The Use of Consumer Reports in Online Marketplaces

Online marketplaces increasingly use consumer reports to match consumers with retailers that offer products and services that may be of interest to them. Some methods of doing so seem unlikely to put the marketplace at risk under the Fair Credit Reporting Act (“FCRA”). Other methods may be riskier.

In general, an online marketplace is least likely to encounter FCRA issues if it keeps out of the data flow among the consumer reporting agency, the consumer, and the retailer. For example, a marketplace might describe different sets of products as suitable for consumers with different credit score-ranges. (Depending on their clarity and precision, these descriptions could raise various non-FCRA issues—such as under unfair and deceptive acts and practices laws.) The marketplace could encourage, and facilitate, a consumer’s obtaining credit-score or related information directly from a consumer reporting agency. The marketplace could also, at the request of a consumer who has obtained such information, present the consumer with one or more sets of products, sorted by credit-score range.

In this model, the marketplace is not obtaining or communicating a consumer report or information derived from it. (See “Forty Years of Experience with the Fair Credit Reporting Act: An FTC Staff Report with Summary of Interpretations” (“Forty Years”), ¶603(d)(1)-4 (“If information from a consumer report is added to a report that is not otherwise a consumer report, that report becomes a consumer report.”)) In these circumstances, the marketplace seems unlikely to become a consumer reporting agency.

A more complex model would be a marketplace that obtains a consumer report on behalf of a consumer and then promptly provides the consumer with a customized array of ads on behalf of its retailer partners. The marketplace would not necessarily become a consumer reporting agency by obtaining the consumer report. See Forty Years, ¶ 603(f)-4(H) (“An agent or employee that obtains consumer reports does not become a CRA by sharing such reports with its principal. . . .”).

Such a marketplace would also, presumably, have entered into agreements with its retailer partners to provide the respective retailers’ ads to consumers whose consumer reports have been obtained by the marketplace and indicate that the consumers fall within particular credit-score ranges specified by the retailers. Depending on the content of the certification that the marketplace gave the consumer reporting agencies regarding the marketplace’s purposes for obtaining consumer reports, this could potentially raise issues under Section 604(f), which prohibits the use of a consumer report for any purpose that the user has not certified.

Also, it could potentially be argued that if the marketplace agreed to notify a retailer which consumers’ credit-scores fit the retailer’s preferred range, such notification would constitute a consumer report. But for this reason it seems more likely that the marketplace would undertake to provide the retailer with aggregated data—e.g., the number of such consumers per day, week or month.

Another issue could arise if, having been presented with the retailer’s ad, the consumer then clicks on it, and the click informs the retailer that the consumer had clicked on an ad presented via the marketplace. The marketplace/retailer agreement might provide that the retailer’s marketplace ads must be “tagged” in this way, in order to permit the marketplace to obtain appropriate compensation from the retailer. And by clicking such a tagged ad, the consumer would not only accept an offer for the retailer’s product; she would also be informing the retailer that the consumer’s credit score fell within the retailer’s preferred range—since that range was the criterion on the basis of which the marketplace presented the ad to the consumer. Thus, the marketplace would have caused the communication to the retailer of information from the consumer’s consumer report, and thus potentially be a consumer reporting agency.

However, this scenario has many similarities to prescreening—the retailer communicates its credit criteria and learns the identity of consumers meeting those criteria in the course of providing them with a product they have requested. Moreover, whereas consumers are exposed to prescreening if they do not opt out from it, in this model, the consumer will have opted in. Prescreening, of course, is expressly permitted (under specified circumstances) by the FCRA. Accordingly, whether or not this model is in full technical compliance with the FCRA (we offer no view on that question in this article), it seems unlikely to encounter regulatory objections.

We invite your comments regarding these hypothetical models. We will continue to monitor the use of consumer reports by such marketplaces, and will report further as events warrant.