The Fair Credit Reporting Act and people-search sites: where the line is

Two documents about you can look almost the same on a screen. One is a people-search listing: your name, a few past addresses, an age range, some possible relatives, maybe a phone number that stopped being yours years ago. The other is a background report a property manager ordered before deciding whether to rent to you. Same kind of facts, often drawn from the same public records. Under federal law, though, the two can sit on opposite sides of a line, and which side a report falls on decides whether you have any right to see it, dispute it, or even know it was used.

That line is drawn by the Fair Credit Reporting Act, a 1970 statute found at 15 U.S.C. 1681 and the sections that follow. Below: what the Act covers, why people-search sites insist they are outside it, what federal regulators did when that claim did not match the business, and what you can do either way. It is general information, not legal advice; where a lawyer is worth calling, I say so.

What the Act regulates, in plain terms

The FCRA does not regulate information as such. It regulates a particular use of it, and the businesses that supply it for that use.

Section 603 of the Act defines a "consumer report" as information from a consumer reporting agency that bears on a person's creditworthiness, character, general reputation, personal characteristics or mode of living, and that is used or expected to be used to decide whether the person qualifies for credit or insurance for personal, family or household purposes, for employment, or for another purpose the Act allows. Section 604 lists those other permissible purposes. They include a business transaction the person started, such as applying to rent an apartment, and certain government licenses.

A "consumer reporting agency," under the same section 603, is a business that regularly assembles or evaluates information about consumers in order to furnish consumer reports to others for a fee. The three nationwide credit bureaus are the obvious examples, but the category is much wider. The Consumer Financial Protection Bureau keeps a list of consumer reporting companies that includes employment screeners, tenant screeners, check and bank account screening services, and companies that track insurance claims or medical information for underwriting.

Once a business is in that category, the Act asks a lot of it. Section 607 requires reasonable procedures to make sure reports go only to users with a permissible purpose, including having users identify themselves and certify that purpose, and reasonable procedures to assure maximum possible accuracy. The agency must tell its customers about their own duties under the Act. Section 605 keeps most negative information out of reports after seven years, and bankruptcies after ten. Section 611 gives you the right to dispute. Section 615 makes the business that turns you down tell you that a report was involved.

Each of those duties costs money and slows a sale down, which explains the notice you see on people-search sites.

Why people-search sites say they are not consumer reporting agencies

Read the terms of use on almost any people-search site and you will find language along these lines: the company is not a consumer reporting agency as defined by the FCRA, its reports are not consumer reports, you may not use what you find to make decisions about employment, housing, credit, insurance or similar eligibility, and by searching you agree. Some sites make you tick a box before the results appear.

A business outside the Act does not have to check who its buyers are or why they want a report, does not have to run a formal dispute process, and does not have to keep old negative information out. It can sell a report to anyone with a payment card, for any reason or none, and that is the business model.

From your side, the disclaimer means the FCRA's tools usually do not reach a people-search listing. You cannot file an FCRA dispute with the site; you use its opt-out process instead, which I come back to below.

But the disclaimer is a statement of intent, not a legal classification. Whether a company is a consumer reporting agency depends on what it actually does: who it markets to, what it knows about how buyers use its reports, and whether it assembles information for the purposes the Act covers. The Federal Trade Commission has tested that point more than once.

When the FTC said the label did not match the business

Spokeo, 2012

In June 2012 the FTC announced that Spokeo, a data broker that compiled profiles on consumers, would pay an 800,000 dollar civil penalty to settle charges that it marketed those profiles to human resources, background screening and recruiting businesses without following the FCRA. According to the FTC, Spokeo was operating as a consumer reporting agency and failed to make sure its information would be used only for permissible purposes, failed to make sure it was accurate, and failed to tell users of its reports about their obligations, including the duty to notify people when a report led to an adverse decision. The agency called it its first case about the sale of internet and social media data for employment screening. The FTC also noted that Spokeo changed its terms in 2010 to say it was not a consumer reporting agency, but did not cut off companies that were already using its data for that purpose. The FTC's announcement has the details.

Instant Checkmate, 2014

In April 2014 the FTC announced that Instant Checkmate would pay a 525,000 dollar civil penalty. The FTC said the company marketed its reports to prospective employers and landlords, with advertising that suggested checking out tenants before they rent, without taking reasonable steps to make sure buyers had a permissible purpose or that the reports were accurate.

