Compliance · 13 min read

What is a consumer reporting agency

It gets used as a synonym for background check company. It is not one. It is a definition with five elements, and which side of it you fall on decides every duty in the statute.

The term everybody uses loosely

In the industry the phrase is a job title. People say consumer reporting agency the way they say background check company, meaning a vendor that runs checks and sends back a report. Nothing turns on it in conversation.

In the statute it is a definition, and it is the hinge the whole Act swings on. If you are one, a long list of duties attaches to you that would not otherwise apply. If you are not, those duties do not attach to you at all, and the parties who thought you were carrying them are exposed. That is why the definition is worth reading properly rather than nodding at.

The definition, element by element

§1681a(f) defines a consumer reporting agency as any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports.

That is one sentence with five moving parts and no surplus. Taking them in turn:

• Any person. Defined broadly enough in §1681a(b) to include corporations, partnerships and associations. There is no size threshold and no registration.
• For monetary fees, dues, or on a cooperative nonprofit basis. There has to be some commercial arrangement, but a nonprofit qualifies, and the arrangement does not have to be with the person the report is about.
• Regularly engages in whole or in part. The two most consequential words in the definition, dealt with below.
• In assembling or evaluating. Not just storing. Putting information together, or drawing a conclusion from it, both count.
• For the purpose of furnishing consumer reports to third parties. The destination is what matters. Information gathered and kept for your own use is not the same as information gathered to be passed on.

What the label switches on

This is why the definition matters and not just to lawyers. Every core duty in the statute is addressed to a consumer reporting agency, and none of them apply if you are not one:

• Permissible purpose. §1681b restricts who you may furnish a report to, and requires you to have reason to believe the recipient has a purpose the statute allows.
• Accuracy. §1681e(b) requires reasonable procedures to assure maximum possible accuracy. A reasonableness standard, which means it is answered by your process rather than by whether you got a particular record right.
• File disclosure. §1681g requires you to tell a consumer what is in their file, and to do it on request.
• Disputes. §1681i requires a reinvestigation, with a statutory timetable, and the consumer's dispute runs to you rather than to the employer.
• Public records. §1681k imposes either a notice or strict procedures for completeness and currency when public record information is reported for employment purposes.

There is also the liability, which is not a duty but is the reason the rest of it matters. §1681n and §1681o give a private right of action, willful violations carry statutory damages of $100 to $1,000 per consumer without proof of harm, and attorney's fees follow.

The duties the employer carries under §1681b(b)(2) and (b)(3) sit on the other side of the transaction and are set out in the FCRA article and, for the two notices themselves, the adverse action article. What matters here is that the two sets of duties belong to two different parties, and which party you are depends on this definition.

Who is not a consumer reporting agency

The statute does not carve out much, but the exclusions that exist are real. Almost all of them work through §1681a(d)(2), by excluding certain communications from the definition of “consumer report”. Since the agency definition is built on furnishing consumer reports, removing the report removes the agency.

A first party account of its own experience

The clearest exclusion covers a report containing information solely about transactions or experiences between the consumer and the person making the report. If a bank tells a landlord about its own history with a customer, or a former employer answers a reference request about a person it employed, that is a first party account and it is not a consumer report.

The word to hold onto is solely. The exclusion covers the writer's own experience and nothing else. A reference that adds information from somewhere else leaves the exclusion, and a business that supplements its own account with third party data is not sheltering behind it.

Alongside it sit the two credit-specific exclusions: an approval or authorization of a specific credit extension by a card issuer, and a communication where someone asked by a third party to extend credit conveys their decision, provided the consumer is told who asked and gets the §1681m disclosures. Both are narrow by design.

Employment procurement, and employee investigations

There are two further exclusions built for employment, and both are narrower than their names suggest. §1681a(o) covers a communication made to procure an employee or a work opportunity for a consumer, made by a person who regularly performs that kind of procurement, used for no other purpose, with the consumer's consent to the scope of inquiry and to the transmission, and with limits on equal employment opportunity inquiries.

§1681a(y) covers a communication made to an employer investigating suspected misconduct relating to employment, or compliance with law or the employer's own written policies, where the investigation is not about creditworthiness, the results go only to the employer, its agent, a government body, a self-regulatory organization or as the law requires, and the employer gives the employee a summary of the nature and substance after it acts.

Both of those belong to the case where a recruitment or investigation business sits between the employer and the worker, and the contractor and staffing articleworks through when they apply and where they stop. For this page the point is only that they are specific, conditioned, and easy to fall outside of.

The two words that catch businesses by surprise

Two phrases in the definition do the real work, and both are easy to skim past.

“Regularly engages” does not mean that assembling reports is your business. It means you do it as part of your business with some regularity rather than once. A one-off favor is not a business. A recurring practice is, even if the practice is a small part of what you do and earns you nothing directly.

“In whole or in part” is the one that reaches furthest. It means a business can be a consumer reporting agency for one activity while being something else entirely for the rest of its operations. The consequence is not that the whole company becomes regulated as a screening business. It is that the duties attach to the activity, and a business that never thought about the FCRA has been carrying those duties the whole time.

