Experian, TransUnion, Equifax

Mark Miller: 

A lot of the times when we dive into this, there’s obfuscation because there’s so many documents When I looked at this each of those had 10 or 15 different documents that they were linking to. Is there a real expectation that real users are going to read this stuff? 

Joel MacMull: 

I think it’s very clear that there is a tact here. And I would suggest to you that it’s something pernicious. Which is, let’s see the extent to which we can overwhelm the average individual consumer, at least in the case of these credit reporting agencies, with various ports of entry for purposes of trying to find, for example, how does a particular credit reporting bureau treat my private information? 

 You’re absolutely right, and we just spoke about this sort of offline, is that it is such a tangled web with various hyperlinks, or subdomains off of subdomains that it’s almost impossible, certainly in the absence of having a kind of, site tree where one should be able to go and yeah, they’re very difficult to navigate. 

I think this is what you’re driving at. Particularly with these large multi-million, multi-billion dollar companies, that that’s done on purpose. I have to wonder that at the legislative level and frankly at the national level with Congress, is there someone who is promoting a kind of, consumer agenda that is aware of this. Is this on someone’s radar? Are people complaining about this? 

Because at the end of the day, a very good argument can be made that whatever notice is purportedly being delivered by these companies and by the mechanisms they’re using, and specifically I’m talking about hyperlinks from hyperlinks or that sort of thing, I’m critical of it. Judges don’t make law, but I have to believe that there’s a handful out there that have condemned exactly this kind of practice. 

Mark Miller: 

I think that you could make a good case as a lawyer going into something like this, that if you get taken to court for something that you’ve breached in one of these terms of agreements, there’d be a solid case to say there is no expectation that somebody’s going to read all this. 

With that in mind, I want to start and just lay out the ground rules for what we’re talking about here. For people that haven’t paid attention to credit reporting agencies, we’re talking about TransUnion, Equifax, and Experian. Those are the big three that all keep our credit reports. All the mortgage companies go to these guys to see what our credit rating is, things like that. 

The interesting thing for me, Joel, to start the discussion is I really looked and said, when was the last time the terms of agreement were updated for each of these, I was surprised. When I looked at TransUnion that hasn’t been updated since March, 2019. 

Joel MacMull: Yeah, that wasn’t lost on me either. I don’t work at TransUnion. I don’t know, internally what kind of guidelines they have to look at this and refresh it, but I also have to wonder whether that’s really correct. To the extent that on the TransUnion page in particular, what they call their terms of service for exactly the reasons I mentioned that there’s several points of entry, query whether the last update in connection with anything that TransUnion believes to be part of its terms of service was actually last revised in 2019. Or whether what we’re really seeing here is a bit of a recording error.

In other words, there may have been a refinement to some discreet issue, but it has not made its way to the main page and I suppose an acknowledgement or credit as to when that little discreet piece may have been amended. 

Mark Miller: If we go to court, and TransUnion says , we told everybody in 2022 about this. Could you legally go back and say, well, you’re telling me on the front page of your terms of service that this hasn’t been updated since 2019, so why would I look any deeper? 

Joel MacMull: 

I’m not sure it would be dispositive. Questions like that are often they’re facts and circumstances.

 If I have what I believe to be one agreement, And I believe to be the operative agreement during whatever the relative period is, whether I breached or I’m making a claim against something that TransUnion has or hasn’t done, I would imagine that it will come into evidence and it’ll be left as a fact finder to determine how important is that discrepancy in dates.

So for example, is the document that stated 2019 an entirely different document that’s enforcing entirely different obligations, or as I suspect would be in the case, at least with these particular entities. Is it’s pretty much the same, but maybe there’s been a tweak with respect to the arbitration provision or the class action provisions or whatever.

Mark Miller: 

Let’s keep that train of thought then I’m going to jump over to Experian. Because they updated February 2nd, 2023. Sure. But I got no notification as a consumer that they had updated their terms of service. , so where’s my position now? They updated two weeks ago. didn’t tell me it was updated. Am I bound by that agreement? 

