🇺🇸Fair Credit Reporting Act

Skin

← Back to laws in United States

Fair Credit Reporting Act

Fair Credit Reporting Act: privacy, accuracy and permissible use

The Fair Credit Reporting Act regulates consumer reporting in the United States. It is a privacy law, but it is also an accuracy, fairness and accountability law. It governs consumer reporting agencies, furnishers of information, users of consumer reports and certain related activities involving consumer report information.

The FCRA is especially important for credit, lending, insurance, employment screening, tenant screening and other decisions where consumer report information may affect a person’s opportunities. It is not a general privacy law for all personal data. It applies when information is used or supplied in the consumer reporting ecosystem.

What the FCRA is trying to control

The law is built around the idea that consumer report information can significantly affect people’s lives. If information about credit worthiness, credit standing, credit capacity, character, reputation, personal characteristics or mode of living is assembled or used for eligibility decisions, the FCRA may become relevant.

Compliance therefore depends on role. A consumer reporting agency has different duties from a lender that uses a report, an employer that requests a background check, or a company that furnishes information to a reporting agency.

Key Provisions

Permissible purpose: consumer reports should be obtained and used only for purposes allowed by the FCRA.

Accuracy and integrity: furnishers and reporting agencies must pay attention to accuracy, dispute handling and correction processes.

Consumer disclosures: consumers have rights to access information in their files and dispute inaccurate information.

Adverse action: users of consumer reports may need to provide notices when a report contributes to an adverse decision.

Specialised uses: employment screening, credit offers, fraud alerts, identity theft and affiliate information sharing can trigger specific duties.

Permissible purpose is the gatekeeper

A business should not obtain a consumer report merely because it is useful. It needs a permissible purpose under the law. Common contexts include credit, insurance, employment, tenant screening and other eligibility decisions where the FCRA permits use under specified conditions.

For employment purposes, the organisation should be especially careful with disclosure, authorisation and adverse action workflows. Background checks handled casually can create legal risk even when the information itself appears accurate.

Disputes and accuracy are operational obligations

FCRA compliance requires systems for handling disputes and correcting or deleting inaccurate information where required. A consumer’s ability to challenge information is a core part of the law. Organisations that furnish information should have procedures to investigate disputes and avoid repeatedly reporting information that has not been properly verified.

Users of consumer reports should also maintain evidence of permissible purpose, authorisation where needed, adverse action steps and communications with the consumer.

Practical risk area

Do not label a dataset as “credit data” or “background data” without identifying the FCRA role. The obligations differ depending on whether the organisation is a reporting agency, furnisher, user, reseller or employer using a screening report.

Relationship with state privacy laws

Many state consumer privacy laws contain exemptions for activities regulated by and authorised under the FCRA. This does not mean every piece of personal data held by a financial or screening business is automatically outside state privacy law. The exemption usually needs to be tied to the regulated FCRA activity.

Businesses should therefore separate consumer report workflows from general marketing, analytics, website, customer support and account data flows.

What this means for you

If your business obtains, supplies or uses consumer report information, build FCRA compliance around role, purpose and evidence. Track permissible purpose, consumer authorisation where required, dispute handling, adverse action notices, accuracy controls and vendor responsibilities.

Other laws in United States
CA-DELETE

California Delete Act and Data Broker Requirements

California Privacy Protection Agency

Open law Read analysis
CPPA

California Privacy Rights Act and California Privacy Protection Agency provisions

California Privacy Protection Agency

Open law Read analysis
CLOUD-ACT

Clarifying Lawful Overseas Use of Data Act (CLOUD Act)

United States Department of Justice

Open law Read analysis
42-CFR-P2

Confidentiality of Substance Use Disorder Patient Records

U.S. Department of Health and Human Services, Office for Civil Rights

Open law Read analysis
CAN-SPAM

Controlling the Assault of Non-Solicited Pornography And Marketing Act

Federal Trade Commission

Open law Read analysis
CPNI

Customer Proprietary Network Information Rules

Federal Communications Commission

Open law Read analysis
DPPA

Drivers Privacy Protection Act

United States Department of Justice and federal courts

Open law Read analysis
ECPA-SCA

Electronic Communications Privacy Act and Stored Communications Act

United States Department of Justice

Open law Read analysis
FERPA

Family Educational Rights and Privacy Act

U.S. Department of Education, Student Privacy Policy Office

Open law Read analysis
GINA

Genetic Information Nondiscrimination Act

U.S. Equal Employment Opportunity Commission and federal health agencies

Open law Read analysis
HITECH

Health Information Technology for Economic and Clinical Health Act

U.S. Department of Health and Human Services, Office for Civil Rights

Open law Read analysis
HIPAA

Health Insurance Portability and Accountability Act of 1996

U.S. Department of Health and Human Services Office for Civil Rights

Open law Read analysis
IL-BIPA

Illinois Biometric Information Privacy Act

Illinois Attorney General and private enforcement

Open law Read analysis
MT-CDPA

Montana Consumer Data Privacy Act

Montana Attorney General, Office of Consumer Protection

Open law Read analysis
NJDPA

New Jersey Data Privacy Law

New Jersey Attorney General and Division of Consumer Affairs

Open law Read analysis
PRIVACY-ACT

Privacy Act of 1974

U.S. Department of Justice, Office of Privacy and Civil Liberties

Open law Read analysis
RI-DTPPA

Rhode Island Data Transparency and Privacy Protection Act

Rhode Island Attorney General

Open law Read analysis
UCPA

Utah Consumer Privacy Act

Utah Attorney General and Division of Consumer Protection

Open law Read analysis
VT-DPOSA

Vermont Data Privacy and Online Surveillance Act

Vermont Attorney General

Open law Read analysis
VPPA

Video Privacy Protection Act

United States Department of Justice and federal courts

Open law Read analysis