Equifax (EFX) will roll out a new “credit locks for life” product in January that will be open to “all Americans, whether or not they were impacted by the cybersecurity incident,” and some consumers may be wary that participating may result in waived rights.

The “lock” is similar to a “freeze,” but is not subject to regulation by states.

Speaking at a Senate hearing today, interim CEO Paulino do Rego Barros Jr. declined to guarantee that consumers would not be forced to give up their rights to sue if they used Equifax products. Equifax’s terms of service includes forced arbitration clauses that waive consumers’ legal rights to sue Equifax.

“I believe consumers have a choice to choose the products that they need,” Barros told Sen. Richard Blumenthal (D-CT). “We work according to the law and we use the tools that the industry uses to have arbitration in place.”

Companies generally prefer using arbitration to class action suits and often have forced arbitration clauses in their terms of use or service.

But does this apply to Equifax’s new “credit locks for life” product? Answering the question explicitly, an Equifax spokesperson clarified to Yahoo Finance that “the company does not intend to have the arbitration clause apply to the service.

There is no guarantee that you will keep your right to sue

Consumer advocates remain skeptical due to the broad language on Equifax’s own website.

“Unless they rewrite every other arbitration clause on their website, there is still a substantial risk that consumers who purchase the credit lock program will be subject to arbitration,” said F. Paul Bland, executive director at consumer group Public Justice and an expert in class action suits.

Bland said that if the website arbitration clause is broadly worded — he said last time he checked it was — it could apply to the new credit lock program. And in cases where it’s not clear or there is apparently conflicting terms, it often comes down to the arbitrator deciding if the situation falls under their purview, Bland said.

Equifax has had an arbitration problem before

When news broke of the Equifax security breach, in which 145 million people’s personal information was hacked — including Social Security numbers — the company immediately rolled out a complimentary credit monitoring service called TrustedID that had terms that restricted consumers’ legal rights to sue.

Since Equifax’s complimentary service effectively funneled scared consumers into credit monitoring, significant public blowback ensued and the company walked back its statement and removed controversial language from TrustedID’s terms of use.