Joel MacMull: 

I think we are. and let’s understand something too. This leads to all kinds of policy discussions we could have, but as you pointed out, these three entities whether we like it or not, sit on a lot of personal information of ours.

I don’t know, frankly, the authority by which they’re able to collect that information. We certainly know that they sell that information, but there’s no way for us short of falling off the grid in a Ted Kazinski style fashion, to not essentially have our data at least be picked up by these companies.

Mark Miller: 

If they’ve updated on February 2nd, 2023. Yes. And not notified the public that they have updated their terms of service, are we bound by the new terms of service? 

Joel MacMull: 

A couple of things. Number one is the notice on their website suggesting that they have updated their terms of service, that’s the notice. 

I think what you mean is something more personal. and you’re not saying this, but I’m inferring from this, like for example, you didn’t get an email in your inbox from Experian and you certainly didn’t get a piece of paper in the mail informing you that they updated their terms of service. Therefore, to what extent are you bound by it. 

Now remember, as I said, not withstanding the fact that they collect data on us, whether we like it or not, they also sell products. So if I hop on one of these, and I, I was more attuned to this back when I was buying a home for all the reasons you mentioned, because the first thing a mortgage company does is run your credit and you realize that there’s some $25 copay that for whatever reason wasn’t paid six years ago and you’re like, oh my God. And you’re, cleaning all that up. If you go onto their website and you buy a product today, let’s say you want, and I m making this up, you want an advanced credit report, by virtue of you making the purchase today and they say, basically our terms of service are updated. Yeah. There’s really no court in the land, absence some sort of overall policy consideration, that’s not going to say that whether you like it or not, you use the tool, therefore you’re bound by the document or the contract. 

Mark Miller: 

I can’t see accepting that you have to read through 15 to 20 single space documents in order to legitimately punch that accept button. That’s just way out of bounds of there any reasonable expectation.

Joel MacMull: 

There is a concept that we lawyers are taught something in law school, and I got to tell you, if I’ve seen it professionally, I could count it on one hand. It’s, called a contract of adhesion. The concept is that the relative bargaining power between the two parties is so different in nature that I, as a lowly consumer, cannot possibly be given the benefit of the bargain because either the terms are so onerous or, and I think this is akin to it, the circumstances under which I could considered giving notice of the terms, which is really more what we’re talking about, are so onerous that it is literally impossible, impossible for the reasonable person, a layperson, to understand what it is that they’ve committed to. 

Mark Miller: 

The other thing that is shocking to me when I went through this is that the company says, at its sole discretion can offer optout. What do you mean, your sole discretion That means that you can say I’m not offering it. 

Joel MacMull: That was not lost on me. Did you go on and read the optout procedure? Did you see how… I don’t need to ? You can imagine what it is, right?

Yeah. I’m, between two and four on every other Thursday, we need you to go down to the town square and do a…

Mark Miller: 

I’ve actually run into that. Literally, you have to be at the place between three and four o’clock on Tuesday. I have actually run into that. 

Joel MacMull: 

That was, before the internet era, that was from what I’m told, and I’m not that old, but that was a classic tact that was used in sort of municipal government.

If you wanted a permit for a parade on Memorial Day, you had to be time and place. And it’s the classic, don’t argue with City Hall. If that’s what they say, then that’s what you got to do. 

No, you’re right in their sole discretion, which is interesting. So I think this is where, this might be that exception to what I said, and I’m just guessing here, I honestly don’t know.

But I think these contracts become enforceable, particularly where the provider gives the opportunity to the consumer to opt out. So to your point, how can they strong arm me to participate when, in the case of these three credit reporting agencies, I’m not even a willful participant. Whether I like it or not, and I want to buy a car, I want to buy a house they’ve got that data. So I suspect that courts have said, in as much as you offer consumers, which by the way, the process is incredibly onerous, you offer them an opt out so that they could opt out of mandatory arbitration. Okay? You need to do that. Of course what they do is they say, okay, it’s gotta be a pre-marked stamped envelope that, has to indicate that there’s a clear intention that you not be bound by the arbitration agreement.

