Equifax, Experian, and TransUnion must process requests to freeze and unfreeze credit reports without charge, making it easier for people to prevent outside parties from obtaining their credit histories.

Previously, the cost of such freezes varied state by state.

The Economic Growth, Regulatory Relief, and Consumer Protection Act, signed into law in May, eased a number of restrictions on banks imposed by the Dodd-Frank reform act of 2010 that followed the banking and mortgage loan crisis. However, it also implemented several notable consumer protections, including the free credit freezes and longer period of fraud watches.

Parents may now also request credit freezes for children 15 and under, also at no cost, something that previously varied from state to state, including whether parents had the right to ask at all.

Freezes may be placed online, by phone, or via regular mail. These links take you to the respective credit-freezing Web sites for Equifax, Experian, and TransUnion.

A credit freeze and lock are not the same, although they accomplish the same function. Equifax, Experian, and TransUnion continue to have the right to charge for locks, which are typically advertised as being simpler and faster by allowing immediate account-based locking and unlocking of credit reports via an online account.

A freeze requires that consumers verify their identities, and may take a few days to go into effect. Credit-reporting bureaus must unfreeze accounts within an hour after consumers place a call, but it may take longer by mail and online.

People who apply for new credit cards, loans, and other transactions including apartment rental in some places, and for people trying to get their credit score, must lift their freezes and locks.

Security expert Brian Krebs noted that the Consumer Financial Protection Bureau lists 46 different companies that collect consumer-financial information. But most consumer credit checks get processed through the big three, which is why this new law that goes into effect today focuses on them.

Krebs recommended also filing freezes with the fourth-largest credit-reporting bureau, Innovis, and one used by cellular companies, NCTUE, which is effectively operated by Equifax but isn’t subject to the regulation.

Krebs wrote that he generally recommends consumers freeze their credit reports because of the widespread availability of low-cost access to people’s credit history through websites that don’t validate the requestor’s identity and don’t even require a Social Security Number. With a freeze in place, he found that these sites no longer appeared to be able to pull his own credit file.

The law also extends a required period for fraud alerts, which were and remain free. Consumers can inform credit bureaus that they have been subject to fraud, and the bureaus must then inform any company requesting credit reports on those consumers—say, for opening a new credit-card account—that the company should attempt to contact the consumer to verify that someone is impersonating them.

Before Sept. 21, credit-reporting bureaus only needed to provide this alert to credit requesters for 90 days. That’s now been extended to 1 year. A previous requirement to inform requesters of a consumer having been the victim of identity theft remains at seven years.

Active-duty military service members will also receive free credit-reporting services from the big three firms, but this provision goes into effect in late May 2019.