Consumer Protection Act: Federal Laws, CFPB, and State Rules

Consumer protection laws in the United States are a layered set of federal and state statutes that give you legal rights when a business misleads you, charges hidden fees, collects debts abusively, sells you a dangerous product, calls you illegally, or misuses your personal data. The core federal pieces are the Federal Trade Commission Act, the Consumer Credit Protection Act (which contains the Truth in Lending Act, Fair Credit Reporting Act, Fair Debt Collection Practices Act, Equal Credit Opportunity Act, and Electronic Fund Transfer Act), the Consumer Product Safety Act, the Telephone Consumer Protection Act, and the Magnuson-Moss Warranty Act. Every state adds its own “little FTC Act,” and twenty states now have comprehensive privacy laws on top. Enforcement is shared among federal agencies, state attorneys general, and private lawsuits by consumers themselves.

The FTC Act: The Broad Backstop

The Federal Trade Commission Act of 1914 is the widest federal consumer protection law. Section 5 declares “unfair or deceptive acts or practices in or affecting commerce” unlawful, and that phrase covers nearly every industry and transaction type.¹

Two standards do most of the work. A practice is deceptive if a material misrepresentation or omission is likely to mislead a reasonable consumer. A practice is unfair if it causes substantial injury that consumers cannot reasonably avoid and that isn’t outweighed by benefits to consumers or competition.² The FTC enforces Section 5 through administrative cease-and-desist proceedings and through injunction suits in federal court, and it can seek civil penalties when companies break final orders or trade regulation rules.³

One boundary matters if you’re hoping the FTC will get your money back. In 2021 the Supreme Court unanimously held in AMG Capital Management v. FTC that Section 13(b) does not authorize courts to award restitution or disgorgement, so the agency now has to use its slower administrative process or the narrower remedies in Section 19 to return money to consumers.⁴

If you’ve been scammed or misled, you can file a complaint at ReportFraud.ftc.gov. The FTC uses those reports to spot patterns and build cases, and shares them with other federal, state, and local law enforcement.⁵

Credit, Debt, and Payment Protections

The Consumer Credit Protection Act, signed May 29, 1968, is the umbrella statute for most of your rights around borrowing money, being reported on, paying with a debit card, or dealing with a collector.⁶ Congress has added title after title over the years. Here’s what each of those titles actually gives you.

Truth in Lending Act

TILA requires creditors to disclose the true cost of credit — the annual percentage rate, finance charges, and total payments — so you can compare loan offers on the same terms.⁶ If a loan is secured by your home, you get a three-day right to rescind after closing.⁷ Willful violations can carry criminal penalties up to $5,000 and a year in prison, and you can sue for actual damages plus statutory penalties. TILA is implemented through the CFPB’s Regulation Z, and its coverage threshold for consumer credit transactions adjusts each year for inflation; for 2026 the threshold is $73,400.⁸

Fair Credit Reporting Act

Added in 1970, the FCRA regulates credit bureaus, tenant screening companies, and other consumer reporting agencies.⁹ Your concrete rights:

One free credit report every 12 months from each nationwide credit bureau and specialty reporting agency.¹⁰
The right to dispute inaccurate or incomplete information; the agency must typically investigate within 30 days and correct or delete anything it can’t verify.¹⁰
Time limits on negative information — most items must come off after seven years; bankruptcies after ten.¹⁰
An adverse action notice whenever a company denies you credit, insurance, or a job based on a consumer report; the notice must identify the reporting agency.¹⁰
The right to freeze your reports or place a fraud alert lasting one to seven years.¹¹

If your rights are violated, you can sue in state or federal court.⁹

Fair Debt Collection Practices Act

The FDCPA targets third-party debt collectors — collection agencies, debt buyers, and attorneys collecting on behalf of creditors — for personal, family, and household debts. It generally does not apply to the original creditor.¹² Collectors covered by the law may not:

Contact you before 8 a.m. or after 9 p.m. local time.¹³
Use obscene language, threats of violence, or repeated calls meant to annoy you.¹³
Misrepresent what you owe, imply government affiliation, or threaten arrest without legal authority.¹³
Keep contacting you after you send a written request to stop, with limited exceptions.¹³

If you sue and win, you can recover actual damages, up to $1,000 in statutory damages per action, court costs, and attorney’s fees. Class actions are capped at the lesser of $500,000 or one percent of the collector’s net worth. You have one year from the violation to file.¹³

Equal Credit Opportunity Act

The ECOA prohibits creditors from discriminating based on race, color, religion, national origin, sex, marital status, age, receipt of public assistance income, or the good-faith exercise of any right under the Consumer Credit Protection Act. If you’re denied credit, you can ask for the specific reasons. For a first-lien home loan application, the creditor must give you copies of all appraisals used.¹⁴ The Department of Justice can sue where there’s a “pattern or practice” of discrimination.¹⁵

