Experian slapped by the DoJ for sending spam emails with no opt out

In context: Experian is a multinational corporation headquartered in Dublin, engaged in the contentious credit reporting industry. Operating across 37 countries, the company offers consumers a "credit score" to assess financial risk. According to US law, Experian is obligated to furnish consumers with a free credit report annually.

Experian recently reached a settlement with the US government in response to a lawsuit filed by the FTC. As part of the settlement, the credit reporting corporation has agreed to a permanent injunction and will pay a $650,000 civil penalty. The lawsuit was prompted by Experian's subsidiary, ConsumerInfo.com, also known as Experian Consumer Services (Experian), reportedly sending commercial emails related to customer credit scores. These emails lacked a clear mechanism for recipients to opt-out, essentially constituting a spam campaign.

According to the DoJ, Experian's actions violated the Controlling the Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM Act), the Controlling the Assault of Non-Solicited Pornography and Marketing Rule (CAN-SPAM Rule), and the Federal Trade Commission Act. The targeted customers were those who had established free Experian accounts to manage third-party access to their credit reports, a measure intended to safeguard their financial information from both malicious entities and legitimate institutions such as banks.

Experian used the email addresses belonging to free accounts as just another marketing tool, according to the DoJ. The company sent consumers commercial promotions for its paid services, offering a credit score "boost" or a free scan of the dark web for unsecure user data proliferation. In the emails, Experian tried to encourage consumers to use one of these services by asking them to confirm whether a car the company had associated with their account was actually theirs.

Experian emails didn't include any notice about the fact that users could opt-out of future marketing campaigns, and there was no simple way (a link, a button, anything) to start the opt-out procedure. US authorities received "many consumer complaints" about the practice, the DoJ states, which was in clear violation of the CAN-SPAM Act and the CAN-SPAM Rule.

Providing users with the ability to opt-out of unwanted commercial emails is a "critical" right, U.S. Attorney Martin Estrada said. Furthermore, such emails must not be misleading in any way. The settlement forces Experian to avoid further violations of the CAN-SPAM Act, while the $650,000 fine is essentially inconsequential for a company that made $1.1 billion in profits last year.

Despite settling the lawsuit with the US government, Experian is still professing its innocence. The company stated that it disagrees with the FTC's allegations, but it wants to "move forward" to continue serving consumers in the "best way possible." Every new marketing email now contains a link to an "Email Preferences Center" that consumers can use to customize communications sent by Experian.