How Section 1033 May Cost You

Originally published on Substack. 

You open a budgeting app and connect it to your checking account. Or maybe you apply for a mortgage and authorize another company to review your financial history. You should be able to decide who sees your information and how you use it.

But your data doesn’t move by magic. Someone builds the connection, protects it from hackers, verifies requests, monitors fraud, and maintains the technology.

Who should pay for all that?

That simple question is at the center of the fight over Section 1033 of Dodd-Frank⁠. With the Biden-era rule currently stayed and the Trump administration reconsidering it, Washington has another chance to get this right.

How We Got Here

Congress passed the Dodd-Frank Wall Street Reform and Consumer Protection Act⁠ after the 2008 financial crisis. The massive 2010 law reshaped financial regulation and created the Consumer Financial Protection Bureau, or CFPB.

Buried within Dodd-Frank is Section 1033. It generally requires covered financial companies to make certain information about a consumer’s financial products and services available to that consumer upon request.
That’s reasonable. Consumers should control their financial information. Not sure this requirement is necessary, as markets would work this out, but that’s the current law.

The Biden administration went much further. In 2024, the CFPB finalized its Personal Financial Data Rights rule⁠, creating an extensive framework for financial institutions to provide data electronically to consumers and authorized third parties. The problem isn’t consumer access. It’s Washington deciding how the market should provide it.

Zero Isn’t Free

As I explained in my 2025 report on Section 1033 at Americans for Tax Reform⁠, the rule prohibits covered providers from charging consumers or authorized third parties for required data access.

Consider what that means. Suppose you authorize a financial app to connect to your bank account every day. The app may benefit commercially from that connection, but your bank must build and maintain the secure infrastructure that makes the connection possible.

Engineers aren’t free. Cybersecurity isn’t free. Fraud monitoring, servers, software upgrades, and compliance aren’t free.

Washington can mandate a price of zero, but it cannot make the cost zero. Those costs will appear somewhere else through higher prices, reduced investment, fewer services, or some combination.

Imagine if Washington required one payment company to let its competitors use its network without compensation because the transaction ultimately belonged to the customer. We wouldn’t call that competition. We would call it a government mandate.

Consumer ownership of data and free access to someone else’s infrastructure are not the same thing.

Markets Were Working

The mandate is even harder to justify because financial companies were already solving these problems.

Banks, fintech companies, and data aggregators developed agreements and increasingly secure connections because consumers demanded them. Companies had incentives to make those connections easier and safer.

That’s how markets work. Consumers demand better services, entrepreneurs respond, businesses negotiate, and competing technologies improve.

Government should punish fraud and theft. It doesn’t need to determine every term of the transaction or set the price at zero.

Congress Should Decide

There is also a basic question of government authority. Section 1033 gives the CFPB rulemaking authority and directs it to promote standardized electronic formats. But the statutory language does not expressly mention APIs or data aggregators.

That deserves greater scrutiny after the Supreme Court’s Loper Bright⁠ decision⁠ overturned Chevron deference in 2024. Courts must independently determine what statutes authorize rather than deferring to an agency merely because the law is ambiguous.

Congress writes the laws. Regulators should implement them, not create new ones.

Another Chance

A federal court stayed the rule’s compliance dates⁠ in October 2025. Meanwhile, the CFPB is reconsidering major parts of the framework, including fees, data security, privacy, and who can act as a consumer’s representative.

As of late September 2026, that reconsideration remains at the proposed-rule stage and has been under White House Office of Management and Budget review since August.

Russ Vought, my former boss when I served as chief economist at OMB, now serves as acting CFPB director. The administration should use this opportunity to narrow Washington’s role rather than replace one sprawling rule with another.

Consumers should be able to obtain their information. Beyond that, companies should generally negotiate how they exchange data and what those services cost. Liability should follow the data, and reasonable security standards should apply to anyone handling sensitive information.

Let Markets Work

I’ve long argued that Congress should eliminate the CFPB and place legitimate consumer-protection responsibilities in more accountable institutions. But the immediate Section 1033 question is simpler.

Your financial data belongs to you. Someone else’s infrastructure doesn’t.

Washington should protect consumers, enforce contracts, and punish fraud. Prices should communicate costs, property rights should encourage investment, and competition should push companies to offer safer and better services.

That’s a much better model than having Washington decide the price is zero and pretending the cost disappeared. Let markets work so people can prosper.