Selling Reports on People Who Never Agreed to Be the Product
Credit bureaus collect information on borrowers without their consent and sell it to lenders. The people described are the product, not the customer, which creates a business with unusual power and friction.
The Data Business at the Center of Lending
When a lender decides whether to lend to someone, it wants to know how reliably that person has repaid debts before. Credit bureaus provide this: they collect information on people borrowing and repayment behaviour from lenders, compile it into profiles and scores, and sell that information to lenders assessing whether to extend credit.
The distinctive feature is that the people described by the data are not the customers. The lenders are the customers, buying the data; the borrowers are the subject of the data, collected without their active consent. The individual is the product being sold, not the buyer, which shapes the entire business and its tensions.
You are not the bureau's customer. You are its inventory. The lenders who buy reports about you are the customers, and you had no say in becoming the product.
How the Business Works
The bureau sits in the middle of a data exchange. Lenders report information about their borrowers to the bureau, and the bureau compiles this into a comprehensive profile of each person borrowing history across all their lenders, then sells access to that profile back to lenders.
| Party | Role |
|---|---|
| Lenders reporting | Supply borrower data to the bureau |
| Credit bureau | Compiles profiles and scores |
| Lenders buying | Pay for reports and scores |
| Borrowers | The subject, not the customer |
The genius and the power of the model is that lenders both supply the data and buy it. Each lender contributes its own borrower information and gains access to the combined data from all lenders, which is far more valuable than any single lender data alone. The bureau creates value by aggregating what no single participant could assemble, and this aggregation, sitting in the middle of the whole lending system, is its powerful and defensible position.
Why It Is So Defensible
The credit bureau business is protected by a strong network effect and enormous barriers to entry. The value of a bureau data comes from its comprehensiveness, having information on everyone from every lender, and a new entrant cannot easily assemble comparable data, since it would need lenders to report to it and would start with nothing.
Lenders report to the established bureaus because those bureaus have the comprehensive data, and the comprehensive data exists because lenders report to them, a reinforcing cycle that keeps the incumbents entrenched. The industry consolidated into a few dominant bureaus, and their position is extremely durable, since the data advantage compounds and cannot be replicated by a newcomer. This is why the business is highly profitable and stable, protected by a moat that is nearly impossible to cross.
The Friction of Being the Product
Because the individuals described are the product rather than the customer, the business carries inherent friction and public concern. People have data collected about them without meaningful consent, that data determines their access to credit, and errors in it can harm them, yet they are not the ones the bureau serves.
This creates ongoing tension: individuals wanting to see, correct, and control their data, which the bureau collects for the benefit of its lender customers. Errors in credit data can cause real harm, denying someone credit or raising their cost of borrowing, and the difficulty of correcting errors is a persistent complaint. The mismatch between who is served and who is described is the source of much of the regulation, criticism, and public unease around the business, since the people most affected by it have the least power over it.
The Regulatory and Security Exposure
The business faces heavy regulation precisely because of this mismatch and the sensitivity of the data. Rules govern what data can be collected, how it can be used, the rights of individuals to access and dispute their data, and the accuracy the bureaus must maintain, all attempting to protect people who are the subject rather than the customer.
The concentration of sensitive personal data also makes bureaus a target and a point of systemic risk, since a breach of a bureau exposes the financial data of enormous numbers of people. Major breaches have caused significant harm and intensified scrutiny, highlighting that a business built on holding sensitive data about people who did not choose to provide it carries serious responsibilities and exposures. The regulatory burden and the security risk are structural features of a model that profits from data on people who are the product, not the customer.
The Bottom Line
Credit bureaus collect data on borrowers from lenders, compile it into profiles, and sell it back to lenders, making the individuals described the product rather than the customer. The model is powerfully defensible, since lenders both supply and buy the data and the aggregated comprehensiveness cannot be replicated by a newcomer, giving the few dominant bureaus an entrenched position. The mismatch between who is served and who is described creates inherent friction, driving heavy regulation and public concern, and the concentration of sensitive data makes the bureaus a target whose breaches cause widespread harm.