UDAAP stands for “unfair, deceptive, or abusive acts and practices.” The Consumer Financial Protection Bureau, which regulates the consumer finance market, usually pluralizes the term—”UDAAPs”—when referring to these acts and practices collectively; others forgo the “s.” Either way, the CFPB decides what counts as a UDAAP and what doesn’t, based on the agency’s assessment of how the act or practice in question affects consumers.
The idea of UDAAP blossomed out of the 2008–2009 financial crisis. The term “unfair, deceptive, or abusive” appears 12 times in the text of the Dodd–Frank Wall Street Reform and Consumer Protection Act, primarily under Title X, which established the CFPB. Indeed, protecting consumers from UDAAPs has been a core objective of the CFPB since day 1.
What Counts as a UDAAP?
So, what qualifies as a UDAAP? How can you ensure your organization doesn’t engage in unfair, deceptive, or abusive acts and practices? For better or worse, that’s up to the CFPB. The agency has written that “[a]n act or practice is unfair when:
- It causes or is likely to cause substantial injury to consumers;
- The injury is not reasonably avoidable by consumers; and
- The injury is not outweighed by countervailing benefits to consumers or to competition.”
If you think the list above is a recipe for broad, near-autocratic rule-making, you’re not alone. Critics have warned that unspecific UDAAP reasoning imparts the CFPB with unchecked authority, since what is and isn’t unfair, deceptive, or abusive is frequently a subjective question. And while the CFPB’s published guidance notes that “emotional impact and other subjective types of harm will not ordinarily amount to substantial injury,” it leaves in some room for subjectivity: “[I]n certain circumstances emotional impacts may amount to or contribute to substantial injury. In addition, actual injury is not required; a significant risk of concrete harm is sufficient.”