CFPB Circular 2024-05 — Improper Overdraft and AI Chatbot Practices
United States · CFPB Issue Spotlight (June 2023); CFPB UDAAP / ECOA / TILA enforcement posture (2024)
Building on its 2023 chatbot report, the CFPB has warned that banks and lenders using generative-AI chatbots that mislead consumers — about fees, account terms, or credit denials — face liability under the Consumer Financial Protection Act, the Equal Credit Opportunity Act, and the Truth in Lending Act. Hallucinating chatbots are not a regulatory loophole.
Technical detail
CFPB Issue Spotlight 'Chatbots in Consumer Finance' (June 2023) and follow-on Circular guidance treat AI/chatbot misstatements as UDAAPs under 12 U.S.C. § 5536, ECOA adverse-action obligations under 15 U.S.C. § 1691, and TILA disclosure rules. CFPB has investigated several large banks' AI chatbot deployments.
Who is protected: Consumers interacting with bank, lender, or fintech AI chatbots
Who must comply: Banks, credit unions, fintechs, and non-bank lenders deploying customer-facing AI
Key facts
| Jurisdiction | United States |
|---|---|
| Level | Federal |
| Status | In effect |
| Protection strength | Moderate protection |
| Effective date | 2024-10-23 |
| Enacted | 2024-10-23 |
| Citation | CFPB Issue Spotlight (June 2023); CFPB UDAAP / ECOA / TILA enforcement posture (2024) |
| Enforced by | Consumer Financial Protection Bureau; state AGs (parallel UDAP authority) |
| Private right of action | No — agency enforcement only |
| Penalties | CFPA civil money penalties (tiered up to ~$1.36M/day for knowing violations), restitution, injunctive relief |
| Topics | consumer protection · automated decision-making · housing and credit decisions |
| Last verified | 2026-06-17 |
| Official source | Chatbots in Consumer Finance (Issue Spotlight) ↗ |
More AI rules in United States
- FTC Act Section 5 (unfair/deceptive AI) · In effect
- TAKE IT DOWN Act · In effect
- FCRA (AI in credit & background checks) · In effect
- ECOA / Regulation B (AI credit discrimination) · In effect
- Title VII / ADA (AI hiring) · In effect
- COPPA + 2025 Rule (childrens data) · In effect
Related consumer protection rules elsewhere
- CCPA/CPRA + ADMT Regulations · In effect
- AB 2013 (Training Data Transparency) · In effect
- SB 942 (AI Transparency Act) · Enacted (not yet in effect)
- SB 53 (Frontier AI Safety) · In effect
- Colorado AI Act (repealed) · Repealed / replaced
- SB 26-189 (Colorado ADMT Law) · Enacted (not yet in effect)
See something wrong or out of date? Submit a correction — every entry must carry a verifiable official source.