February 5, 2026
Bipartisan Enforcement Is Rising In Consumer Finance
Lucy E. Morris and Robert D. Tilley
Originally published by Law360 on February 5, 2026. Reprinted with permission.
In December, the Democratic Attorneys General Association, or DAGA, announced that it hired Rohit Chopra to lead its new Consumer Protection and Affordability Working Group. In this role, the Biden-era director of the Consumer Financial Protection Bureau now leads a team of researchers and policymakers to recommend nationwide strategies for enforcement cases based on companies' abusive practices.1 In other words, Chopra once again has a formal role in identifying and prioritizing issues for consumer finance enforcement and oversight.
Many in the consumer finance industry breathed a sigh of relief in February 2025 when the Trump administration made clear that it would drastically curtail the CFPB's enforcement and supervisory activities. Given the sharp contrast between Chopra's aggressive approach and the Trump administration's attempts to shutter the CFPB, some might expect Chopra's appointment by Democratic states to foreshadow a partisan split in state enforcement.
However, one theme of consumer finance enforcement over the past year has been that Chopra's approach durably affected enforcement priorities for both red and blue states. Shortly after President Donald Trump fired Chopra, it became clear that we would see an uptick of state enforcement activity in response to the CFPB's pullback.2 We now appear to be at the beginning of a bipartisan state enforcement wave, in many ways following a blueprint set out by Chopra during his tenure at CFPB.3
Recent Amendments to State Consumer Protection Laws
Even before the DAGA announcement, it was striking how successful Chopra had been at setting the agenda for state consumer finance regulation. In the waning days of the Biden administration, the CFPB issued a report outlining proposed changes to state laws, most notably advocating for states to increase the breadth of their consumer protection laws.4 Following this recommendation, New York passed the Fostering Affordability and Integrity Through Reasonable Business Practices Act, taking effect this month. This new law expands the state's primary consumer protection statute to prohibit "unfair" and "abusive" acts — to match the scope of the federal Consumer Financial Protection Act — in addition to prohibiting deception.5 Crucially, the law also expands protections to include small businesses and nonprofits, allowing the New York attorney general to police business-to-business financial services on the same terms as consumer products.
Oregon took a different approach to statutory changes, mandating total price transparency for sales of online goods and services. This statute, which took effect on Jan. 1, prohibits online sellers from advertising or displaying prices that exclude mandatory fees, instead requiring the retailers to provide "all-in" price disclosures.6 Oregon's approach is consistent with both the Biden administration's attempts to prohibit junk fees and the current Federal Trade Commission's emphasis on all-in price transparency.7
Bipartisan Aggressive State Enforcement
Based on the news of Chopra's new role, we expect to see multistate attorney general sweeps relating to Chopra's past priorities, including junk fees, alternative finance products, algorithmic bias and data privacy. Whether by design or coincidence, within a few days of DAGA's announcement, seven state attorneys general sent letters to the six largest providers of buy now, pay later financing, seeking information about their products, fee structures and consumer dispute procedures.8 The CFPB under Chopra had previously expressed concern about the rapid increase in BNPL financing and imposed a number of regulations on BNPL products, which the Trump administration later reversed.
In 2025, we also saw multistate enforcement attention focused on several of the recently enacted state data privacy laws. In September, the attorneys general for California, Connecticut and Colorado, along with the California Privacy Protection Agency, announced that they launched a joint investigative sweep to identify violations of their respective state data privacy laws.9 In short succession, both the California attorney general10 and state Privacy Protection Agency (which has since rebranded itself as CalPrivacy)11 announced data privacy settlements in which two businesses — Jam City Inc. and Tractor Supply Company, respectively — each agreed to pay more than $1 million to resolve the alleged violations. Earlier in 2025, the Connecticut attorney general also announced an enforcement action against TicketNetwork, its first under the state's data privacy law that took effect in July 2023.12
Notably, Texas — a red state by any metric — was probably the single most aggressive state data privacy regulator last year. In January 2025, Texas filed a lawsuit against Allstate and its subsidiary under the Texas Data Privacy and Security Act, alleging that the company unlawfully collected, used and sold consumers' location data. The Texas attorney general's press release described this lawsuit as "the first enforcement action ever filed by a State Attorney General to enforce a comprehensive data privacy law."13 Texas remained active on data privacy enforcement throughout the past year, filing a lawsuit against TikTok in January 2025, announcing an investigation of DeepSeek for data harvesting in February 2025, and finalizing a $1.35 billion data tracking settlement with Google in October.
One of Chopra's most consistent priorities during this time at the CFPB was to emphasize and bolster the states' authority to enforce federal consumer financial law, with or without the involvement of a federal regulator.14 Over the past year, a number of states have pursued this type of case. Most recently, on Jan. 16, 2026, the Virginia attorney general filed a lawsuit, Virginia ex rel. Miyares v. Waller, in the U.S. District Court for the Eastern District of Virginia, asserting federal claims under both the Consumer Financial Protection Act and the Truth In Lending Act against several companies involved in financing consumer solar panel sales.15 The suit alleges that lenders facilitated $200 million in "money-losing" loans based on deceptive marketing about energy savings. The suit also closely follows the blueprint that Chopra set out for state enforcement of federal consumer finance law.16 For that reason, the timing of the suit is particularly notable. It was filed by outgoing Republican Attorney General Jason Miyares on his final day in office, rather than letting it fall to his Democratic successor.
