Equifax data breach, 143 million people affected

I think think the law prevented banks from prohibiting consumers from filing class actions. Equifax already agreed to allow class action suits for people who use their monitoring software, so I don’t think this affects them.

It’s not clear to me that this law affects Equifax anyway, they are neither a bank or a CC company, and generally individuals do not do business directly with them, so how could they prevent it? For example, I have never signed an agreement with Equifax. How can they force me into arbitration?