Authorized third party
Under the US data rights rule, a third party that has met the authorisation procedure to access a consumer's data.
Under the CFPB's personal financial data rights rule, an authorized third party is a third party that has complied with the rule's authorisation procedures, which include giving the consumer an authorisation disclosure, certifying to its obligations and obtaining the consumer's express informed consent. Those obligations limit collection, use and retention of data to what is reasonably necessary for the product the consumer asked for. The CFPB has since opened a reconsideration of the rule, so current status and compliance dates should be checked on its pages.
Agent Minute explains this term on 30 December 2026.
Related terms
Data providerUnder the US data rights rule, a covered firm that must make consumer financial data available on request.ConsentA freely given, specific, informed and unambiguous indication of a person's agreement to the processing of their data.RevocationThe principal withdrawing a mandate or consent before it expires, after which no one may act on it.Open bankingCustomers letting authorised third parties access their payment account data and initiate payments through secure APIs.