CFPB Ends TransUnion Security Freeze Order Early

The CFPB terminated the October 2023 consent order that found TransUnion failed to timely place or lift security freezes and locks, told consumers requests had succeeded when they had not, and failed to keep fraud-alert consumers off prescreened marketing lists. TransUnion had paid a $5 million penalty and redress; the order was set to run at least five years. Earlier in 2025 the CFPB also dropped its separate lawsuit against TransUnion with prejudice.

November 3, 2025 · Analysis by Shawn Jaffer

Case: In re TransUnion, Trans Union LLC, and TransUnion Interactive, Inc.
Source: Consumer Financial Protection Bureau
Citation: File No. 2023-CFPB-0011 (order terminating consent order, Nov. 3, 2025)
Decided: November 3, 2025
Bottom line: TransUnion's federal order on security freezes is gone, but the FCRA's freeze deadlines and fraud-alert rules still apply, and consumers can still enforce them.

Background

A security freeze stops a credit bureau from releasing your credit report to most new lenders, which makes it harder for an identity thief to open accounts in your name. Since September 21, 2018, the FCRA (15 U.S.C. § 1681c-1(i)) has required the nationwide bureaus to place freezes for free, within one business day of an online or phone request, and to lift them within one hour. Fraud alerts and active-duty alerts must also keep a consumer off prescreened marketing lists for set periods.

On October 12, 2023, the CFPB issued a consent order against TransUnion and two subsidiaries. The order found that, because two internal databases fell “Out of Sync,” TransUnion failed for years to place or remove tens of thousands of freezes and locks, while sending automated messages telling consumers their requests had succeeded. It found a mail vendor was allowed to take five business days instead of the three required by law, delaying about 17,000 freeze requests, including about 12,000 made for children and other protected consumers. It also found that some consumers with extended fraud alerts or active-duty alerts were not excluded from prescreened offers. TransUnion was ordered to pay $3 million in redress and a $5 million civil penalty and to fix its systems. By its terms, the order would last at least five years.

What the order does

On November 3, 2025, the CFPB’s Acting Director issued a two-page order terminating the consent order barely two years into its minimum five-year term. The order recites that TransUnion paid the $5 million penalty, made the required redress payments, and took “steps to implement” the conduct provisions. It invokes the Bureau’s authority under 12 U.S.C. § 5563(b)(3) and states: “The Bureau also waives any alleged noncompliance therewith.”

This followed an earlier retreat. On February 28, 2025, the CFPB, TransUnion, and former executive John Danaher stipulated to dismiss, with prejudice, a 2022 federal lawsuit alleging that TransUnion violated a 2017 consent order through deceptive marketing of credit scores and subscription products.

Our take

TransUnion did pay the penalty and the redress, and early termination of an order whose money terms are satisfied is within the agency’s authority. Our concern is with the conduct provisions. They were the part of the order meant to ensure that the database problems behind years of failed freezes did not recur. Ending them early, together with a blanket waiver of “any alleged noncompliance,” removes outside oversight of that work without a public explanation of why it is no longer needed.

For consumers, the practical point is that the order was never the source of their rights. The freeze deadlines and fraud-alert protections are in the FCRA itself, and consumers can sue for willful or negligent violations under §§ 1681n and 1681o. With federal oversight shrinking, private enforcement carries more of the load.

What it means if your report is wrong

If you place a freeze, save the confirmation and then check that it works. Some lenders will tell you if they could not pull your report. If a freeze you asked to lift stays in place and costs you a loan, or a freeze you placed did not stop a fraudulent account, write down the dates, keep every confirmation message, and request your TransUnion file. The same goes for prescreened offers that arrive while an active-duty or extended fraud alert is on your file. A free case review can assess whether a bureau’s freeze or alert failures support an FCRA claim, and there is no fee unless we win.

Sources

Primary

Commentary we reviewed

NCLC statement: CFPB Dismisses Case Brought Against TransUnion Over Allegations It Tricked Customers Into Overpaying

Updated November 1, 2026. "Our take" is the firm's opinion. This page is general information, not legal advice, and later decisions may change the law.