Call Don’t Click: Findings on Official Site AnnualCreditReport.com

 Report home | Read the report (PDF) | Previous section | Next section

 

Blacklisting, or not allowing active Web linking to the annualcreditreport.com site is an ongoing issue. [17] But those consumers who do manage to land at the official annualcreditreport.com site have further challenges to contend with.

Namely, there are issues regarding automatic selection for marketing and information sharing, menu confusion, and up to four different privacy policies to read and understand. Additionally, one credit bureau, TransUnion, is requesting consumer email addresses in a way that does not indicate the submission of the information is voluntary and is not required for receiving a free credit report.

Blacklisting for those who link to AnnualCreditReport.com

As of December 1, 2004, this is the message consumers saw when they clicked a link to annualcreditreport.com from all sites but the FTC and the three credit bureaus:

annualcredireport_blackList

It is intriguing that the credit bureaus are allowing imposter domains to help send them business via online ad links and affiliate marketing, while at the same time they are blocking legitimate organizations from sending consumers to the official free credit report site via online links.

The most current blocking message the credit bureaus are putting on the annualcreditreport.com site is as follows:

“For security purposes, www.AnnualCreditReport.com can be accessed by typing the web address “www.annualcreditreport.com“, or from links from the Federal Trade Commission (www.ftc.gov), Equifax (www.equifax.com), Experian (www.experian.com) and TransUnion (www.transunion.com) websites.

AnnualCreditReport.com is the only web source authorized by all three nationwide consumer credit reporting companies from which free annual credit file disclosures can be requested.” [18]

Again, it should be pointed out that the three credit bureaus allow affiliate marketing sites to actively link to the bureaus’ credit services. It is unknown how security risks are mitigated in the instances of affiliate marketing linking to credit bureaus’ commercial sites.

TransUnion Marketing to Consumers and Email Collection

If consumers use annualcreditreport.com to collect their federally mandated free credit report from the TransUnion credit bureau, consumers will run into two immediate issues. First, TransUnion pre-selects a checkbox that gives it permission to send consumers marketing and affiliate offers. Secondly, unlike the other two credit bureaus., TransUnion requests consumer email addresses at its registration page.

A third general issue to note is that TransUnion, unlike the other two credit bureaus, requires consumers to register at the TransUnion site in order to view their federally mandated free credit report. Registration requires consumers to provide more information than would otherwise be necessary.

TransUnion “Auto-Opt In”

On the TransUnion subsection of the official annualcreditreport.com site, consumers are automatically selected to receive marketing emails and have their information potentially shared with affiliates and partners. TransUnion accomplishes this by displaying a checked box on the bottom of the page on its site. If consumers do nothing, they will be effectively choosing to receive marketing and affiliate offers.

(PDF of TransUnion page with pre-checked box.)

The text of the TransUnion pre-checked offer states:

“You will receive a free monthly newsletter loaded with important credit education as well as valuable product offers provided by our subsidiaries and partners.” [19]

This pre-selection is problematic on a number of fronts. First, consumers should not be forced to de-select themselves from marketing and affiliate offers when they are going to the site specifically for collecting a federally mandated free credit report. It is important to note that in order to get those product offers from subsidiaries and partners, TransUnion may share consumers’ relevant information.

Secondly, the checked box is at the very bottom of the page, and may easily be overlooked by consumers.

In its annualcreditreport.com privacy policy, TransUnion states:

“Under the FCRA, we may provide information to companies that provide you with pre-approved offers of credit or insurance. 19 Text confirmed in December 2004.

If you indicated to us when you registered, placed an order or updated your account that you were interested in receiving information about other products and services, your name and email address may be shared with a third party in order to present these offers to you.” (PDF of full privacy policy.)

Because TransUnion requires consumers to register in order to access federally mandated free credit reports, then this statement about name and email address sharing with third parties will very likely apply to consumers who neglect to uncheck the box and who provide email addresses.

It is unknown if TransUnion’s auto-selection of consumers at annualcreditreport.com will override previous opt-outs consumers have made. For example, if a consumer has previously called to stop affiliate information sharing, will keeping the TransUnion checkbox checked reverse this choice? This is a question the FTC needs to address with TransUnion.

Also located in TransUnion’s annualcreditreport.com privacy policy is a statement specifically about signing up for the newsletter:

“TrueCredit Newsletter

You may sign up for TrueCredit’s free monthly newsletter by selecting “You will receive a free monthly newsletter loaded with important credit education and valuable product offers provided by our subsidiaries and partners.”

(PDF of full privacy policy )

There is a question here of the accuracy of the privacy policy, because consumers do not need to select anything to sign up for the TrueCredit newsletter, it has already been done for them if they visit the site.

Neither Equifax or Experian are automatically selecting consumers to receive marketing information and affiliate offers.

TransUnion Email Address Requests

On the same page where TransUnion automatically selects consumers to receive marketing offers, TransUnion also requests consumers’ email addresses. The email address is requested in the same space that requests information such as name and address and SSN. (Click here to see TransUnion email request PDF)

TransUnion does not specifically disclose that giving an email address is voluntary. If an individual clicks on a link under the email address request, a box pops up with an explanation of why TransUnion is asking for it.

