Experian Precise ID Option 22 Configuration Guide

OneTrust supports an integration with Experian Precise ID Option 22 plus Multifactor Authentication (MFA) for Privacy Rights Automation enterprise customers to verify the identity of the consumer before honoring their request. Using an implemented pre-approved decision workflow incorporated with Experian products, customers can connect to their Experian instance via OneTrust to initiate identity verification.

For additional information about Experian and ID verification, see ID Verification Implementation Guide for OneTrust & Experian and watch the ID Verification Experian Precise ID Verification Integration official video demo.

Note:

This integration only works for accounts with published web forms.

Customer Requirements

  • OneTrust Enterprise DSAR license

  • Three-way agreement with OneTrust, the customer, and Experian.

  • Experian environment configured with Precise ID Option 22, with or without KnowledgeIQ (KIQ)

To configure permissions and credentials

  1. Reach out to your consultant or submit a product support ticket asking to enable your account for third-party verification and to seed your system credentials.
    Ensure that you provide the following:
    • Account Name
    • Account ID
    • Environment
  2. You will also need to provide OneTrust with the following details from Experian for credential set up:
    • Base URL (e.g. https://api.uat.crosscore.experian.com:8443)
    • HMACKey
    • Experian Tenant ID
    • PIDXML version
    • Subscriber preamble
    • Subscriber operator initial
    • PID username & password
    • Detail request
    • Subscriber sub-code
    • Product option (i.e. Option 22)
    • Product details (i.e. with or without KIQ)

To enable ID verification integration

You can proceed with the ID verification integration once OneTrust has completed the configuration.

  1. On the Privacy Rights Automation menu, click Web Forms.

    The Web Forms screen appears.

  2. Hover over your desired web form to display and click the View button.

    The Web Form Customization screen appears.

  3. Go to the Settings tab.
  4. Enable the Enable Third-Party ID Validation setting.
  5. Select your specific Experian Option 22 configuration from the Select the pre-configured provider field.

    Experian Option 22 configuration selected in the pre-configured provider field

    Experian Option 22 ID verification flow in the web form
  6. Click the Save button.
  7. Click the Publish button to activate your changes.

Experian Precise ID Option 22 with KIQ - Supported CCPA Solution to Identity Verification

The Experian CCPA strategy enables an integration that can leverage a One-TIme Password (OTP) and/or Knowledge-Based Authentication (KBA) when processing identity verification. Use the table below to reference the decision logic and descriptions for the respective verification statuses.

Integration Decision Logic

Decision Element : Application Response Value

CrossCore Overall Decision : Description

Decision Description

OneTrust Request Status

Parent Verification Method Status

FS Error

REFER

Error

Unverified

Failed

decisionText = IdentFail

REFER

IdentFail

Unverified

Failed

decisionText = otpRequestCode

OTP

otpRequestCode

Unverified

Unverified

decisionText = otpMatchAccept

ACCEPT

otpMatchAccept

[Stage 1]

Verified

decisionText = otpNoMatchRefer

REFER

otpNoMatchRefer

Unverified

Failed

decisionText = otpExpiredRefer

REFER

otpExpiredRefer

Unverified

Failed

decisionText = REFER

KBA

kbaAskQuestions

Unverified

Unverified

decisionText = kbaPassAccept

ACCEPT

kbaPassAccept

[Stage 1]

Verified

decisionText = kbaFailRefer

REFER

kbaFailRefer

Unverified

Failed

Customization (Optional)

Form Fields

You will need to enable the form fields that will be collected from the consumer and sent to Experian for validation.

Note:

Only seeded fields can and will be sent to Experian. For more information, see Experian Integration FAQs.

Email Templates

Email templates can be customized in the OneTrust Global Settings.

  • Verification Failure Email: sent to consumer when Precise ID verification or SMS authentication fails.

  • Check Identity Verification Status Email: sent when the initial request is submitted through the web form.

Verification Screens

Verification screens pull branding from Web Form > Form Styling in the Web Form Customization screen. These screens also use the Footer content configured for the web form.

Note:

Message text can be updated with a OneTrust 6.23 preview feature. For more information, see Customizing Text on Verification Screens.

Icons on these screens cannot be changed.





SMS Authentication

The SMS Authentication screen pulls branding from Web Form > Form Styling in the Web Form Customization screen. This screen also use the Footer content configured for the web form.



Knowledge-Based Authentication Screen (Experian CCPA Only)

The Knowledge-Based Authentication screen pulls branding from Web Form > Form Styling in the Web Form Customization screen. This screen also use the Footer content configured for the web form.



Troubleshooting the Experian Integration

When identity verification methods either error or return failed statuses, you can use the application to identify a Reference ID and analyze log decisions to troubleshoot the integration between OneTrust and Experian.

  1. Select an active, unverified request from the Request screen. The Data Subject Request Details screen appears.

  2. Click the ID Verification tab.

  3. Click on the verification method that is experiencing an error status or that failed. The Verification Results modal appears.

  4. Locate the System heading. Below this will be a Reference ID and a log snippet that identifies the decision returned by Experian. This will allow you to troubleshoot the decisions passed by OneTrust and Experian using the Reference ID in your Experian log review.



  5. This log snippet will appear respectively for each verification method, such as OTP or KIQ, that failed in the integration.



  6. Add any comments as necessary, then click the Save button.

Experian Integration FAQs

What fields can OneTrust send to Experian?

OneTrust can ONLY send data to Experian that is collected through the seeded web form fields, which includes the following:

  1. First Name

  2. Last Name

  3. Address

  4. City

  5. State

  6. Country

  7. Zip Code

  8. Date of Birth

  9. National ID (used to collect full or last four digits of SSN)

  10. Phone Number

  11. Contact Preference

Which fields are required on the web form for the integration to work?

Customers will decide which fields to collect, though, not all of these personally identifiable information (PII) fields are required for the integration. Consultants should work with customers and Experian to determine which PII fields the customer will require from the consumer.

Can I still add custom form fields to the web form?

Yes, but the custom fields will not be sent to Experian.

If I already created a custom field for Date of Birth or SSN, can I use those fields for the Experian integration?

No. You will need to replace (i.e. delete or disable) those fields and enable the seeded fields.

Will the integration still work if I rename the seeded fields (e.g. change “National ID” to “Social Security Number”)?

Yes. You can change the labels and descriptions on the seeded fields.

How can I tell which form fields are seeded?

Custom fields will have a trash icon displayed in the editor. Seeded fields cannot be deleted from the form, only disabled.



What if my credentials are incorrect or have issues connecting to Experian?

If incorrect credentials are provided, such as a wrong or expired password, an error alert screen (same as seen above) will appear to the data subject. DSAR admins will see a "Failed" verification status in the Request Details screen. OneTrust recommends to contact Experian for further assistance and troubleshooting.

For additional reference, please see the Intake & Verification Diagram below.