Experian plc is a Jersey-incorporated, London Stock Exchange-listed (FTSE 100) global information-services group whose core operations — credit reporting, marketing services, decision analytics, and consumer products — depend on large-scale collection, aggregation, and onward use of personal data across many jurisdictions and legal entities. Its own privacy documentation discloses broad categories of collection (device data, contact data, meeting records), use of cookies and pixel tags for advertising, and data flows between its credit bureau and marketing services divisions. The company's regulatory record includes a UK Information Commissioner's Office (ICO) enforcement notice over 'invisible' marketing data processing — later substantially overturned on appeal — multiple US FTC actions, and a large consumer class-action settlement tied to a 2015 breach of a client's applicant data, indicating an extensive and at times contested history of regulatory and litigation scrutiny rather than a settled compliance record.
TRACK RECORD
3 ENFORCEMENT ACTIONS
[2023-09-13]
In August 2023, the FTC announced a settlement in which "Experian Consumer Services, operating as ConsumerInfo.com, agreed to pay a $650,000 civil penalty for alleged violations of the CAN-SPAM Act by sending marketing emails without an opt-out option," marking, according to reporting, "the first time the FTC sanctioned a credit-reporting agency for violating the privacy law."
On February 20, 2023, the UK First-Tier Tribunal substantially overturned the ICO's 2020 enforcement notice; Experian's own statement noted the Tribunal found "that the vast majority of our practices meet GDPR requirements, including the transparency that we provide consumers through our Credit Reference Agency Information Notice and our Consumer Information Portal," though the Tribunal still found Experian had unlawfully failed to notify over 5 million individuals whose data was sourced from public records. The ICO's subsequent appeal to the Upper Tribunal was dismissed on April 23, 2024.
On October 27, 2020, the UK ICO issued Experian an enforcement notice following a two-year investigation into the data broking sector, requiring changes described by legal commentary as addressing "infringed the data protection principles under Article 5, specifically the principles of transparency and lawfulness, and the data subject rights under Articles 12 to 22" of the GDPR; the ICO stated the contraventions were serious partly because "an extremely large number of data subjects was affected" and processing was allegedly designed to be invisible.
Experian's US consumer-facing privacy policy states that the company "provides services based on information about millions of individuals and businesses," with use of that data governed by internally published "Global Data Principles."
Experian plc's corporate privacy policy discloses that the company collects contact information, device information (including device ID, date/time stamps, and IP address), and information on meetings held with Experian, stating it uses device data "to produce aggregated information on how our users interact with the site."
Experian plc is "incorporated in Jersey, Channel Islands under registered number 93905" and its ordinary shares are "listed on the London Stock Exchange (FTSE100) with the trading symbol EXPN (LSE)." Additionally, it is tax resident in Ireland, per third-party financial research.
Experian plc discloses American Depositary Receipts trading in the US under symbol EXPGY and Brazilian Depositary Receipts trading on B3, indicating multiple cross-border share structures alongside its primary LSE listing.
Experian's website-visitor privacy policy discloses that the company "may share aggregated information (i.e., information about you and other customers collectively, but not specifically identifiable to you) and other non-personal, de-identified, or anonymous information we collect with third parties, including affiliates to develop and deliver targeted advertising on our Site and on the websites of third parties."
Experian Employer Services' privacy policy discloses that it shares information "with third parties, such as third-party verifiers (including lenders, landlords, etc.) consistent with our contracts with our clients."
Experian's UK consumer product privacy policy discloses internal data flows between its credit bureau and marketing divisions: "Personal data that you provide during registration...is shared with Experian's Credit Bureau for the purposes of improving data accuracy and completeness. The Experian Credit Bureau may subsequently provide your data to Experian Marketing Services."
Litigation from the 2015 breach was resolved via a settlement in which "the settlement included a $22 million non-reversionary cash settlement fund as well as remedial measures and two years of free credit monitoring and identity theft insurance," with total settlement value reported to exceed $170 million.
In October 2015, Experian disclosed a breach of a server holding personal data on behalf of client T-Mobile USA, exposing information on "approximately 15 million people who applied for financing from the mobile network operator T-Mobile USA, to which Experian supplied credit assessment services", including Social Security numbers.
On October 27, 2020, the UK ICO issued Experian an enforcement notice following a two-year investigation into the data broking sector, requiring changes described by legal commentary as addressing "infringed the data protection principles under Article 5, specifically the principles of transparency and lawfulness, and the data subject rights under Articles 12 to 22" of the GDPR; the ICO stated the contraventions were serious partly because "an extremely large number of data subjects was affected" and processing was allegedly designed to be invisible.
On February 20, 2023, the UK First-Tier Tribunal substantially overturned the ICO's 2020 enforcement notice; Experian's own statement noted the Tribunal found "that the vast majority of our practices meet GDPR requirements, including the transparency that we provide consumers through our Credit Reference Agency Information Notice and our Consumer Information Portal," though the Tribunal still found Experian had unlawfully failed to notify over 5 million individuals whose data was sourced from public records. The ICO's subsequent appeal to the Upper Tribunal was dismissed on April 23, 2024.
In August 2023, the FTC announced a settlement in which "Experian Consumer Services, operating as ConsumerInfo.com, agreed to pay a $650,000 civil penalty for alleged violations of the CAN-SPAM Act by sending marketing emails without an opt-out option," marking, according to reporting, "the first time the FTC sanctioned a credit-reporting agency for violating the privacy law."
Experian's website-visitor privacy policy discloses use of pixel tags in HTML email, stating "When used in HTML-formatted e-mail messages, Pixel Tags can tell the sender whether and when the e-mail has been opened."
An Experian cookie policy discloses that "Marketing cookies are used to track visitors across websites. The intention is to display ads that are relevant and engaging for the individual user and thereby more valuable for publishers and third party advertisers."