Electronic Fund Transfer Act

The EFTA protects you when you use debit cards, ATMs, direct deposit, and peer-to-peer payment services. The most important part is the cap on your losses from unauthorized transfers. Report a lost or stolen card within two business days and your liability is capped at $50. Report after two days but within 60 days of the statement showing the unauthorized activity, and liability rises to $500. The bank bears the burden of proving the transfer was authorized.¹⁶

When you report an error, the institution must investigate promptly, report results within the regulatory timeline, and correct any confirmed error within one business day. It cannot make you file a police report or contact the merchant first, and no account agreement can waive these protections by calling a transfer “final and irrevocable.”¹⁷

The CFPB and What Its 2025 Pullback Means

The Consumer Financial Protection Bureau was created by Title X of the Dodd-Frank Act in 2010 to consolidate consumer financial protection work previously scattered across the Federal Reserve, OCC, FDIC, OTS, and NCUA.¹⁸ It writes rules, supervises financial companies, and brings enforcement actions against “unfair, deceptive, or abusive” acts and practices. The “abusive” standard is broader than the FTC’s: it covers conduct that materially interferes with a consumer’s ability to understand a product’s terms or takes unreasonable advantage of a consumer’s lack of understanding or inability to protect their interests.¹ The CFPB is the primary enforcer for banks with more than $10 billion in assets and the exclusive federal enforcer for nonbanks like payday lenders and debt collectors.

What’s changed matters for anyone counting on the bureau. Since early 2025, Acting Director Russell Vought has narrowed the agency sharply. In May 2025 the CFPB withdrew 67 guidance documents, rescinded its policy statement on unfair, deceptive, or abusive practices, and pulled back its interpretive rule on state enforcement authority. The bureau closed about 40 percent of pending investigations, dismissed or withdrew 19 enforcement actions, and terminated 22 more during 2025.¹⁹ As of early 2026, the bureau proposed cutting its staff by roughly 53 percent, with supervision down 78 percent and enforcement down 63 percent.²⁰ State attorneys general still have express authority under Title X to enforce federal consumer financial law, and Dodd-Frank preserves stronger state laws.¹⁸ Practically, that means state regulators and private lawyers now handle much of the enforcement the CFPB has stepped away from.

Product Safety

The Consumer Product Safety Act created the Consumer Product Safety Commission, which sets safety standards, orders recalls, and imposes civil penalties on companies whose products create unreasonable risks.²¹ Manufacturers, importers, distributors, and retailers must notify the CPSC within 24 hours if they learn a product may contain a defect creating a substantial hazard or an unreasonable risk of serious injury or death.²² Selling a recalled product is a federal violation.

The 2008 Consumer Product Safety Improvement Act expanded the agency’s authority over children’s products, including a 100 parts-per-million limit on lead content and a ban on certain phthalates in toys and child care articles above 0.1 percent.²³ Children’s products must be tested by an accredited third-party lab, and manufacturers must issue a Children’s Product Certificate. To report an unsafe product or check for recalls, use SaferProducts.gov.²²

Robocalls, Robotexts, and Telemarketing

The Telephone Consumer Protection Act of 1991 restricts telemarketing calls, robocalls, robotexts, and unsolicited faxes. In general, a business needs prior express written consent before using an autodialer or a prerecorded voice to call your cell phone or landline for telemarketing.²⁴ As of January 27, 2025, FCC rules require that consent be obtained on a one-to-one basis for a single identified seller at a time, with clear disclosure that signing is not a condition of any purchase.²⁵

The TCPA gives you a strong private right of action. You can sue in state court for $500 per illegal call or text, and a court can triple that to $1,500 per violation if the caller acted willfully or knowingly. State attorneys general can also sue on behalf of residents on the same per-violation basis.²⁶

Warranties

The Magnuson-Moss Warranty Act of 1975 does not require a company to offer a written warranty, but if it does, federal rules apply. Written warranties on products costing more than $10 must be labeled “Full” or “Limited.” A full warranty must provide free repairs, service to any owner during the warranty period, and a replacement or full refund if the product can’t be fixed after a reasonable number of attempts. A company that offers any written warranty cannot disclaim implied warranties like the warranty of merchantability, and it generally can’t require you to use specific branded parts or services to keep the warranty in force. A breach of warranty is a federal violation, and a consumer who wins can recover court costs and attorney’s fees.²⁷

State Consumer Protection Laws

Every state has its own consumer protection statute, usually called a “little FTC Act” or a UDAP law (unfair and deceptive acts and practices). They generally prohibit deceptive practices in consumer transactions, and many reach unfair or unconscionable conduct too.²⁸ Their strength varies. Maryland’s Consumer Protection Act treats a violation of the federal Military Lending Act as an automatic state violation and allows penalties up to $10,000 for a first offense and $25,000 for later ones. Arkansas amended its Deceptive Trade Practice Act in 2017 to require proof of actual financial loss caused by reliance, and it bars private class actions entirely.²⁹

