WASHINGTON—Consumers are on track to get one thing from Congress in response to last year’s massive Equifax Inc. hack: free freezes of their data held by the credit-reporting companies.

The bipartisan agreement, set to be approved in the Senate by next week as part of a broader banking bill, would require credit-reporting companies to let consumers block access to their credit reports to potential lenders without paying a fee. Freezing access to credit data is a crucial measure consumers can take if they want to protect themselves from identity theft.

Credit-reporting firms are mixed about the measure, which would erode a source of revenue, while consumer advocates worry it doesn’t go far enough to give people more control over their data.

The provision would set a single national standard for credit freezes. Currently, 42 states allow credit-reporting firms to charge for the service unless an individual was a victim of identity theft. Eight states and the District of Columbia mandate waiver of the fees under all circumstances.

The U.S. has three main reporting companies—Equifax, Experian and TransUnion—that typically charge $10 or less each to freeze or reinstate credit-data access, depending on a patchwork of state laws. The measure bars fees for both.

Under the provision, credit-reporting firms would have to place the freeze within one to three days after receiving a consumer’s request. Consumers would also be able to unfreeze their credit within an hour, if the process is requested electronically, or three days if requested by mail.

Consumer groups are concerned the measure would override future efforts by states to implement stricter freeze requirements on credit-reporting firms—for instance, making credit freezes a default setting for credit reports, essentially requiring consumers to approve any credit inquiry from potential lenders.

“It’s stopping the states from doing anything better in the future, and that’s a problem,” said Mike Litt, a director at U.S. PIRG, a consumer-rights group. 

Sen. Mark Warner (D., Va.), one of the chief sponsors of the broader Senate bill, said he regretted the legislation—the result of a compromise between the political parties—doesn’t do more to rein in credit-reporting companies.

“They have all of our personal information,” Mr. Warner said. “And there are not clear standards and clear penalties.”

The credit-reporting firms have accepted the change is coming. “This is likely to be Congress’s opportunity to address the credit-reporting industry,” said Francis Creighton, head of the Consumer Data Industry Association, a trade group that represents credit-reporting companies.

“We think it’s fair that we’re able to charge a fee on a freeze,” Mr. Creighton, said. But, “given that [policy makers] don’t agree with us, this bill is perfectly reasonable,” he added.

“We are not upset with the provision of the proposed law. We support a federal security freeze statute that simplifies the process for consumers,” Experian said.

The provision likely will result in credit-reporting firms pitching credit-monitoring and other subscription-based services, according to a person familiar with the matter. People who contact the firms to sign up for the freeze will likely be marketed services that have a monthly fee attached to them, the person said. 

Credit-reporting firms don’t break out what share of their revenue comes from credit freezes, though an industry executive says it is much smaller than other services they sell consumers, such as credit monitoring and identity-theft protection. But removing freeze fees would eliminate funds some of the companies say they use to help cover the costs associated with the freezes, including maintaining call centers. In some cases, the companies incur losses from the service. 

The provision’s impact likely extends to lenders who receive loan applications from consumers with frozen reports. In some cases, lenders that contact the firms for the applicant’s credit reports and receive a notice that the report is frozen will still pay for that service. The lenders in most cases wouldn’t move forward with the loan application without a credit report.

Some firms are letting consumers place limits on their credit reports at no cost. Equifax and TransUnion offer a free service that allows consumers to lock and unlock their credit reports, while Experian charges for it. Locks are similar to credit freezes in helping to block identity thieves from obtaining financing in another person’s name. While they offer more convenience, such as control of data via an app, locks also give consumers less legal protection, consumer advocates say.

The credit-freeze provision is one of several proposals circulating in Congress since last year’s disclosure of the massive Equifax hack, which compromised the personal information of 147.9 million people. Many of the proposals go further than this bipartisan deal, with provisions to impose stricter regulatory oversight on the credit bureaus, charge penalties in the event of further breaches, or establish credit freezes as the default option for consumers. 

Equifax itself hasn’t been able to shake off condemnation from policy makers and is the subject of several government probes. It also has upset its competitors. Experian and TransUnion believe the freeze legislation wouldn’t have materialized without the Equifax breach, according to the person familiar with the matter.