.00 per month.

Amicus Brief(ly): Connecticut often takes the approach to regulate new products or address market developments by amending its existing laws to put those new products under the umbrella of existing law. Several other states have also recently amended lending laws to add EWA products to their regulated loan products. In addition to requiring a license for non-bank providers, Connecticut adds some product-specific enhancements to its Small Loan Law to regulate EWA, with some rules tailored to address the product's unique features. It can be challenging for financial services providers to do business in Connecticut given how active the legislature and regulator are, but the state is transparent about consumer credit regulation, so we know where we stand.

On July 30, House Financial Services Committee Chairman French Hill (R-AR), Rep. Richie Torres (D-NY), Subcommittee on Digital Assets, Financial Technology, and Artificial Intelligence Chairman Bryan Steil (R-WI), and Rep. Josh Gottheimer (D-NJ), alongside Senator Mike Rounds (R-SD), Senator Andy Kim (D-NJ), Senator Thom Tillis (R-NC), and Senator Martin Heinrich (D-NM), introduced H.R. 4801 - the Unleashing AI Innovation in Financial Services Act - to promote the use of artificial intelligence in the financial services industry. Under the Act, federal financial regulatory agencies would allow regulated companies to experiment with AI through regulatory sandboxes.

The Act would require each financial regulatory agency to establish - or identify an office, division, or department of the agency that will serve as - an AI Innovation Lab to enable regulated entities to experiment with AI test projects without unnecessary or unduly burdensome regulation or expectation of enforcement actions, pursuant to the approval of an application by a regulated entity to engage in an AI test project. An "AI test project" is defined as a financial product or service that falls under the jurisdiction of a financial regulatory agency, makes substantial use of AI, and is subject to a federal regulation or federal statute.

Amicus Brief(ly): This bill is potentially impactful, but it still needs to get through Congress and then to the President's desk. Regulatory sandboxes can be very productive ways for industry and regulators to confer about the best ways to regulate innovative consumer products (financial and otherwise). To be clear, AI innovation has been underway in financial services for years, but regulation most often trails the pace of development. It is not altogether surprising to see Congress come up with a sandbox concept focused on the impacts of AI. To be successful in practice, this bill will have to get signed and then passed along to the federal regulators for implementation. That is when a new set of challenges will emerge, given that the Administration has prioritized regulatory cutbacks that have affected staffing at the federal agencies. If this sandbox initiative is important enough to the Administration, we expect that the regulators will find a way to do the work.

---

¹ For the unfamiliar, an “Amicus Brief” is a legal brief submitted by an amicus curiae (friend of the court) in a case where the person or organization (the “friend”) submitting the brief is not a party to the case, but is allowed by the court to file the brief to share information or expertise that bears on the issues in the case.