This is the text of the TransUnion email explanation: “Why do you need my email address?

Your email address allows us to contact you with important information regarding your account and , if necessary, to help you login or confirm your identity.”

(Click here to see a screen shot of the email explanation box at TransUnion PDF )

In order to view a federally mandated free credit report online, there is no need for an individual to give a credit bureau an email address. The report displays online through the Web browser, and is not sent via email. The other two credit bureaus do not request email addresses from consumers as a prerequisite to viewing the free credit report.

Consumers’ email addresses are an additional and optional piece of information that TransUnion does not need to have.

TransUnion, in its privacy policy governing its activities at annualcreditreport.com states: “We may use information you provide to update our consumer credit database.” It is unknown if this statement applies to email addresses. However, if a consumer does not opt-out of the newsletter checkbox, the email address and name may apparently be shared with affiliates and partners.

It should be noted that Experian in its implementation of the federally mandated free credit report does give consumers an opportunity to provide an email address much later in the reporting process. This is done only if a consumer chooses to dispute an item in the credit report. The notification of why the email is requested is very clear, and it is made very clear that the submission of the email address is voluntary.

Potentially Confusing Menu Bars at the AnnualCreditReport.com Site

The three credit bureaus have been allowed by the FTC to advertise for their commercial services at the annualcreditreport.com site. Generally speaking, because of this, the menu design of the individual credit bureaus’ aspect of the annualcreditreport.com site is not optimal.

For example, when an individual is viewing their free credit report online via the annualcreditreport.com site, menu items for the free credit report show up. But menu items for commercial items also show up, and sometimes in a way that makes it look as if those commercial items are part of the free credit report. For example, the Equifax menu bar is all one color, and it is very difficult to differentiate between items that are part of the free credit report and items that are not.

(PDF of Equifax menu bar showing a commercial pitch.)

Experian’s menu bar is a little better, but not perfect. The Experian menu bar at the time of researchers’ visits were color-coded to differentiate the free materials from the for-pay materials, but there was still room for consumer confusion.

(PDF of Experian menu bar.)

The menu bar issue could be easily remedied by the credit bureaus by clearly labeling the for-pay menu items as “commercial services” and separating the for-pay menu items clearly from the free credit report menu items.

Privacy Policies at AnnualCreditReport.com

An individual who goes to annualcreditreport.com and orders credit reports from all three credit bureaus will be subject to four different privacy policies: the annualcreditreport.com policy, and the policies of all three credit bureaus. These policies will be in effect at different times of consumers’ visit and generally do not overlap.

Annualcreditreport.com is essentially a portal site that acts as a funnel to lead consumers to subsites at the three credit bureaus where they can access their free credit report at each separate credit bureau. Annualcreditreport.com has a privacy policy that covers its collection of information, but this policy only applies to the few pages of the annualcreditreport.com portal area; it does not apply to consumers after they have entered each of the three credit reporting sites from the portal. For that, each credit bureau has its own policy.

As soon as consumers enter the TransUnion, Experian, or Equifax subsection of the annualcreditreport.com site, then they are subject to the relevant credit bureau’s privacy policy.

Experian and Equifax did not display unique policies tailored to annualcreditreport.com. TransUnion, however, did. TransUnion apparently has a standard privacy policy on its main site, and a separate (and different) privacy policy for annualcreditreport.com.

Things to Be Aware of in the TransUnion AnnualCreditReport.com Privacy Policy

As discussed previously, consumers are asked for email addresses at the TransUnion section of the annualcreditreport.com site. Consumers are also automatically selected to receive marketing and affiliate offers.

To reiterate the previous discussion of TransUnion’s privacy policy, it is important to again note its privacy policy clearly states:

“We may use information you provide to update our consumer credit database.”

And it also states:

“Under the FCRA, we may provide information to companies that provide you with pre-approved offers of credit or insurance.

If you indicated to us when you registered, placed an order or updated your account that you were interested in receiving information about other products and services, your name and email address may be shared with a third party in order to present these offers to you.”

Archive of relevant AnnualCreditReport.com privacy policies:

TransUnion annualcreditreport.com site privacy policy: PDF TransUnion standard privacy policy: PDF

Experian annualcreditreport.com site privacy policy: PDF Experian standard privacy policy: same as above.

Equifax annualcreditreport.com privacy policy: PDF Equifax standard privacy policy: same as above.

 

 

 

____________________________

Endnotes:

[17] The Electronic Privacy Information Center complained to the FTC about this practice December 7, 2004. To date, the credit bureaus are still blocking active Web links to the official annualcreditreport.com site.

[18] Source: < www.annualcreditreport.com >. Last accessed February 24, 2005.

[19] Text confirmed in December 2004.

 

 

Roadmap: Call, Don’t Click – Why it’s smarter to order federally mandated free credit reports via telephone, not the Internet: Findings on Official Site AnnualCreditReport.com

 

 Report home | Read the report (PDF) | Previous section | Next section