Does Equifax require consent?

No. Equifax scripts power identity verification and credit check workflows required for financial service delivery and regulatory compliance, including AML and KYC obligations. These are essential services exempt from standard cookie consent requirements under ePrivacy.

What does the Equifax script do on a website?

Equifax scripts embed identity verification flows, credit check widgets, and fraud detection tools. They collect identity data entered by users (name, address, DOB, ID numbers) and device fingerprint signals, transmitting them to the Equifax API for verification.

How does ConsentStack handle Equifax?

ConsentStack classifies Equifax as essential and functional, so it loads without requiring visitor consent. This ensures identity verification and credit check workflows remain uninterrupted while your consent management configuration stays compliant.

What tracker domains does Equifax use?

ConsentStack has catalogued tracker domains for Equifax including equifax.com. These are the network destinations Equifax's scripts contact, which a consent platform blocks until a visitor agrees.

Equifax - Identity Verification & Consent Profile

Back to Vendor Library

Overview

Equifax is one of the three major consumer credit reporting agencies, providing credit reporting, identity verification, and fraud detection services to financial institutions, lenders, and businesses. When detected on a website, Equifax scripts are typically powering identity verification workflows (KYC — Know Your Customer), credit check processes, or fraud screening during account opening, loan applications, or financial service onboarding. These are regulated financial services that support compliance obligations.

What This Script Does

Equifax scripts embed on financial service websites to facilitate identity verification and credit-related workflows.

Identity verification flows: Scripts load Equifax's identity verification interface, guiding users through document upload, knowledge-based authentication (KBA) questions, and identity confirmation steps required for regulatory compliance
Credit check widgets: On lending sites, scripts render credit check consent forms and manage the communication flow between the website and Equifax's credit reporting API
Fraud detection: Scripts collect device and browser signals (device fingerprint, IP address, behavioral patterns) to assess fraud risk during account opening or transaction flows
Cookies set: Session cookies maintaining the verification or credit check workflow state. Authentication cookies for secure communication with Equifax's API. These cookies are functional — required for the multi-step verification process to complete.
Data collected: Personal identity information (name, address, date of birth, SSN/ID numbers) entered by the user during verification flows. Device fingerprint signals for fraud prevention. Credit report data retrieved from Equifax's database.

Consent & Compliance

Equifax falls under both functional and essential consent categories.

Under GDPR and ePrivacy, identity verification and credit check services are essential components of financial service delivery, often required by regulation (e.g., Anti-Money Laundering directives, PSD2). Cookies used during these workflows are strictly necessary for completing the service explicitly requested by the user. GDPR legal basis is typically Article 6(1)(b) (contract performance) or Article 6(1)(c) (legal obligation). Equifax operates in the EU through Equifax Europe and processes data under GDPR-compliant terms.

Under CCPA/CPRA, credit reporting data is subject to additional protections under the Fair Credit Reporting Act (FCRA), which preempts some CCPA provisions. Identity verification data processed for regulatory compliance falls outside the scope of CCPA's opt-out requirements.

Should You Block This Without Consent?

No. Equifax scripts provide essential identity verification and credit services required for financial service delivery and regulatory compliance. Blocking them would prevent users from completing identity verification, loan applications, or account opening processes. The cookies set are functional — required for the multi-step verification workflow to operate.

Is Equifax GDPR compliant?

Equifax typically loads functional trackers, which are not strictly necessary for your site to work. Under the GDPR and the ePrivacy Directive, non-essential cookies and trackers must stay blocked until a visitor gives clear opt-in consent. So Equifax can be fully GDPR compliant, but only if your site holds its scripts until consent is granted and lets visitors decline just as easily. Compliance depends on how your site loads Equifax, not on Equifax itself.

Visit website