The new legislation might do more harm than good, Mr. Litt said. For example, it could stop states from requiring that all credit reports be frozen by default — an arrangement that would put consumers in control of who gains access to their data. As it stands, consumers must contact each of the three bureaus — Equifax, Experian and TransUnion — to initiate a freeze. Likewise, they must also contact the bureaus to lift the freeze, which is necessary when applying for a loan or, say, car insurance.
There are also several states where a freeze blocks not just lenders but also insurers and employers from access to your credit files. “Those states would be overridden because this law would only extend to credit checks” from lenders, Mr. Litt added.
Consumers have little choice but to work with Equifax and its peers. Banks and other financial services firms feed consumers’ personal data to the bureaus, which keep files on more than 200 million people. That data is then crunched to calculate personal credit scores.
There is no way to opt out of this system. Mortgage providers, credit card companies, mobile phone providers and others won’t do business with you until they check your credit report at one or all of the big bureaus. If you freeze your file, these companies cannot get to it — and if they cannot get to it, they won’t issue credit. That protects you if thieves obtain your personal information and try to open accounts in your name.
The Consumer Data Industry Association, the credit bureaus’ trade group, did not oppose the language in the Senate bill. The big bureaus do not break out how much they collect in fees for initiating and lifting credit freezes, the association said.
“Consumers in every state will be protected by a strong federal law under this bill,” Francis Creighton, president and chief executive officer of the association, said in a statement.
But consumer advocates do not believe it goes far enough. They would like a law that gave regulators — such as the Federal Trade Commission or the Consumer Financial Protection Bureau — the power to oversee data security at the big credit bureaus, which could include inspections and penalties for poor practices or digital breaches. Senator Elizabeth Warren, Democrat of Massachusetts, introduced one such bill this year.
Such an approach would be proactive, rather than the currently reactive way of doing things, said Chi Chi Wu, a staff attorney at the National Consumer Law Center.
“The fundamental premise is you want a regulator to supervise for data security at the credit bureaus and not just, ‘We can take enforcement action after you messed up,” Ms. Wu said. “That is a different way of regulating than suing them after they’ve lost everyone’s data.”
Another bill, introduced by Senator Jack Reed, Democrat of Rhode Island, would essentially freeze credit reports by default. Anna Laitin, director of financial policy for Consumers Union, said that bill would “stop identity thieves in their tracks by freezing access to credit files unless the consumer gives their consent.”
The current bill’s free freeze provision was viewed as a bargaining chip — a little goody for consumers — in legislation that would roll back some of the banking regulations that were established after the financial crisis a decade ago. But there was also at least one nugget that would be good for the bureaus: A provision to provide free credit monitoring to active-duty members of the military would strip them of the right to take the agencies to court should something go wrong.
It remains to be seen if the House will pass the legislation, which means free credit freezes aren’t guaranteed just yet. If the bill does not move ahead, states will be free to consider their own changes. Some states, for example, are considering legislation that would let consumers place a credit freeze at all three agencies by making a request at just one, Ms. Laitin said.
“State lawmakers pioneered credit freeze protection and have been quicker to take action compared to Congress,” she said. “They should be allowed to continue to innovate so that consumers can more easily protect themselves from identity theft fraud.”