On August 26, 2026, LexisNexis won an important, but limited, victory in a proposed class action: a federal court refused to certify a class of people seeking damages for the company’s response to privacy requests which violated the Fair Credit Reporting Act (FCRA). The court did not decide whether LexisNexis had violated the FCRA, only deciding that the plaintiffs could not pursue their claims as the proposed class.
The facts began with Daniel’s Law, a New Jersey statute that protects the home addresses and personal telephone numbers of judges, prosecutors, police officers, certain other public officials, and their immediate family members. Covered individuals may ask a business to stop disclosing that information, and the business generally has ten days to comply.
Beginning in December 2023, thousands of covered individuals allegedly sent LexisNexis written requests to suppress their protected information. According to the plaintiffs, these were straightforward privacy requests, not requests to freeze their consumer files. Nevertheless, LexisNexis reportedly placed security freezes on approximately 18,607 files, maintaining that it could not redact the protected information from consumer reports without doing so.
Because a security freeze restricts access to a consumer report, it can affect banks, insurers, and others evaluating whether to provide credit or services. As a result, the plaintiffs alleged that the unrequested freezes violated the FCRA. However, their effort to proceed as a class ran into a proof problem. The record showed only 13 people had been denied insurance because of the freezes. For everyone else, the court would have needed individualized evidence showing that the person sought credit or services, the freeze blocked access to necessary information, and the blockage caused a denial. Those individual questions defeated the broader class, while a 13-person subclass was too small to satisfy Rule 23’s numerosity requirement.
For companies responding to statutory privacy requests, the decision illustrates how a request directed at specific information can implicate a broader consumer-reporting process. LexisNexis maintained that it could not remove the protected information from its consumer reports without placing a security freeze, and the court did not decide whether that approach violates the FCRA. The takeaway is less about prescribing a particular response and more about understanding how privacy workflows operate across connected systems. Companies should assess whether the mechanism used to honor a request changes access to a consumer report or related service and remember that a narrow request does not always have narrow effects.