Regulatory & Legal Record
Significant lawsuits, settlements, DOJ indictments, SEC enforcement, and ongoing regulatory oversight involving Equifax, documented with public sources.
Enforcement Actions
| Year | Action | Authority | Outcome | Status |
|---|---|---|---|---|
| 2017 | Multi-district class action litigation (MDL) | U.S. District Court, N.D. Georgia | Consolidated hundreds of consumer lawsuits | Settled |
| 2018 | UK ICO enforcement | UK Information Commissioner's Office | £500,000 fine for UK data protection failures | Resolved |
| 2019 | FTC / CFPB / State AG settlement | FTC, CFPB, 50 States & Territories | Up to $700M settlement; $425M consumer fund | Settled |
| 2020 | DOJ criminal indictment | U.S. Department of Justice | Four Chinese military hackers indicted | Resolved |
| 2020 | SEC insider trading investigation | Securities and Exchange Commission | Former CIO charged with insider trading; pled guilty | Resolved |
| 2022 | CFPB supervisory actions | Consumer Financial Protection Bureau | Continued oversight of dispute handling and accuracy | Ongoing |
| 2023+ | State attorney general investigations | Multiple State AGs | Investigations into post-settlement compliance | Ongoing |
Sources: FTC.gov, CFPB.gov, DOJ.gov, ICO.org.uk, SEC.gov, U.S. District Court PACER records.
Data Practices
Credit bureaus compile data from lenders, public records, and collection agencies — often without the consumer's direct knowledge. This includes payment histories, account balances, credit inquiries, and identifying information.
Consumer credit data is a revenue product. Equifax sells access through credit reports, fraud detection services, employment verification, and marketing lists. Over $5 billion in annual revenue is derived from data services.
The Fair Credit Reporting Act requires credit bureaus to maintain "reasonable procedures" for accuracy and gives consumers the right to dispute errors. Enforcement has been criticized as insufficient.
California's CCPA/CPRA, Virginia's VCDPA, and similar state laws provide additional consumer data rights including access, deletion, and opt-out of data sale.
Federal law guarantees free credit freezes and fraud alerts. A security freeze prevents new accounts from being opened in your name without your authorization.
Consumers rarely choose to have their data held by credit bureaus — inclusion is automatic when creditors report. This raises ongoing questions about informed consent.