Remedies typically include actual damages, with treble or punitive damages available in many states when the misconduct was willful. Some states set statutory damage floors: $500 in Alaska, Colorado, and Indiana; $1,000 in Hawaii, Idaho, and New York. Attorney’s fees are available to prevailing consumers in most states.²⁸

State attorneys general are among the most active consumer enforcers. In 2025, California’s attorney general secured a $1.55 million settlement over failures to honor California Consumer Privacy Act opt-out requests for targeted advertising, Nebraska’s attorney general sued the e-commerce platform Temu over alleged unauthorized data collection and deceptive trade practices, and Pennsylvania settled with a debt collector that had misrepresented debts and charged interest exceeding state usury limits.³⁰

Digital Privacy and Data Protection

No comprehensive federal consumer privacy law has been enacted. A bill called the SECURE Data Act (H.R. 8413) was introduced in the House in April 2026 but has not advanced beyond committee.³¹ In the meantime, the FTC uses Section 5 to police data practices, and states have filled the gap.

Twenty states now have comprehensive consumer privacy laws in force. Indiana, Kentucky, and Rhode Island’s laws took effect January 1, 2026, joining California, Colorado, Connecticut, Oregon, and others. California has tightened breach notification timelines to 30 days for consumers and 15 days to the attorney general for breaches affecting 500 or more people, expanded data broker disclosure requirements, and launched a “DROP” platform that lets consumers opt out of data brokers in bulk. Colorado’s Artificial Intelligence Act, regulating high-stakes algorithmic decisions, took effect June 30, 2026.³¹

Federal enforcement in this space has continued. In early 2026 the FTC finalized an order against General Motors over unauthorized collection and sale of geolocation data through OnStar, secured a $100 million judgment against Walmart over deceptive earnings claims for its Spark Driver gig-work service, and a court-approved order required Disney to pay $10 million for enabling unlawful collection of children’s personal data.³¹

Where to Turn If Your Rights Are Violated

Which door to knock on depends on the problem. For scams, deceptive marketing, or unfair business practices generally, report to the FTC at ReportFraud.ftc.gov.⁵ For errors on your credit report, dispute directly with the reporting agency under the FCRA and, if unresolved, sue in state or federal court.¹⁰ For debt collector abuse, send a written cease-communication request and consider suing under the FDCPA within one year.¹³ For unauthorized debit-card or ACH transfers, notify your bank within two business days to keep your losses capped at $50.¹⁶ For illegal robocalls or texts, you can sue in state court for $500 to $1,500 per violation.²⁶ For an unsafe product, report at SaferProducts.gov and check for recalls before you use it.²² And for almost any consumer complaint, your state attorney general’s consumer protection division is a parallel path — often the fastest one now that the CFPB has scaled back.

1
FDIC. Federal Trade Commission Act Section 5 and Dodd-Frank
2
FTC. Enforcement Authority
3
FTC. Federal Trade Commission Act
4
Supreme Court of the United States. AMG Capital Management v. FTC
5
FTC. FTC Announces New Fraud Reporting Platform for Consumers
6
GovInfo. Consumer Credit Protection Act, Public Law 90-321
7
Justia. Consumer Protection Law
8
Federal Register. Truth in Lending Regulation Z
9
FTC. Fair Credit Reporting Act
10
Consumer Financial Protection Bureau. Summary of Your Rights Under FCRA
11
FTC. Fair Credit Reporting Act
12
Consumer Financial Protection Bureau. What Laws Limit What Debt Collectors Can Say or Do
13
FTC. Fair Debt Collection Practices Act Text
14
FTC. Equal Credit Opportunity Act
15
Department of Justice. Equal Credit Opportunity Act
16
Cornell Law Institute. 15 U.S.C. § 1693g – Consumer Liability
17
Consumer Financial Protection Bureau. Electronic Fund Transfers FAQs
18
Cornell Law Institute. Dodd-Frank Title X
19
Consumer Financial Protection Bureau. 2025 Enforcement Lookback
20
Banking Dive. CFPB Workforce Reduction Plan
21
CPSC. CPSC Launches National Recall Fraud Effort
22
CPSC. Consumer Product Safety Improvement Act
23
CPSC. Total Lead Content
24
FDIC. Telephone Consumer Protection Act
25
Federal Register. Rules and Regulations Implementing the TCPA
26
FCC. TCPA Rules
27
FTC. Businesspersons Guide to Federal Warranty Law
28
Justia. Consumer Protection Laws 50-State Survey
29
American Bar Association. States’ Divergent Approaches
30
California Office of the Attorney General. Privacy Enforcement Actions
31
FTC. Privacy and Security Enforcement