The FTC issued a final rule relating to the use of consumer credit information obtained from an affiliate for marketing purposes. Under the final rule, a person or company is prohibited from using certain credit information received from an affiliate to market goods or services to a consumer, unless the consumer is given notice, a reasonable opportunity to opt-out, and a simple and reasonable method for opting-out. However, there is an established business relationship exemption from this prohibition.

The rule is issued pursuant to the Fair and Accurate Credit Transactions Act of 2003 which amended the Fair Credit Reporting Act (FCRA). The FCRA regulates credit reporting companies and establishes limits on how credit reporting information can be used.

The final rule applies to any person or company within the FTC’s jurisdiction that (1) uses consumer "eligibility information" obtained from an affiliate for the purpose of marketing solicitations or (2) provides information to its affiliates for that purpose. "Eligibility information" is defined in the rule as "any information the communication of which would be a consumer report if the exclusions from the definition of ‘consumer report’ in section 603(d)(2)(A) of the [Fair Credit Reporting] Act did not apply. Eligibility information does not include aggregate or blind data that does not contain personal identifiers such as account numbers, names, or addresses." Eligibility information includes a consumer’s own transaction or experience information such as information about the consumer’s account history.

"Consumer report" is defined very broadly in the FCRA as "any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer’s eligibility for credit or insurance to be used primarily for personal, family, or household purposes, employment purposes, or any other purpose authorized in section 604 of the FCRA." Credit report information includes any type of information credit grantors use as criteria for prescreening or in credit scoring models such as credit limits; loans obtained in the last six months; the number of credit card accounts, mortgages or loans; the type of loans; and the mere existence of an account with a credit card, loan, or mortgage company.

Notice must be provided in writing or, if the consumer agrees, electronically. The opportunity to opt-out must be provided (1) after the consumer has received notice of the right to opt-out, and (2) is given a reasonable opportunity to opt-out. A consumer’s opt-out election is effective for five years. The final rule contains examples and model forms to facilitate compliance with the notice and opt-out requirement.

(The FTC’s affiliate marketing rule should not be confused with the FTC’s affiliate sharing rule, which also applies to consumer credit information. In the notice of proposed rulemaking for the affiliate marketing rule, the FTC explained that the affiliate marketing rule applies to how consumer credit information is used, while the affiliate sharing rule applies to whether and how consumer credit information can be shared among affiliates.)