TruthFinder and Instant Checkmate, 2023

In September 2023 the FTC announced a 5.8 million dollar settlement with the two companies, and this case went straight at disclaimers. The FTC said that despite stating they were not consumer reporting agencies, the companies assembled background reports and promoted them for employment and tenant screening, including through search advertising aimed at those uses. It also alleged that "Remove" and "Flag as Inaccurate" buttons did not work the way people would expect: removing an item hid it only from the customer who clicked, and flagged items were never investigated. The order requires the companies to run a monitoring program that regularly assesses whether they are operating as a consumer reporting agency.

What the cases add up to

A disclaimer protects a company only if its marketing, its sales and its customers line up with it. When a site advertises to landlords and hiring managers, the "not a consumer reporting agency" line settles nothing.

Private lawsuits are a harder road. A suit over an allegedly inaccurate Spokeo profile reached the Supreme Court, which ruled in 2016 that a bare procedural violation of the Act, without a concrete harm, is not enough to bring a case in federal court, and sent it back to the appeals court. If you believe a report cost you something real, that ruling is one reason to talk to a consumer protection lawyer before filing anything yourself.

Regulators are still drawing the line

The question is not settled. In September 2023 the CFPB published an outline of proposals it was considering under the FCRA. Among them: treating data brokers that sell certain types of consumer data as consumer reporting agencies, and barring brokers from selling data gathered for a permissible purpose to buyers who have no permissible purpose. At the time of writing, the Bureau has not issued a proposed rule, so none of this has changed anyone's obligations yet.

Your rights when it is a real background check

When the Act does apply, it gives you a sequence of rights. Here is how it plays out with a job application; renting is similar, and the FTC explains both in its guides to employer background checks and tenant background checks.

1. Before the check: An employer that wants a report from a background screening company must tell you in writing, in a document that contains only that disclosure, and get your written permission (section 604). You can refuse, though you may not get the job.
2. Before a final no: If the employer is leaning toward rejecting you because of the report, it must first give you a copy of the report and the official "Summary of Your Rights Under the Fair Credit Reporting Act." This is your chance to point out a mismatch, such as someone else's court record attached to your name.
3. The adverse action notice: If an employer, landlord, lender or insurer goes ahead with a negative decision based on a report, section 615 requires a notice with the name, address and phone number of the company that supplied it, a statement that the company did not make the decision, and your rights to dispute and to get a free copy of the report if you ask within 60 days.
4. The dispute: Under section 611 you dispute directly with the reporting company. It must investigate unless the dispute is frivolous, and inaccurate, incomplete or unverifiable information must be corrected or removed, usually within 30 days. Send copies, never originals, of anything that shows the error, keep a dated record of what you sent, and ask that a corrected report go to the employer or landlord.
5. Old information: In most cases negative information older than seven years cannot be reported, and bankruptcies drop off after ten. Criminal convictions have no federal time limit, though some states and cities restrict how employers may ask about or use criminal history.

You also have the right to see your file at any consumer reporting agency. It is free in several situations (after an adverse action, for example, or if you are a victim of identity theft and place a fraud alert), and once every 12 months from each nationwide credit bureau and each nationwide specialty agency. If a company breaks the rules, you may be able to sue in state or federal court, and you can complain to the CFPB or the FTC; states can enforce the Act too. A lawyer who handles consumer cases can tell you whether what happened to you is worth pursuing.

When it is a people-search listing

If the report about you sits on a people-search site and nobody used it to turn you down for anything, the FCRA probably gives you nothing to work with. Your tools are different.

• The site's opt-out form: Most large people-search sites have one, and some families of sites share a single form. Our walkthrough on removing yourself from Whitepages, Spokeo and BeenVerified covers three of the biggest, and the full opt-out guide covers the rest.
• State law: California residents can already ask businesses covered by the state's privacy law to delete personal information, and California's Delete Act, signed in 2023, requires the state privacy agency to build a single deletion request that will reach every registered data broker, due to open in 2026. A few states, California and Vermont among them, also require data brokers to register.
• The source: A listing is usually stitched together from property records, court records, marketing lists and other brokers. Our piece on what a data broker knows about you explains where the pieces come from.

There is one place where the two worlds meet. If you suspect a landlord or employer turned you down because of something found on a people-search site, ask them in writing what report they relied on and who supplied it. A company selling reports for screening while saying it is not a consumer reporting agency is exactly what the FTC cases above were about, and you can report it to the FTC or the CFPB. If the decision cost you a job or a home, this is the moment to speak with a lawyer.

A quick test: which side of the line are you on

The one thing to keep: a website's label does not decide whether the law applies; the use does. If any report about you costs you a job, an apartment, a loan or an insurance policy, ask in writing which company produced it and request your free copy. That single request is what sets every other right in motion.