One of these companies, in fact, just this morning as I was preparing for our talk, one of these companies provides exactly that. 

Mark Miller: 

The thing that stood out for me the term soul discretion means that there is no obligation to do anything. 

Joel MacMull: 

That’s right. But it cuts the other way, which is that if in their sole discretion they decide not to provide you and I as consumers with an opt out then that, as far as I’m concerned, makes it more right, not less so, for us to make the argument that we should not be bound by the agreement because it essentially only ran in one direction and in your favor, credit bureau. 

Mark Miller: 

The next topic then, as we’re pounding this thing out here is the liability amount, the limited liability shall not exceed the amount paid by you to this service. The dilemma for me Joel, is that there is no room here for harm cost. If I pay you five bucks and you completely hosed me, then it’s worth more than $5.

Joel MacMull: 

I don’t know the answer. I can certainly tell you that a plaintiff’s lawyer on the consumer protection side that is sensitive to these issues would know the answer and I’ll bet you that the issue has been litigated on something very similar, where there’s a federal or state statute that provides for x and one of these companies where someone similarly positioned said, no, no, no, no. Any award here has necessarily got to be X minus one, whatever the limitation of liability is in the contract. 

 More generally, and I agree with you, they suck, but, I as a lawyer enter into these all the time, with certain consultancy companies. For example, when I need an expert, an accounting expert, one of the things they’ll do is they’ll disclaim liability, and they’ll also say that in the event that there is any liability, it could be no more than the fees you paid our firm in connection with the services rendered.

 Query whether that’s enforceable. I have to believe in many cases it is. Particularly for someone like me who’s deemed to be a sophisticated or a law firm who’s deemed to be a sophisticated party. 

Mark Miller: 

All right. Let’s look at the last one I want to cover here as we’re looking at it, and this is consumer protection.

It says now, and I’m reading directly from my notes that I took from the documents: “Personal information can be shared with business partners and service providers.” I have no control over who those people are or how they’re going to use my data. And then I’m also agreeing to targeted marketing and advertising. 

Those are two separate things, but I put ’em in the same bucket because that’s a personal level, now. You’re going to give my info out and you’re going to allow people to target market me with anything. 

Joel MacMull: 

And what is that info? In the context of a credit reporting agency, think about what that information is. We’re not just talking about name, phone number, and an address here. You’re sitting on, for example, what I pay my car company on the payout on my car. What rights, what, right, do you have third party to disclose that information? And it’s particularly egregious with these companies for the reasons we mentioned right off the top, which is, it’s one thing if you enter into an agreement voluntarily, but as I said, whether we like it or not, these folks from some sort of congressional mandate, these folks, meaning these credit bureaus, are allowed to collect our data whether we like it or not.

To my knowledge and I not looked into this, is, are we as consumers able to opt out of their aggregation and collection of our data? Not to my knowledge. 

Mark Miller: 

If we go back to the point we did two sections before this. They have the sole discretion can offer opt out. 

Joel MacMull: 

That optout is with respect to, I think, the mandatory arbitration provision. It is not an opting out of their general service, which is what? Which is collecting information on you as it relates to your finances. The optout is the optout, but the concept of which it applies is different. 

Mark Miller: 

As we’re looking at the three major credit reporting companies in the United States, there isn’t any recourse for a consumer against any of this stuff, it seems like. You are already in the system. You did not opt into the system to get these three companies to get your personal information. You did not opt into allowing them to give out that information. What do we got here? 

Joel MacMull:

I imagine there’s a public policy argument somewhere that goes something like this. If you as a consumer want to borrow money, or to the extent that you even made a transaction and entered into the social contract that exists in making that transaction… let’s be honest, these are quasi-governmental agencies in terms of the way they operate.

