You never signed a contract with them. Never opened an account, never checked a box that said "I agree." And yet there is already a file on you — thick, alive, updated monthly — held by three companies most people only learn exist the moment they're turned down for a loan, an apartment, or a job. Equifax, Experian, TransUnion. You are not their customer. You are what they sell.
The dossier started before you filled out your first credit application. It began the moment someone first mentioned your name in connection with money, and it has been growing on its own ever since, without your participation, without your permission, and with almost no way for you to see the whole of it at once.
A factory that started with morality
Equifax is the oldest of the three, and its origin is uncomfortably honest. In 1899, in Chattanooga, Tennessee, the Woolford brothers founded the Retail Credit Company. It didn't just tally debts. It collected rumor: whether a man drank, who he slept with, whether his house was clean, how he treated neighbors of another race. These notes went into a file and shaped whether that person got a loan, a job, or insurance — without his knowledge and without any right to challenge a single line.
By the 1970s that had produced enough scandal for Congress to pass the Fair Credit Reporting Act, the first law forcing bureaus to show people their own files and remove outright falsehoods. Retail Credit Company renamed itself Equifax in 1975, as if a new sign could erase the model underneath. The model stayed the same: gather data on a person without asking, then sell access to it to whoever had a "legitimate interest" — a bank, an employer, a landlord. The law made the bureaus more careful. It did not make them ask permission.
A ring of three, and a right you never voted on
Experian grew out of Britain's CCN. Equifax grew out of that same Retail Credit Company. TransUnion started in Chicago in 1968 as a side project of a company that leased railcars, and inherited a customer database almost by accident. Three different origin stories, one identical result: today, nearly the entire credit history of nearly every American adult flows through this trio, and there is no opting out — much the way you can't rent an apartment without appearing in a land registry.
The legal mechanism that permits this is called "permissible purpose." Once a bank, employer, or insurer has one, the bureau is obligated to hand over your file. You aren't asked. You don't consent to each individual pull — consent is treated as implied by the fact that you applied for something, somewhere, once. From that point forward, your file is open to an entire category of institutions you may not even know exist.
A dossier wider than credit
Most people assume the bureaus only know about credit cards and late payments. That assumption is roughly a decade out of date. In 2007, Equifax acquired a company called TALX, and with it, a database called The Work Number — a repository where employers upload salary and employment data directly, for tens of millions of workers. By various estimates, it now holds records on more than a hundred million employed Americans, not because they agreed to it, but because their employer outsourced verification of employment to Equifax under contract.
That database isn't sold only to banks. It's bought by landlords, debt collectors, government agencies verifying eligibility for benefits, and insurance companies. Your salary, your termination history, your gaps of unemployment — all of it sits inside a product you never listed for sale, one that generates real, growing revenue for the company year over year.
Our record: in the system of Maat, Ren is the name that, spoken with the right power, grants authority over the one it names. A credit bureau is a machine that turns your name into exactly that kind of Ren for other hands to hold — a complete, continuously updated, saleable profile that knows more about you than your neighbor does, and cares considerably less about getting it right.
A breach that changed nothing
In 2017, Equifax announced that hackers had accessed the data of 147 million people — nearly the entire adult population of the United States: Social Security numbers, birth dates, addresses, and for a subset, driver's license numbers and roughly 209,000 credit card numbers. The cause was mundane: an unpatched vulnerability in the Apache Struts web framework, one the company had been warned about in advance.
What followed was exactly what happens to an institution with no real competitor to lose customers to. Several executives sold shares before the breach was disclosed publicly, which later drew an insider-trading investigation. The CEO resigned, forfeiting part of his bonus, while keeping a pension package worth on the order of eighteen million dollars. The company settled with regulators for up to 700 million dollars, most of it earmarked for consumer restitution — but split across 147 million people, the payout most claimants actually received came to a few dollars, or at best a few hundred. Equifax's stock dipped for a few months and then fully recovered. The business model didn't shift a single degree: the bureau's actual customers — banks and employers — had no alternative to switch to, and the people harmed had never been customers to begin with, so there was no one for them to walk away from.
What you can actually do
You cannot fully opt out — participation in the system was never voluntary. But the lever has an edge. Since 2018, freezing your credit file at all three bureaus has been free by federal law, and it blocks new accounts from being opened in your name without the freeze being lifted — it won't stop the data collection, but it stops the most common path to identity theft. Once a year, and more recently every week, you have the right to a free copy of your report at the official site annualcreditreport.com, and it's worth checking for errors — an inaccurate entry in a file is not rare, and a mistake in someone else's dossier can cost you an apartment or a job you never learn you were denied because of it.
A dossier compiled without your consent doesn't stop existing because you never looked at it. The only defense against a file that lives a life of its own is to open it first.