Marketing practices remain at the forefront of CFPB activity as evidenced by two recent consent orders entered into with TransUnion and Equifax. The consent orders combine to require the Consumer Reporting Agencies (“CRAs”) to pay more than $17.6 million in restitution to affected consumers and an additional $5.5 million in civil monetary penalties. Both consent orders will remain in place for five years and were entered without any admission of liability by the CRAs.

Surprisingly, the violations identified by the CFPB have very little if anything to do with credit reporting.  Instead, the orders are focused on the CRAs’ marketing and sale of credit-related reporting services. The CFPB took issue with: (a) the credit scores being marketed and represented as being the same scores lenders typically use to determine a consumer’s creditworthiness, and (b) the CRAs not adequately disclosing the monthly charges for the services if not canceled during the free trial period. Additionally, with respect to Equifax, the CFPB asserted a violation of Regulation V’s prohibition against CRAs advertising its credit products through the centralized credit reporting source for annual free credit reports prior to delivery of the consumer’s free annual credit report.

Specifically, the CFPB asserted TransUnion and Equifax “represented, directly or indirectly, expressly or impliedly, that the credit scores it marketed and sold to consumers were the same scores typically used by lenders or other commercial users for credit decisions.”  Equifax Order, ¶ 23; see also TransUnion Order, ¶ 29. Additionally, the CFPB asserted that TransUnion and Equifax failed to adequately disclose that consumers unless they opted out in the free trial period, would automatically be enrolled in a subscription-based service with monthly fees.
In addition to the restitution and monetary penalty elements, the Consent Orders require remediation by the two CRAs and provide further insight into the CFPB’s continuing focus on marketing practices of financial institutions. Beyond the obvious (a prohibition against misrepresenting products and payment terms), the Orders set forth the CFPB’s expectations regarding:

Informed Consent.  The Orders require the CRAs obtain express informed consent from consumers before enrolling them in what the CFPB terms as “Negative Option Billing structures” (structures that require a consumer affirmatively opt-out during the trial period or incur monthly charges). Specifically, the orders require the CRAs to include:

In their internet offers, a check box on the page where payment information is collected requiring consumers to affirmatively consent to the billing structure. The Orders further require the check box be conspicuous and clearly state “that the consumer agrees to be billed for the product unless the consumer cancels before the trial period expires.” The Orders additionally require that adjacent to the check box, the CRAs must disclose the amount of the recurring charge and the billing interval; the date the trial period expires; and the amount the consumer will be charged. Similarly, the CRAs must provide a simple mechanism for immediate cancellation which must, “at a minimum, be substantially similar to the mechanism(s) the consumer used to initiate the purchase” of any credit-related product.

For oral offers – the Orders require the CRAs obtain “affirmative and unambiguous” oral confirmation that the consumer affirmatively consents to authorizing payment for the credit-related products and understands the necessary steps to cancel the services and future charges.

Clear and Conspicuous Disclosure. Additionally, with regard to the offering of educational credit scores (those offered for consumer purposes but rarely used by lenders), the CRAs are required to clearly and conspicuously disclose the nature of the score and clearly and conspicuously disclose that the credit scores sold to consumers are not the same scores used by lenders or other commercial users; that there are various types of credit scores, and that lenders use a different type of credit score in making their lending decisions. The Consent Orders require that the CRAs include these disclosures in written communications under the label “What You Need to Know” and that the label is in a font size double that of the disclosure.

Compliance Management. Similar to other recent enforcement orders, the consent orders require the development and implementation of policies and procedures designed to improve the effectiveness of their communications with consumers and prevent communications which have a tendency to deceive consumers.

The policies and procedures at a minimum should include:

• At least an annual collection and review of performance metrics, including a review of both internal consumer complaints, as well as consumer complaints received by federal and state regulators;
• At least an annual collection and review of data regarding consumers’ perceptions of, among other things, the CRAs’ advertising regarding the nature of their credit products (specifically, credit scores), the pricing structure and other material terms for an assessment of “consumer confusion” regarding the products and services offered to consumers; and
• At least an annual assessment of advertisements to determine what adjustments should be made to enhance consumer understanding of the consumer products issues.

Submission of a comprehensive compliance plan designed to ensure the CRAs’ marketing and advertising practices comply with all applicable federal consumer financial laws (including the Consumer Financial Protection Act (and its UDAAP provisions) and the FCRA;

A requirement for the CRAs to update their compliance plan on a regular basis (the orders mandate at least every two years or as required by changes in laws or regulations);

An advertising retention policy which will remain in effect for the life of the Orders (five years) and includes:

• Copies of all advertisements, as well as sales scripts, training materials, and marketing materials relating to the credit related products, including any such materials used by third parties or affiliates;
• A record of the date and location or placement that each advertisement is made accessible to the public and, to the extent the information is available, the number, type, and cost of all credit related products purchased through the advertisement and any and all modifications made to the advertisement including its mandated disclosures;
• For all internet advertisements, the impressions, number of visits, unique visitors and clicks on the advertisement, as well as the number of purchases;
• Accounting records showing the gross and net revenues generated by the credit related products;
• All non-telephonic consumer complaints and refund requests relating to credit related products; and
• Retention of all telephone communications with consumers consistent with current retention policies.

Entities subject to regulation should be taking notice of the number of enforcement orders which are now focusing on the marketing and advertising of consumer financial service products and reviewing their products under any product specific regulations, as well as the Consumer Financial Protection Act’s UDAAP umbrella.