Equifax Privacy Policy

This document is Equifax's US-facing consumer privacy policy, governing how the company collects, uses, shares, and retains personal information across its websites, mobile applications, and consumer-facing products, with its legal basis rooted in consent, legitimate interest, legal obligation, and contractual necessity depending on jurisdiction. The policy states that Equifax collects a broad range of personal data including identifiers, financial information, credit and income data, government identifiers, geolocation, biometric data, and inferences drawn from this data to create consumer profiles, and authorizes use of this information for core credit reporting functions, marketing, product development, analytics, and sharing with affiliates, business partners, data brokers, and service providers. Notably, as a consumer reporting agency subject to the Fair Credit Reporting Act, Equifax operates under statutory data collection and sharing authorities that may differ from what general consumers expect from a typical website privacy policy, and the policy's broad inference and profiling disclosures, combined with its role as a data broker and credit bureau, create an unusually wide data footprint relative to most consumer-facing privacy policies. The policy engages the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, the California Consumer Privacy Act and California Privacy Rights Act, and state biometric privacy frameworks, with heightened compliance exposure for California residents who receive expanded rights including opt-out of sale or sharing and correction rights. Material compliance considerations include the interaction between FCRA permissible purpose requirements and broader marketing data uses, the adequacy of consent mechanisms for sensitive data categories including biometrics and geolocation, and the scope of data sharing with third parties characterized as service providers versus independent data controllers.