What is the FCRA?

The FCRA is one of the oldest data-privacy laws in the country. It predates the internet, the credit-score industry as we know it, and the modern data-broker business. But it still sets the rules for the most consequential reports written about you: the credit report a lender pulls, and the background check an employer or landlord runs. Understanding what it does — and, just as important, what it doesn't reach — is the difference between disputing a bad record and chasing one that no law forces anyone to fix.

What the FCRA covers

The FCRA regulates consumer reporting agencies (CRAs) — companies that assemble information about you and sell it to help someone decide about your credit, job, housing, or insurance. The best-known CRAs are the three nationwide credit bureaus: Equifax, Experian, and TransUnion. But the law also covers specialty agencies that most people never think about:

• Employment and background-screening companies that sell reports to employers.
• Tenant-screening companies that sell rental histories to landlords.
• Check-verification, insurance, and medical-information bureaus.

The common thread is purpose. A document becomes an FCRA "consumer report" when it's assembled and sold to inform one of those covered decisions. If a company isn't in the business of supplying reports for credit, employment, insurance, or tenancy, the FCRA generally doesn't reach it — a distinction that matters enormously for people-search sites, as the section below explains.

Your core rights under the FCRA

The law hands you a specific, enforceable set of rights over any consumer report about you:

1. See your file. Any CRA must disclose everything it holds on you.
2. Get a free report every 12 months from each nationwide bureau through AnnualCreditReport.com, the government-mandated source. The three bureaus now voluntarily offer free reports every week.
3. Dispute inaccurate or incomplete information. The agency must investigate — usually within 30 days — and correct or delete anything it can't verify.
4. Have old negative information age off. Most negative items must drop off after seven years; most bankruptcies after ten.
5. Get an adverse-action notice. If a report is used to deny you credit, a job, insurance, or housing, you must be told, and given the source so you can check it.
6. Limit who can pull your report. A CRA may release it only for an FCRA-permitted purpose — credit, employment, insurance, tenancy, and a short list of others.
7. Freeze your file and place fraud alerts, free to add and lift.
8. Sue. You can take a reporting agency, or a company that furnished bad data about you, to court for violations.

FCRA background check rights

When an employer runs a background check through a screening company, that company is a CRA and the report is a consumer report — so the FCRA applies in full. Your FCRA background check rights are among the most-litigated parts of the law, and they follow a strict sequence:

• Before the check, the employer must give you a clear, standalone disclosure and get your written authorization.
• If the report might cost you the job, the employer has to send a pre-adverse-action notice first — with a copy of the report and a summary of your FCRA rights — and give you a reasonable window to dispute errors before the decision is final.
• If you dispute, the screening company must reinvestigate and fix or remove anything it can't verify, the same as any other CRA.

The point of that sequence is to stop a wrong record — a mismatched name, an expunged case, a stranger's arrest — from quietly ending your candidacy before you ever get to challenge it.

The data-broker gap

Here's where the FCRA runs out. Most people-search sites publish the same kind of information a background-check company would — your name, addresses, relatives, phone numbers, age — but they sidestep the law by disclaiming it. Their terms of service state that they are not consumer reporting agencies and that you may not use their data to decide on employment, credit, housing, or insurance. Because they claim their listings aren't "consumer reports," the FCRA's accuracy and dispute rights don't attach. You generally can't file an FCRA dispute to force a people-search site to correct or take down what it publishes about you.

Regulators have pushed back on the edges of this. In 2012 the FTC secured an $800,000 penalty against a people-search company for marketing consumer profiles to employers and recruiters while ignoring its FCRA obligations. But that case turned on the site behaving like a screening service; most people-search sites stay carefully on the disclaiming side of the line, and the gap remains. For those listings, the tool isn't an FCRA dispute — it's an opt-out or removal request, and, where you're a covered resident, a state privacy law like the CCPA.

Who enforces the FCRA

Federal enforcement is shared by the FTC and the CFPB, and state attorneys general can bring cases too. Beyond the regulators, the FCRA gives you a private right of action: you can sue a reporting agency, or a company that furnished inaccurate data about you, for willful or negligent noncompliance, and recover statutory damages, actual damages, and attorney's fees. Complaints go to the CFPB at consumerfinance.gov or the FTC at reportfraud.ftc.gov.

Common questions

Does the FCRA let me remove myself from people-search sites?

Usually not. Most people-search sites disclaim consumer-reporting-agency status, so the FCRA's dispute and correction rights don't apply to their listings. Getting that data down runs through opt-out and removal requests, plus state privacy laws where they apply — not an FCRA dispute.

Is a credit report the same as a background check?

They're cousins, not twins. Both are FCRA consumer reports when they're sold for a covered decision, but a credit report comes from a nationwide bureau and focuses on your borrowing history, while an employment background check comes from a screening company and focuses on identity, criminal, and work records.

Can I sue under the FCRA?

Yes. The law includes a private right of action, so you can take a reporting agency or a data furnisher to court for willful or negligent violations and recover damages and legal fees.

See also

• What is a background-check site?
• How accurate is the data brokers hold on you?
• How data brokers fuel identity theft