State Oversight: The Next Frontier For Consumer Protection

I. Introduction

Increasing state scrutiny of consumer protection concerns is prompting providers of consumer finance products and services to take notice. As federal regulators—most notably the Consumer Financial Protection Bureau (CFPB or the Bureau)— adopt a less aggressive enforcement and rule writing, state attorneys general and regulators are stepping in to fill the gap. These energized actors have enforcement authority over a patchwork of state laws and rules—some of them new— in addition to existing federal laws and rules. This creates a complex and fragmented network of enforcement and regulatory priorities for market participants.

How will this intensifying state regulatory and enforcement environment develop? Recent actions in New York State are instructive examples: hiring former staff of federal agencies into state-government roles, initiating multi-state lawsuits to enforce consumer protection laws, and increasing state-level rulemaking and legislation. Each state, however, has its own priorities and political landscape, and clients should not expect a one-size-fits-all approach.

Still, there are some anticipated approaches, especially among Democrat-leaning states. Shortly before stepping down, former CFPB Director Rohit Chopra created a blueprint for aggressive state-led enforcement of federal consumer protection laws. That blueprint draws on an expansive interpretation of section 1042 of the Consumer Financial Protection Act (CFPA) to empower state attorneys general.¹

This article describes the rising activity in state consumer protection enforcement, situates it in the context of the Biden-era CFPB framework, and describes emerging gaps given a weakened CFPB and key considerations for clients.

II. A Growing Role for State Enforcement

So far, early signs of a more assertive approach are most apparent in blue states: officials in New York have proposed new legislation and rules that would impact consumer finance products, and New York and California are both seeking to hire talent displaced by the Trump administration's cuts to federal agencies like the CFPB. Interestingly, there is reason to think red-state enforcers may increase their scrutiny of financial institutions, especially given the prevailing populist sentiment.

a. Legislation and Rulemaking

In early March 2025, New York Attorney General Letitia James proposed to expand New York's consumer protection laws through the Fostering Affordability and Integrity through Reasonable Business Practices (FAIR Business Practices) Act.² The bill would amend Article 22-A of the New York General Business Law, which protects New York consumers against deceptive business acts and practices. Most notably, the proposed changes would introduce an explicit prohibition on "unfair" or "abusive" business practices.³ The bill's definitions of "unfair" and "abusive" closely track those of the CFPA.⁴ Unfair practices are those that cause, or are likely to cause, "substantial injury which is not reasonably avoidable." Abusive practices are characterized as those that either interfere with a person's ability to understand the terms of a product or service or that take advantage of a person's lack of knowledge of a product's risks, a person's inability to protect their own interests, or a person's reasonable reliance on another to act in their interests.⁵ These new provisions would significantly expand New York's consumer protection statute beyond its current prohibition of deceptive acts.⁶ If passed, the law would provide New York regulators with a broader mandate to pursue companies engaging in exploitative or harmful financial practices that may not meet the existing threshold for "deceptive" conduct under state law.

However, it is not clear how state courts would interpret "abusive" under state law. Although the term appears in the CFPA, few states' UDAP statutes cover abusive conduct. In a document summarizing CFPB recommendations for strengthening state-level consumer protections, the Bureau recommended that states incorporating "abusive" into their UDAP statutes include a rule of construction providing that "abusive" should be interpreted in a manner consistent with the CFPB's 2023 Policy Statement on Abusive Acts or Practices.⁷ State courts might also rely on caselaw interpreting "abusive" in CFPA cases; alternatively, they could adopt broader or narrower definitions of the term. Additionally, the CFPB, under Republican leadership, may opt to replace guidance defining "abusive" conduct, which would further bear on courts' interpretations.

Furthermore, New York's Department of Financial Services has proposed amendments to state regulations governing overdraft fees and insufficient funds charges.⁸ These amendments would cap the number of such fees an institution could charge, stipulate rules for transaction processing to prevent banks from processing in a manner designed to maximize overdraft fees and limit the circumstances in which an institution may charge overdraft fees.⁹ These regulations will significantly impact how banks and financial institutions handle deposit account transactions.¹⁰

b. Hiring

State regulators are also recruiting newly-available former federal employees to bolster their ranks. New York Governor Kathy Hochul announced new hiring initiatives for federal employees who were recently displaced due to mass federal government layoffs.¹¹ Similarly, the California Department of Financial Protection and Innovation (DFPI) is recruiting to enhance its oversight of banks, fintech firms, and nonbank lenders.¹² Former Bureau staff will also likely take jobs at non-government organizations focused on consumer protection and may participate in bringing private litigation to advance policy goals.¹³ These hiring trends presage an expanded capacity for investigations and enforcement actions against financial institutions that might have previously been pursued by federal agencies. The influx of talent provides more than just additional personnel; it provides states with personnel knowledgeable on federal consumer protection laws, under which states are now more inclined to bring actions.

c. Will This Be a Blue-State Phenomenon?

Blue states are clearly more focused on addressing the Trump Administration's retrenchment from numerous Biden-era CFPB positions. They have taken preliminary steps to strengthen consumer protection, as demonstrated by a coalition of state attorneys general from major markets like California and New York, which has filed an amicus brief in federal court to defend the Bureau.¹⁴

Although blue states seem to be gearing up for aggressive enforcement, consumer finance companies should not assume that Republican-led states will stand pat. For example, Arkansas and Utah recently enacted laws regulating earned wage access products. In 2023 and 2024, Florida enacted statutes prohibiting lending licensees from discriminating against customers based on factors such as political opinions, lawful ownership of a firearm, or support for combating illegal immigration, drug trafficking, or human trafficking.¹⁵ There is also an emerging populist streak within the Republican party, exemplified by Senator Josh Hawley's co-sponsorship of legislation amending the Truth in Lending Act to cap credit card interest rates, a proposal that President Trump has supported on the campaign trail.¹⁶ This trend could result in heightened scrutiny by red-state attorneys general of consumer financial products and services.

Moreover, Republican state attorneys general may use enforcement of consumer...