Privacy Law Library

Fair Credit Reporting Act

FCRA

Credit reporting · Financial · Employees

The FCRA governs the collection, accuracy, and use of consumer report information. It limits who may obtain reports and for what purposes, requires accuracy procedures and dispute handling, and gives consumers rights to their files, free credit freezes, and adverse action notices. The Homebuyers Privacy Protection Act (effective March 4, 2026) restricts mortgage 'trigger leads'; the CFPB's 2025 medical debt rule was vacated in July 2025.

Where
Federal
Citation
15 U.S.C. 1681-1681x; 12 CFR Part 1022 (Regulation V)
Status
In force
In force since
1971-04-25
Last amended
2026-03-04
Enforced by
CFPB and FTC (plus banking agencies and state attorneys general)
People can sue
Yes
Penalties
Willful violations: actual damages or $100-$1,000 statutory damages, plus punitive damages and fees; negligent violations: actual damages and fees (no private suit for section 1681m duties, per 1681m(h)(8)). FTC civil penalties for knowing violations are $4,983 per violation (16 CFR 1.98(m)).
Applies to
  • Consumer reporting agencies, including background-screening and specialty agencies
  • Users of consumer reports (lenders, insurers, employers, landlords)
  • Furnishers of information to consumer reporting agencies

What a privacy notice must say

  • Users taking adverse action based on a consumer report must give an adverse action notice with the agency's contact details and dispute rights.15 U.S.C. 1681m(a)
  • Employers must give a standalone written disclosure and get written authorization before obtaining a consumer report for employment.15 U.S.C. 1681b(b)(2) · Only if: Employment purposes

Rights it gives people

  • Consumers may dispute information; agencies must reinvestigate free of charge within 30 days.15 U.S.C. 1681i(a)(1)
  • Nationwide agencies must place, lift, and remove security freezes free of charge.15 U.S.C. 1681c-1(i)

Practices it requires

  • Furnish consumer reports only for a permissible purpose.15 U.S.C. 1681b(a); 1681e(a)
  • Consumer reporting agencies must follow reasonable procedures to assure maximum possible accuracy.15 U.S.C. 1681e(b)
  • Furnishers must not report information they know or have reasonable cause to believe is inaccurate and must investigate disputes.15 U.S.C. 1681s-2(a)-(b)
  • An agency may not sell a report triggered by a residential mortgage inquiry to another party unless it is a firm offer and the recipient has the consumer's documented authorization or an existing mortgage, servicing, or account relationship.15 U.S.C. 1681b(c)(4) · From 2026-03-04
  • Exclude most obsolete adverse information (generally older than 7 years; bankruptcies 10 years).15 U.S.C. 1681c(a)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: 1681c(a) 7- and 10-year periods and 1681s-2(b) investigation duty were not read closely | eCFR still shows 12 CFR 1022.38 (medical debt) despite the July 11, 2025 vacatur

Research reference, not legal advice.