Court Ruling: Can LifeLock Still Legally Provide Identity Theft Protection?

A new ruling just came down this week ending (for now, at least) the legal battle between credit bureau Experian and ID theft protection company LifeLock.

Experian filed the lawsuit because it was tired of processing and paying (supposedly millions of dollars) for the "hundreds and thousands" of fraud alerts that LifeLock was calling in on behalf of its members. 

Experian claimed that LifeLock placed the alerts by "posing as the consumer," and therefore LifeLock was committing an unfair business practice under the California Unfair Competition Law. US District Judge Andrew Guilford granted the motion last week. 

Violation of the Fair Credit Reporting Act

The more serious offense that the judge found, though, was LifeLock's violation of the federal Fair Credit Reporting Act. The FCRA allows consumers the opportunity to place a fraud alert on their credit report to protect against identity theft. Guilford ruled that the FCRA wasn't meant to authorize a company to place the alert on behalf of the consumer; Only the consumer herself (or authorized family member or guardian) can place the alert.

LifeLock's defense is that the FCRA was designed to enhance consumer protection, and that placing fraud alerts on behalf of its members is in line with that goal.

LifeLock's next steps

LifeLock says it plans on fighting the court's decision. Placing fraud alerts on behalf of its members is probably the most effective way it guards against identity theft.

Other protections the company provides include removing your name from pre-approved credit card mailing lists and regularly ordering credit reports for you. LifeLock also contacts your credit card companies, banks and other necessary institutions if you lose your wallet. LifeLock claims that it scans criminal websites looking for illicit use of your personal information. The company guarantees $1 million towards legal and investigative fees should your identity be stolen while you are a LifeLock member.

While all of these features are important, placing fraud alerts on behalf of its members is perhaps its biggest draw. For now, it says it will continue to offer this service - despite the recent court decision.

Ramifications from the ruling

Many are pleased with the court's decision - especially those that feel LifeLock is a racket because it charges $10/month to do what any consumer can do herself for free. But others are disappointed. LifeLock and its competitors represented a burgeoning industry that was fighting the good fight against identity theft, according to Chris Hoofnagle, director of information privacy for Berkeley. Hoofnagle regrets that this ruling will hamper the company's ability to take the "privacy-enhancing steps that we don't have time to take."

There will be other unfortunate results from the ruling. For instance, Debix, another ID-theft prevention service, has already announced that it will stop placing fraud alerts for members and start offering a credit monitoring service instead. Also, companies that have suffered a data breach will no longer be able to enroll their customers affected by the breach into credit monitoring and fraud alert programs.

But consumers should remember that they can place fraud alerts and security freezes, pull their credit reports, and enroll in credit monitoring services on their own. These actions may take a little bit of time, but they are ultimately well worth the protection they provide against fraud.