I was a sales director for over a decade for one of the big three credit bureaus. My job was to recruit, train, and lead sales representatives to grow revenue. Consumer reporting agencies make money by selling behavioral information to businesses with a permissible purpose to buy it.

People frequently ask whether credit agencies sell your personal information. There is ongoing tension between protecting privacy, and achieving sales quotas. Credit bureaus collect and market four types of personal data:

  1. Consumer initiated report and scores
  2. Lender initiated account reviews
  3. Lender initiated prescreens and triggers
  4. Traditional business initiated demographics

Sale of Consumer Initiated Reports

Most people are familiar with the traditional consumer reporting agency products: reports, and risk scores. Consumers are entitled to one free credit report from each bureau once per year. However, companies must pay to review your report or score. This is the primary way that the reporting agencies make money.

Look for soft and hard inquiries on each of your three files. Soft inquiries indicate that they sold your information to a company wishing to send you a preapproved offer. Hard inquiries indicate they sold your file in connection with a transaction you initiated.

Most consumer-initiated credit report sales do not cause privacy alarms. The consumer gives the company his or her consent to review the file. In addition, the entity purchasing the report must have a permissible purpose. The FCRA defines permissible purpose: the circumstances under which a consumer-reporting agency can furnish a report.

Some consumer-initiated sales do cause privacy alarms. This occurs most frequently when consumers engage with non-traditional report users: cell phone companies, rental agents, insurance companies, utilities, etc. Many people simply do not expect these companies to pull a report and may sign consent paperwork without reading it.

Hard inquiries are logged for all consumer-initiated transactions. Consumer concerned about privacy can put a block on their credit report to prevent unauthorized businesses from buying their personal financial information.

Sale of Lender Initiated Account Reviews

Many banks and lenders routinely reevaluate the financial status of their existing accounts. Credit bureaus sell periodic account review data to identify customers with changing behaviors. Lenders use the updated information to change limits and other account terms.

Periodic account reviews occur without direct consent from the consumer. Indirect consent is established when the account is opened. Soft inquiries are logged for these transactions.

Sale of Lender Initiated Prescreens and Triggers

Credit bureaus sell personal information in the form of prescreens and trigger lists to qualified lenders. The practice attracts negative attention because the data are sold without the consumers’ knowledge or prior consent. The FCRA regulates the agencies, and explicitly allows this modest invasion of privacy provided the consumers receive a tangible benefit in return. A firm offer of credit is the tangible benefit.

Prescreens allow lenders to better target loan offers to the most qualified prospects. The consumer-reporting agency prunes a list of prospects using pre-defined criteria provided by the lender. The lender reduces its account acquisition costs, which allows them to offer better rates and extend more loans.

Trigger lists are a type of prescreen. In addition to weeding out unqualified prospects, trigger lists focus on consumers recently exhibiting a specific behavior. For example, consumers who recently bought a home often need additional money for repairs, new furniture, etc. Credit bureaus sell trigger lists of newly opened mortgages to lenders to take advantage of the opportunity.

Soft inquiries are logged anytime lists passing prescreen or trigger criteria leave the control of the credit bureau. Opt out prescreen allows consumers to control the marketing of their personal information in this manner.

Sale of Business Initiated Demographic Data

Consumer reporting companies are very diverse information marketing enterprises. Credit reporting may be their core product offering, but they provide a wide array of database services and share data with many different types of businesses.

Credit bureaus market demographic data to help businesses target, acquire, and grow new account relationships. Demographic data is collected from a variety of sources and can be sold without a permissible purpose. The FCRA does not govern the dissemination of demographics. This means almost any business, regardless of industry can purchase these data without your consent. Demographic information comes in many forms:

  • Name and address
  • Age
  • Number of children
  • Estimated income
  • Gender
  • Marital status
  • Ethnicity
  • Much more

Neither soft nor hard inquiries are logged when demographic information is purchased and used. These data are not considered protected information and do not appear on a consumer report. Identifying information is the one exception. A consumer report exists when identifying information and financial data are combined together. When sold separately a report does not exist.

The consumers who want to control the use of their personal demographic data can opt out of direct marketing programs.