Data brokers have been getting away with selling Americans’ personal and financial data, an illegal practice that a new rule proposed by the Consumer Financial Protection Bureau will intend to stop, CFPB Director Rohit Chopra said.

The business model for data brokers is to buy and sell personal and financial data of individuals and groups of people to advertisers and other businesses that use the information for marketing or other purposes. The industry has skyrocketed as personal and financial transactions have moved from paper to online.

There is no federal privacy rule specifically for data brokers. Instead, federal agencies, including the CFPB, believe the industry falls under the Fair Credit Reporting Act (FCRA). The law spells out how credit agencies and others must protect the privacy of the data they handle. Congress intended that the personal and financial data of Americans be protected, Chopra said.

But despite years of warnings by authorities, many data brokers have failed to follow the FCRA, Chopra told reporters in an embargoed conference call Monday. The industry “routinely sidesteps” the FCRA, claiming it doesn’t apply to the industry, he said.