You're correct. Consumer consent and permissible purpose are two key elements under the Consumer Reporting Act. Without that, the institution that is trying to access an Equifax credit file could not. You need the consumer's consent, and you have to have one of the allocated permissible purposes under legislation to do so.
On December 4th, 2017. See this statement in context.