The Consumer Financial Protection Bureau (CFPB) recently filed actions against online lead aggregator D and D Marketing, Inc. d/b/a T3Leads and its co-founders alleging unfair and abusive practices in violation of the Consumer Financial Protection Act (CFPA). The CFPB alleges T3Leads resold loan applications containing sensitive personal data without assessing the sources of the leads or the purchasers they sold to. Thus, the CFPB is once again using its power to enforce violations of the CFPA’s broad prohibition on unfair and deceptive or abusive practices to pursue companies that are not directly engaged in consumer-facing transactions in the consumer finance industry.
Lead aggregators buy consumer information—leads—from websites that market financial products. This consumer information typically contains a consumer’s name, telephone number, home address, email address, references, and employment information. Then, lead aggregators resell this information to lenders and data brokers, who use the information to try to develop relationships with the customers.
The CFPB alleges that T3Leads: (1) bought leads from lead generators with no regard for whether the lead generators’ statements to consumers on how their information would be used was false or misleading; and (2) failed to properly vet the buyers of the lead information, who "steered consumers toward bad deals with lenders" and often did not comply with state usury laws. CFPB Director Richard Cordray said these lawsuits are "a reminder to the middlemen who buy and sell consumer loan applications: if you engage in this type of conduct, you risk the consequences for harming people."
The Federal Trade Commission also recently took its first enforcement action against a lead generator (Expand, Inc. d/b/a/ Gigats) and its founder for, among other things, misrepresenting how a consumer’s information would be used. Gigats claimed it was "pre-screening" job applicants for employers when it was actually gathering consumer information for lead generation for schools and career training or programs that paid kickbacks to Gigats.
Lead aggregators—and those buying and selling leads from them, or from "data brokers"—should recognize that regulators may hold them responsible for their business partners’ conduct.
©2026 Carlton Fields, P.A. Carlton Fields practices law in California through Carlton Fields, LLP. Carlton Fields publications should not be construed as legal advice on any specific facts or circumstances. The contents are intended for general information and educational purposes only, and should not be relied on as if it were advice about a particular fact situation. The distribution of this publication is not intended to create, and receipt of it does not constitute, an attorney-client relationship with Carlton Fields. This publication may not be quoted or referred to in any other publication or proceeding without the prior written consent of the firm, to be given or withheld at our discretion. To request reprint permission for any of our publications, please use our Contact Us form via the link below. The views set forth herein are the personal views of the author and do not necessarily reflect those of the firm. This site may contain hypertext links to information created and maintained by other entities. Carlton Fields does not control or guarantee the accuracy or completeness of this outside information, nor is the inclusion of a link to be intended as an endorsement of those outside sites.
