Fair Credit Reporting Act

Tier 1 In force

The outlier in the US federal sectoral layer, and the reason blanket statements about American privacy law being unenforceable by individuals are wrong. Unlike HIPAA, GLBA and COPPA, the FCRA carries a robust private right of action with statutory and punitive damages and fee-shifting — which is why it generates far more litigation than the rest combined. Three separate duty-bearers carry obligations, and permissible purpose is the gatekeeper for every disclosure.

Identity

Citation: 15 U.S.C. 1681 et seq.
Jurisdiction: United States
Type: sectoral
Structure: Duties fall on consumer reporting agencies, on furnishers of information, and on users of consumer reports

← United States overview

Asymmetry checklist

All ten points answered explicitly. "None found — checked" is a recorded answer, not a gap. Checked by Fable on 26 July 2026.

#	Point	Finding	Notes
1	Territorial extent	Asymmetry found	Uniform nationwide application, but the pre-emption architecture is partial and subject-matter specific rather than a clean floor or ceiling. Certain defined subject areas are expressly pre-empted so that states may not legislate at all, while states retain authority over other aspects of credit reporting, and several have active credit-reporting statutes of their own. Determining whether a state provision survives requires working through the specific pre-emption clauses rather than applying a general rule, and this is one of the most litigated features of the Act.
2	Commencement	None found — checked	None found — checked. The Act has been in force since 1970 and has been amended repeatedly, most substantially by the Consumer Credit Reporting Reform Act 1996 and FACTA 2003, all of which are in force. No provision identified in this pass remains phased or pending.
3	Sunset / mandatory review	None found — checked	None found — checked. No expiry, lapse or mandatory statutory review provision.
4	Criminal liability	Asymmetry found	A distinct criminal track exists alongside the civil and supervisory routes, and custody is available. Under 15 U.S.C. 1681q it is an offence knowingly and wilfully to obtain information on a consumer from a consumer reporting agency under false pretences, and under 15 U.S.C. 1681r for an officer or employee of a consumer reporting agency knowingly and wilfully to provide information from an agency's files to an unauthorised person. Both carry imprisonment of up to two years, and both are prosecuted by the Department of Justice rather than by the CFPB or FTC.
5	Civil liability	Asymmetry found	FCRA is the outlier of the four federal sectoral regimes: it carries a robust private right of action and is among the most heavily litigated privacy statutes in the United States. Under 15 U.S.C. 1681n, wilful non-compliance exposes the defendant to actual damages or statutory damages of USD 100 to USD 1,000 per violation, plus punitive damages, costs and reasonable attorney's fees; under 15 U.S.C. 1681o, negligent non-compliance exposes it to actual damages, costs and fees. "Wilful" extends beyond knowing violation to reckless disregard of the statute (Safeco Insurance Co. of America v. Burr), which is why the statutory damages route drives so much class litigation. Claims are brought in federal or state court, independently of any regulator.
6	Regulatory enforcement toolkit	Asymmetry found	Three public enforcers operate alongside the private route: the CFPB, which holds the principal supervisory and rulemaking authority; the FTC; and state attorneys general. The mix of a well-resourced private bar and multiple public enforcers makes the practical enforcement profile quite unlike HIPAA, GLBA or COPPA, where the regulator is the only realistic source of exposure.
7	Personal / director liability	Asymmetry found	Section 1681r is directed specifically at an officer or employee of a consumer reporting agency and exposes that individual to personal criminal liability with custody available, independently of any proceeding against the agency. Section 1681q likewise attaches to the natural person who obtains the information under false pretences.
8	Public vs private sector split	Asymmetry found	The Act imposes materially different obligations on three distinct classes of duty-bearer: consumer reporting agencies, which bear the accuracy, dispute-investigation and disclosure duties; furnishers, which supply information to agencies and bear their own accuracy and reinvestigation duties; and users of consumer reports, which must have a permissible purpose and give adverse action notices. Analysing FCRA without first identifying which class the client falls into produces the wrong answer, and an entity can occupy more than one class at once.
9	Legal-person coverage	None found — checked	None found — checked. The Act protects "consumers", defined as natural persons. Commercial credit reporting on businesses falls outside the regime entirely, which is a frequent source of error where a sole trader's personal and business credit information overlap.
10	Exemptions — with conditions	Asymmetry found	Rather than a schedule of exemptions, FCRA is gated at the front end by the permissible purpose concept: a consumer report may be furnished only for an enumerated purpose such as a credit transaction initiated by the consumer, employment purposes with the consumer's written authorisation, underwriting of insurance, a legitimate business need in connection with a consumer-initiated transaction, or pursuant to a court order. Anything outside the list is unlawful regardless of consent-like arrangements. Scope is further limited by exclusions from the "consumer report" definition, notably reports based solely on transactions or experiences between the consumer and the reporting party, and certain employer investigations of suspected misconduct.

Criminal liability

A distinct track, separate from the regulatory penalties below. The same failure can attract both — a penalty notice against the organisation and a prosecution of the individual.

15 U.S.C. 1681q — Obtaining information under false pretences Custodial available

Knowingly obtaining information on a consumer from a consumer reporting agency under false pretences.

Penalty: Up to 2 years
Imprisonment: Available

15 U.S.C. 1681r — Unauthorised disclosure by an officer or employee Custodial available

Unauthorised disclosure by an officer or employee of a consumer reporting agency.

Penalty: Up to 2 years
Imprisonment: Available

Civil liability

A genuine private right of action, which distinguishes the FCRA from every other instrument in this layer. Wilful non-compliance carries actual or statutory damages, punitive damages, costs and attorney's fees; negligent non-compliance carries actual damages, costs and fees. "Wilful" includes reckless disregard, following Safeco v. Burr — a lower bar than intent, and the reason statutory damages claims are viable.

15 U.S.C. 1681n — wilful non-compliance
Actual or statutory damages of $100 to $1,000, plus punitive damages, costs and fees
15 U.S.C. 1681o — negligent non-compliance
Actual damages, plus costs and fees

Regulatory enforcement

Public enforcement runs alongside private litigation rather than instead of it.

Legal-person coverage

Covers legal persons: No — natural persons only

Consumers are natural persons.

Interactions and conflicts

Pre-emption is partial and unusual: certain subject areas are expressly pre-empted while states retain authority elsewhere. That split is why state credit-reporting statutes continue to matter, and why a pre-emption answer here cannot be assumed from the HIPAA or COPPA model.

Live issues

Sources

Primary Fair Credit Reporting Act, 15 U.S.C. 1681 et seq. US Government Publishing Office no verified URL yet
URL unconfirmed.
Case law Safeco Insurance Co. of America v. Burr, 551 U.S. 47 (2007) no verified URL yet
URL unconfirmed.

Never independently verified — seeded from the prototype.