After Equifax’s massive data breach, some customers are thinking twice before accepting the credit bureau’s help.

After a data breach that impacted a potential 143 million U.S. adults, Equifax EFX, -2.03% created a website that would allow consumers to check if they were affected. Customers who were told their personal information may have been impacted were given the following message: “Click the button below to continue your enrollment in TrustedID Premier.”

There’s one catch: Those who signed up to this TrustedID Premier security monitoring service for a year appeared to waive their rights to participate in a class-action lawsuit. Some consumers quickly detected these conditions included in the terms of Equifax’s service.

In a statement online, Equifax said the class-action waiver applies to TrustedID “and not the cybersecurity incident.” But given the extent of the latest data breach, many people have said asking customers to waive their right to a class-action lawsuit should something go awry with TrustedID is, at best, a case of bad timing. (The company was not immediately available for comment.)

Equifax terms for TrustedID require “arbitration of disputes” and “a waiver of the ability to bring or participate in a class action, class arbitration, or other representative action.” The terms were written in block capitals rather than fine print. However, experts say research has shown that customers rarely read the terms and conditions when signing up for services.

“Customers are between a rock and a hard place,” said Lisa Gilbert, the vice president of legislative affairs at Public Citizen, a nonprofit based in Washington, D.C. “In order to protect your identity you sign away your right to band together and protect yourself with others who have been harmed. It’s a corporate Catch 22.”

Don’t miss:Government’s consumer bureau targets mandatory arbitration

Proposed class-action lawsuits have already been filed. Late Thursday evening, Bloomberg News reported, plaintiffs Mary McHill and Brook Reinhard, who live in Oregon, filed a suit. A lawyer who is part of the team that filed the class-action suit told Bloomberg it will seek as much as $70 billion in damages nationally.

Attorney John Yachunis of the firm Morgan & Morgan also filed a suit against Equifax, he said Friday, with lead plaintiffs named as Jamie McGonnigal and Brian Spector. His clients will seek statutory damages under the Fair Credit Reporting Act, he said, as well as reimbursement for out-of-pocket losses related to the case.

Yachunis, the attorney filing a class-action suit against Equifax, said waivers such as Equifax’s are common in identity theft cases, but even if consumers opted in to such a waiver, they still may be able to join a suit. “It doesn’t affect the underlying conduct of Equifax in connection with the release of data,” he said.

How the rise of drones is posing a major security nightmare

The suits come at a time when arbitration clauses are being debated in the U.S. House of Representatives. In July, the Consumer Financial Protection Bureau announced a final version of a rule that would ban financial companies from using language in their contracts called “mandatory arbitration clauses” that prohibit consumers from bringing class-action suits against them.

But members of the House voted to repeal that rule. It now faces a vote in Senate, but it’s unclear when or if the vote will take place. That rule would impact Equifax, Gilbert said, because it covers credit-related companies.

“This is a prime example of why we need the CFPB rule,” said George Slover, senior policy counsel at Consumers Union, a consumer advocacy group based in Yonkers, N.Y.

Currently, many financial institutions, like Equifax, include language in their contracts that require consumers to settle disputes with them in private, with individuals known as arbitrators, saving the companies time and money and allowing them to avoid negative publicity.