Put the two together and the pattern is easy to see. A staffing firm that runs checks on candidates and passes the results to client employers. A software platform that aggregates public records and sells access. A tenant screening service attached to a property management product. A marketplace that adds a background check feature. None of them would describe themselves as a consumer reporting agency. The question is not what they call themselves but whether the five elements are satisfied.

You cannot disclaim your way out of it

The most useful enforcement example is also the most on point, and it is now old enough that people have stopped citing it.

In June 2012 the FTC announced that Spokeo, a data broker that compiled profiles on millions of people from online and offline sources, had agreed to pay $800,000 to settle charges that it marketed those profiles to employers and recruiters in violation of the FCRA. It was the Commission's first action about internet and social media data used in employment screening.

The allegations are worth reading as a list, because they are the duties above arriving in order. The Commission alleged that Spokeo failed to maintain reasonable procedures to verify that its users had a permissible purpose, failed to maintain reasonable procedures to assure maximum possible accuracy, and failed to tell the people buying its reports what their own FCRA obligations were, including the adverse action duty. It also alleged a separate deception under the FTC Act over endorsements that appeared to come from independent users and had in fact been written by Spokeo's own employees.

The detail that matters most for this page is what Spokeo had done about it beforehand. The company had rewritten its own terms of service to state that it was not a consumer reporting agency, and the Commission's position was that this did not matter, including on the reasoning that the company had not revoked access for the customers who were still using the data for screening purposes. Seventeen years of case law later, the position is not seriously contested: the status follows from the conduct, and a clause in a contract is not conduct.

There is a curiosity attached. The same company appears in the standing decision everybody in this field knows, Spokeo v. Robins, where the Supreme Court held that a bare procedural violation of the FCRA does not automatically establish an injury in fact. It is the same Spokeo, and the two cases together tell you most of what you need to know about how this statute is enforced.

Where the question is live now

The definition has not changed. The facts it is applied to have changed a great deal, and there are three places where the answer is genuinely unsettled in a way that matters commercially.

People search and data broker products. The Spokeo case settled that a data broker can be a consumer reporting agency. The open question is which ones, and it turns on how the product is marketed and who buys it. A site sold to consumers for finding old classmates is not the same product as the same data sold to recruiters, even if the underlying records are identical. Marketing and customer base are evidence of purpose, which is why the URL, the advertising keywords and the onboarding questions all became exhibits.

Social media and open source screening. A vendor that reads public posts and produces a characterization of an applicant is assembling and evaluating information on a consumer for furnishing to a third party. That is the definition, and the fact that the information is public is not an element of it. Publicness affects what may lawfully be reported and how accurate it can be, not whether the reporter is an agency.

Automated and algorithmic screening tools. This is the newest version of the question and the least settled. A tool that scores or ranks applicants is evaluating information on consumers. Whether it is furnishing consumer reports depends on what it outputs and who receives it. A tool that produces a recommendation for the employer is a different thing from a tool that produces data a human then interprets, and the line between them is being drawn now rather than having been drawn.

What this means for an employer

Two practical consequences, and they point in opposite directions.

The first is that you cannot delegate the duties that are yours by choosing a vendor and trusting it. The disclosure and authorization duty under §1681b(b)(2) is the employer's, and so is the notice sequence. A vendor being a consumer reporting agency does not move those to the vendor, whatever the contract says.

The second is that you should care whether your vendor is one, because if it is not, the duties that were supposed to sit on that side of the transaction are sitting on nobody. Nobody is maintaining dispute procedures, nobody owes the applicant a file disclosure, and the accuracy standard is not being applied by anyone. The employer still carries its own notices, and a great deal of what the process assumed would be handled is simply absent.

That is the whole reason the definition is worth a page. It is not a classification exercise. It is how you work out which party is holding which end of the obligation.

What we do

We are a consumer reporting agency under this definition and we do not treat that as a marketing label. It means we run dispute procedures with the statutory timetable attached, we give consumers their file on request, we maintain written accuracy procedures and can describe them, and we apply the public record requirements in §1681k rather than presenting a raw database result as a verified record.

It also means the split of duties on this page is the split we operate under. The notices to the applicant are yours as the employer, and we build the reports and the dispute handling that sit behind them.

Sources

• 15 U.S.C. §1681a(f) (definition of consumer reporting agency)
• 15 U.S.C. §1681a(d) (definition of consumer report, and the exclusions)
• 15 U.S.C. §1681a(o) (excluded communications, employment procurement)
• 15 U.S.C. §1681a(y) (exclusion of certain communications for employee investigations)
• 15 U.S.C. §1681b (permissible purposes)
• 15 U.S.C. §1681e(b) (reasonable procedures to assure maximum possible accuracy)
• 15 U.S.C. §1681g (disclosures to consumers)
• 15 U.S.C. §1681i (procedure in case of disputed accuracy)
• 15 U.S.C. §1681k (public record information for employment purposes)
• 15 U.S.C. §1681n and §1681o (civil liability)
• FTC, Spokeo to pay $800,000 to settle FTC charges, 12 June 2012
• Spokeo, Inc. v. Robins, 578 U.S. 330 (2016)

Last reviewed 2026-09-27. Nothing here is legal advice; see the terms of use.