This Virginia attorney general's lawsuit is also notable because it asserts claims under the FTC's Holder Rule, which requires the purchaser of a credit contract to be subject to "all claims and defenses which the debtor could assert against the seller" of the underlying goods.17 The Holder Rule has become an increasingly common tool for states seeking to protect consumers, despite legal questions about whether it can be enforced by the government. However, courts have allowed Holder Rule claims by several Republican attorneys general to survive motions to dismiss.18 We expect that state regulators will continue to bring claims under these aggressive legal theories until they receive significant pushback from companies and the courts.
Conclusion
The state enforcement activity over the past year suggests a bipartisan commitment to robust enforcement of state and federal consumer finance laws.
With the reemergence of Chopra, we expect that pattern to continue throughout 2026 and beyond. Members of the consumer finance industry should be prepared for scrutiny in every jurisdiction where they operate and, if necessary, to defend themselves against novel and aggressive legal theories.
Robert Tilley and Lucy Morris are partners at Hudson Cook LLP.
The opinions expressed are those of the author(s) and do not necessarily reflect the views of their employer, its clients, or Portfolio Media Inc., or any of its or their respective affiliates. This article is for general information purposes and is not intended to be and should not be taken as legal advice.
1 Evan Weinberger, Wall Street Agitator to Lead Blue-State Consumer Protection Drive, Bloomberg (Dec. 2, 2025), https://www.bloomberg.com/news/articles/2025-12-02/wall-street-agitator-to-lead-blue-state-consumer-protection-drive.
2 For example, see Lucy Morris & Robert Tilley, Expect to Feel Aftershocks of Chopra's CFPB Shake-Up, Law360 (February, 2025).
3 Kate Berry, As CFPB Retreats, State AGs and Bank Regulators Step Up, American Banker (Jan. 21, 2026), https://www.americanbanker.com/news/as-cfpb-retreats-state-ags-and-bank-regulators-step-up.
4 CFPB, Strengthening State-Level Consumer Protections: Promoting Consumer Protection Federalism (January 14, 2025) (available at https://files.consumerfinance.gov/f/documents/cfpb_strengthening-state-level-consumer-protections_2025-01.pdf.
5 N.Y. Gen. Bus. Law § 349.
6 Or. Rev. Stat. § Ch. 311, §1.
7 FTC Press Release, FTC Sends Warning Letters to 13 Property Management Software Providers Nationwide (Dec. 9, 2025), https://www.ftc.gov/news-events/news/press-releases/2025/12/ftc-sends-warning-letters-13-property-management-software-providers-nationwide.
8 Connecticut AG Press Release, Attorney General Tong Launches Inquiry Into Buy Now, Pay Later Lenders (Dec. 1, 2025), https://portal.ct.gov/ag/press-releases/2025-press-releases/attorney-general-tong-launches-inquiry-into-buy-now-pay-later-lenders.
9 Connecticut AG Press Release, Connecticut, California, and Colorado Announce Joint Investigative Privacy Sweep (Sep. 9, 2025), https://portal.ct.gov/ag/press-releases/2025-press-releases/connecticut-california-and-colorado-announce-joint-investigative-privacy-sweep.
10 California AG Press Release, Attorney General Bonta Secures $1.4 Million Settlement with Mobile App Gaming Company for Violating California's Nation-Leading Privacy Law (Nov. 21, 2025), https://oag.ca.gov/news/press-releases/attorney-general-bonta-secures-14-million-settlement-mobile-app-gaming-company.
11 CPPA Press Release, Nation's Largest Rural Lifestyle Retailer to Pay $1.35M Over CCPA Violations (Sep. 30, 2025), https://cppa.ca.gov/announcements/2025/20250930.html.
12 Connecticut AG Press Release, Attorney General Tong Announces $85,000 Settlement with TicketNetwork for Violations of the Connecticut Data Privacy Act (July 8, 2025), https://portal.ct.gov/ag/press-releases/2025-press-releases/attorney-general-tong-announces-settlement-with-ticketnetwork.
13 Texas AG Press Release, Attorney General Ken Paxton Sues Allstate and Arity for Unlawfully Collecting, Using, and Selling Over 45 Million Americans' Driving Data to Insurance Companies (Jan. 13, 2025), https://www.texasattorneygeneral.gov/news/releases/attorney-general-ken-paxton-sues-allstate-and-arity-unlawfully-collecting-using-and-selling-over-45.
14 For our contemporary discussion of these early actions, see Lucy Morris & Robert Tilley, Tracking CFPB Efforts to Promote State Enforcement Action, Law360 (June 8, 2022). See also CFPB, Final Interpretive Rule, Authority of States to Enforce the Consumer Financial Protection Act of 2010, 87 Fed. Reg. 31940 (May 26, 2022) (available at https://www.govinfo.gov/content/pkg/FR-2022-05-26/pdf/2022-11356.pdf).
15 Virginia ex rel. Miyares v. Waller, No. 3:26-cv-00039 (E.D. Va. Jan 16, 2026).
16 Rohit Chopra & Seth Frotman, State Enforcement as a Federal Legislative Tool, Harvard Journal on Legislation (January 15, 2025) (available at https://journals.law.harvard.edu/jol/2025/01/15/state-enforcement-as-a-federal-legislative-tool/).
17C.F.R. § 433.2.
18 See, e.g., State of Tenn. Ex rel. Skrmetti v. Ideal Horizon Benefits, LLC, No. 3:23-cv-00046 (E.D. Tenn. Sept. 30, 2024).