 Think about the data they’re sitting on. If I have a federal or a state tax lien on a piece of property, it’s reported. So that’s why I suggest that there’s a sort of governmental like component. But yeah, it’s certainly an issue. It’s certainly an issue.

 I want to just touch, and I want to sum this up with just a brief vignette if I can. Because this, at least in my space, is an important week, once again before our United States Supreme Court. This week, as you may have heard, there’s a case before the Supreme Court in which, and I believe it’s entitled Gonzalez vs Google, where a family is seeking to be able to sue Google for what it professes was their, certainly tacit endorsement, their active promotion of certain ISIS related videos on YouTube. And here’s the backstory. 

When it was in its nascent, I was just a babe myself, but back in, I think it was 1994, Bill Clinton was in the White House. Congress passed Section 230, known as the Communications and Decency Act. The internet was in its infancy, but it basically provided as follows: we’re going to treat the internet like we do telephone. It is a medium by which people may send messages through our platform. We are not going to treat the internet in the way that we treat newspapers and magazines in what I would call hard classic publications. Congress was well aware of the fact that because I run a website, a bulletin board in those days, and someone can post to my bulletin board, you as an aggrieved party should not be able to sue me in your defamation claim against Joe Blow, i.e., the poster. 

I’m pleased to say that some years ago, many years ago now, I had a wonderful case. that was a great opinion that basically found that our client was really not liable in the wake of the protections of 230.

 The reason why the Google case is different is that the argument being made by the Gonzalez family was that users of YouTube were being pushed content that was pro ISiS. 230 is important because while it does not provide liability for the medium, the box in which the message may appear, it presupposes that the person controlling the box doesn’t author or otherwise craft the message. 

The reason why the Gonzalez case is interesting is because the plaintiff’s lawyers in that case have made the argument that yes, traditional 230 laws should apply, where a website does not take ownership of the content or alter the contents. But what we’re seeing here is Google, through its algorithms is promoting content, delivering content that would not otherwise be delivered in the absence of those algorithms. And oh, by the way, every social media platform on the planet conceptually uses the same thing. 

So why do I make this argument? You talk about targeted marketing and advertising that Experian, Equifax, TransUnion say, “You’re going to be a recipient of target marketing,” and they do it with the expectation that Section 230 would essentially insulate them from any liability that any consumer may have against them for receiving, either an unwanted or perhaps even more problematic, advertisement that they didn’t want. And presumably if anyone turned around and sued Equifax, they’d say, “Hey, wait a second. We are not the publisher. We’re not the publisher.” This is very interesting because the, “We get to do whatever we want with advertising, and you are going to be subject to advertising. And oh, by the way, we’re not liable for it.” It’s at least implied. I don’t know if the language says as much, but I would submit to you the only reason why it’s in there is because they think they’ve got a shield. Query whether that shield will still remain on or before the end of June when the court issues its opinion in this case.

Mark Miller: 

I want to remind people that you’re a lawyer, but you are not their lawyer. 

Joel MacMull: 

…at least not yet.

Mark Miller:

Thanks for joining us for this week’s “You’re kidding me… that’s in my EULA??” We’d appreciate your comments on today’s show page, located at WhatsInMyEULA.com. You’ll also find information on how to get in touch with Joel. While you’re on the page, tell us what other EULAs we should investigate. If we use your suggestion, we’ll give you a shoutout in that episode.

“That’s in my EULA??” is published weekly. Special thanks today to Katy, that’s with a ‘T”, Kadi, that’s with a “D”, Edwin, and Tracy for the awesome voiceover work at the beginning of the show. Music today is provided by Hash Out from Blue Dot Sessions. 

We’ll see you next week.

This was a Sourced Network Production.

If you’re interested in talking with Joel about some of the issues in this episode, shoot him an email.

Joel G. MacMull | Partner
Chair, Intellectual Property, Brand Management and Internet Law Practice
(973) 295-3652 | JMacmull@mblawfirm.com