Fair Credit Reporting Act (FCRA)

What FCRA actually does

The Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.) became law in 1970. It was the first modern federal data-privacy statute. In plain terms: when a company sells a "consumer report" about you to someone deciding on your job, housing, credit, or insurance, that company has to follow specific rules on accuracy, disclosure, consent, and dispute rights.

The companies bound by FCRA are called consumer reporting agencies, or CRAs. The three big credit bureaus (Equifax, Experian, and TransUnion) are the familiar ones, but the definition is broader. Background-check firms, tenant-screening services, and pre-employment screeners are all CRAs. So are some specialty databases covering medical history, check-cashing, and casino self-exclusion.

FCRA matters to first responders in two ways. You have credit-side rights: the freeze, the dispute, and the free report. And FCRA is the legal hook the FTC uses against the worst data brokers, the lever that has produced settlements with real money attached.

What FCRA gives you directly

The credit-side rights are the ones most people use.

1. Free credit report: you can get your report from each of the three major bureaus at annualcreditreport.com. Since October 2023, all three bureaus offer free weekly online reports there on a permanent basis. Use that site, not a bureau marketing page, and don't pay for monitoring you don't need.
2. Security freeze: lock your credit file at each bureau. It has been free under federal law since 2018. You'll need to thaw it when you actually apply for credit, but the lock blocks new accounts opened in your name. File at Equifax, Experian, and TransUnion directly.
3. Pre-screen opt-out: stop the unsolicited credit and insurance offers brokers generate from your file. File at optoutprescreen.com. It lasts 5 years online, or permanently if you mail the signed form.
4. Dispute right: if a credit report has wrong information, the bureau has 30 days to investigate and correct or remove it. File the dispute in writing with the bureau, and separately with the company that supplied the data.
5. Adverse-action notice: if a job, apartment, or loan is denied based in part on a consumer report, the decision-maker has to tell you which CRA the report came from, so you can pull it and dispute it.

For first responders, the freeze is the highest-leverage move. It blocks the most common identity-theft attack against you: someone opening new credit lines in your name using an address and date of birth pulled off a broker site. Place it now. Thaw it temporarily when you apply for a mortgage or refinance.

Why FCRA reaches the broker side

Here is the mechanism. If you are a CRA selling reports for employment, housing, credit, or insurance decisions, you have to comply with FCRA: accuracy, disclosure, consent, and a dispute process. Many people-search and aggregator sites built their business on the claim that they are not CRAs and their data is not for FCRA purposes.

The FTC has tested that claim several times. What matters is not the label a site puts in its terms of service. It is how the data actually gets used. A site that sells profiles to employers and landlords is acting as a CRA regardless of the disclaimer it posts.

FTC enforcement against brokers

A handful of FTC cases set the pattern:

• Spokeo, 2012, $800,000: the first time the FTC applied FCRA to a people-search site. Spokeo had marketed its profiles to HR departments and recruiters for employment screening without following FCRA. Spokeo argued it was not a CRA. The FTC held that the actual use of the data made it one.
• HireRight, 2012, $2.6 million: an employment background-screening firm penalized for reporting inaccurate and duplicated criminal records, sometimes for the wrong person, and for failing to give consumers the notices FCRA requires.
• Instant Checkmate and InfoTrack, 2014, $525,000 and $1 million: two data brokers that sold reports to prospective employers and landlords without checking permissible purpose or report accuracy.
• TruthFinder and Instant Checkmate, 2023, $5.8 million: operated by The Control Group Media Company, Intelicare Direct, and PubRec. The FTC charged them with deceiving users about background-report accuracy and operating as CRAs without FCRA compliance.

Note the years. Enforcement against people-search sites is periodic, not constant. The FTC keeps pressure on the worst broker actors, but it does not pursue every violation.

How to invoke FCRA against a broker

If a broker pulled a report on you that was actually used for an employment, housing, or credit decision, you may have FCRA claims. The steps:

1. Request your file. FCRA gives you the right under 15 U.S.C. § 1681g to see what a CRA holds on you. If the broker refuses, that refusal is itself a violation.
2. Ask who pulled it. A CRA has to disclose, on request, who accessed your file: within the last 2 years for an employment purpose, and the last 1 year for any other purpose.
3. Dispute wrong data. If the broker's file has inaccurate or stale information, file the written dispute. They have 30 days to respond.
4. File an FTC complaint at reportfraud.ftc.gov if the broker refuses, stalls, or claims the rules don't apply when they should.
5. File a CFPB complaint at consumerfinance.gov/complaint as a parallel path. The CFPB and FTC share FCRA enforcement.

For a first responder dealing with a stalker or doxxer, the dispute path matters most when an employer or landlord relied on a broker report holding wrong or stale information. The dispute gives you a documented way to demand a correction, and it builds a record if the situation later reaches court.

Damages and enforcement

The FTC and CFPB share FCRA enforcement. FCRA authorizes federal civil penalties of up to $4,983 per knowing violation (the 2026 inflation-adjusted maximum), which add up quickly across systemic failures touching many files.

FCRA also gives you a private right of action. Under § 1681n (willful) and § 1681o (negligent), a willful violation lets you recover either your actual damages or statutory damages of $100 to $1,000 per violation, plus attorney's fees and, where willfulness is shown, punitive damages. You do not have to prove actual damages to recover the statutory damages for a willful violation. FCRA class actions have produced large settlements.

Where FCRA falls short

FCRA is a useful tool, not a complete one. The gaps:

• Data sold for marketing or "personal interest." If the data is not used for an FCRA-covered decision, the rules do not apply. Most people-search lookups fall outside FCRA on that basis.
• Aggregated public-records profiles. FCRA was written for traditional credit files. Profile pages built from public records sit in a gray area, and the broker industry keeps refining arguments to stay out of the statute.
• Brokers that do not market to covered users. A site that sells to "anyone" rather than to employers or landlords has more room to argue its data was not used for a covered decision.
• Speed. The dispute window is 30 days, and real resolution often takes longer. If you need an apartment in two weeks, that timeline does not help you in time.

What we do

We do not file FCRA complaints for you. That is an attorney's job, or an FTC or CFPB complaint you submit yourself. What we work is the broker layer FCRA tries to police: the people-search and aggregator sites that publish your home address and your family's contact details. We submit opt-outs across the major broker and people-search sites, we keep checking, and we refile when a site relists you. If a broker used your data for an employment, tenant, or credit decision, that is an FCRA matter for an attorney, and we can give you a record of the listings we found and the removals we requested to take with you.

Run a free scan to see who has you today.