Lessons from the CFPB’s Enforcement Action against TransUnion

Lessons from the CFPB’s Enforcement Action against TransUnion

On April 12, the Consumer Financial Protection Bureau (“CFPB”) filed charges against TransUnion over the credit reporting agency’s alleged deceptive marketing practices, which the CFPB charges violated a prior 2017 consent order between the CFPB and TransUnion.

Among other things, the CFPB’s lawsuit alleges that TransUnion used deceptive marketing techniques that were intended to trick consumers into purchasing credit-related subscriptions that were then difficult to cancel. Notably, the CFPB’s complaint states that it notified TransUnion of the alleged deceptive practices, and the CFPB’s belief that they violated TransUnion’s earlier consent order, back in 2019, and TransUnion failed to take sufficient action. This fact paired with the earlier 2017 consent makes TransUnion, in the eyes of the CFPB, a repeat offender, which the CFPB and Director Rohit Chopra have made clear will be a focus of the agency in the coming months and years.

Among other things, the action by the CFPB against TransUnion may be a return to the “regulation by enforcement” policy we saw at play during previous Director Richard Cordray’s tenure with the agency, where the CFPB often used its enforcement powers against one company to send messages to the industry writ large about conduct the CFPB viewed as illegal or unfair, deceptive, or abusive.

In this case, the CFPB alleges that TransUnion engaged in several marketing practices that constituted digital tricks often referred to as “dark patterns” resulted in customers unwittingly singing up for services they did not fully understand and that were difficult to cancel. These “tricks” include putting important disclosures with respect to a service on an image that takes longer to load than the rest of a webpage, or putting important information in font that is low-contrast and /or placed in a non-conspicuous location on a page.

The enforcement action against TransUnion is an important reminder for providers to diligently review their marketing practices to ensure that they are not misleading or deceptive, including with respect to the specific conduct cited by the CFPB in its complaint. Such a review is particularly important in aftermath of Covid-19, as the move toward fully digital account opening and customer experiences has increased exponentially, raising the risk that a provider may unwitting be engaged in activity that the CFPB would consider to constitute digital “tricks” that mislead or otherwise deceive consumers.

A copy of the CFPB’s complaint can be found here.

The CFPB’s prior statement on the importance of “Reining in Repeat Offenders” can be found here.