The three major US credit bureaus are Equifax, Experian, and TransUnion. Privately-owned for-profit corporations that aggregate consumer credit data (account histories, payment patterns, public records, employment data) and sell credit reports to lenders, landlords, employers, and (with consent) consumers. Around 220 million adult Americans tracked. The 2017 Equifax breach (147 million Americans, including names, Social Security numbers, dates of birth) is the largest documented credit-bureau breach.
What it means in practice
The credit bureaus are an unusual category in US privacy: highly regulated under the Fair Credit Reporting Act (FCRA, 1970) for the credit-decision use cases, lightly regulated for many other data uses, and the entire system runs on consumer data the consumer never explicitly consented to share. The lender reports your account opening, payment history, and balances to all three bureaus; the bureaus aggregate, score, and resell. The credit-monitoring services (Credit Karma, Credit Sesame, Experian free tier) provide consumer access to a portion of the data; the full report is reachable via annualcreditreport.com (the FCRA-mandated free annual report from each bureau). The Predaxia editorial frame: the credit bureaus are the largest consumer data aggregators in US life, with the longest-running data retention, and the consumer-side defenses (freezes, opt-outs, fraud alerts) are the operational tools.
Who uses the data, and how
Customers: lenders running credit decisions (mortgages, auto loans, credit cards, personal loans), landlords running tenant screening, employers running pre-hire background checks (in jurisdictions where this is legal; California and New York have restrictions), insurance underwriters in the small subset of insurance lines where credit-based pricing is permitted, and (most consequentially for privacy) the marketing and identity-verification industries that use credit-bureau data as a data foundation. The 2017 Equifax breach drove federal legislation (the 2018 Economic Growth, Regulatory Relief, and Consumer Protection Act) that mandated free credit freezes; the freeze remains the highest-leverage individual control over credit-bureau data flow.
What you can change today
Three actions. First, freeze your credit at all three bureaus: equifax.com (Security Freeze), experian.com (Security Freeze), transunion.com (Credit Freeze). The freeze prevents new accounts being opened in your name without the freeze being lifted, defeats the most lucrative ID-theft monetization path, and is free and reversible. Second, pull your annual credit reports at annualcreditreport.com (one free report per bureau per year, plus the post-pandemic weekly free reports that were extended through 2026) and audit for accounts you do not recognize. Third, opt out of pre-screened credit offers at optoutprescreen.com, which removes you from the credit-bureau direct-marketing data feed used by lenders for pre-approved offers.