15 U.S.C. § 1681 (FCRA): Credit Report Rights Explained

15 U.S.C. § 1681 opens the Fair Credit Reporting Act with Congress's findings on why fair credit reporting matters, but it creates no right for consumers and no duty for credit bureaus on its own. The FCRA's actual rules on background checks, report accuracy, disputes, and damages live in the sections that follow, §§ 1681a through 1681x.

This article treats 15 U.S.C. § 1681 as the entry point into the full federal Fair Credit Reporting Act (FCRA), and walks through the operative sections that a search for "15 usc 1681" or "FCRA" is usually actually looking for: permissible purposes, employment background checks, negative-item time limits, free reports, disputes, and private lawsuits. It does not cover the separate state background-check and credit-reporting statutes layered on top of the FCRA floor; for those, see Background Check Laws by State.

Information last verified against primary federal sources on August 12, 2026. This article has not yet been reviewed by a licensed lawyer.

What 15 U.S.C. § 1681 Actually Says

Section 1681's heading is "Congressional findings and statement of purpose," and the text matches it. The section opens, "The Congress makes the following findings," then explains that the banking system depends on fair and accurate credit reporting, that inaccurate reports undermine the public confidence that system relies on, and that consumer reporting agencies have assumed a vital role in assembling and evaluating consumer credit and other information about consumers.

The section closes by stating the FCRA's purpose: to require that consumer reporting agencies adopt reasonable procedures for meeting the needs of commerce for consumer credit, personnel, insurance, and other information in a manner that is fair and equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization of that information.

That is a mission statement, not a rule. § 1681 does not tell a credit bureau what it can report, does not tell an employer when it can run a background check, and does not give a consumer any specific right to sue. Those all come from the sections that follow.

The FCRA's Operative Framework: What §§ 1681a-1681x Actually Regulate

The Fair Credit Reporting Act is codified at 15 U.S.C. §§ 1681 through 1681x. Each section below handles one piece of the scheme; jump to whichever one matches what actually brought you here.

Who a Credit Bureau Can Share Your Report With

§ 1681a(f) defines a consumer reporting agency as an entity that regularly assembles or evaluates consumer credit or other information, for fees or on a cooperative nonprofit basis, for the purpose of furnishing consumer reports to third parties. § 1681a(d) defines a consumer report as any communication bearing on a consumer's creditworthiness, credit standing, character, or reputation that is used or expected to be used to decide eligibility for credit, insurance, or employment.

§ 1681b limits who a bureau can hand that report to. A CRA may furnish a report only for an enumerated permissible purpose: a court order, the consumer's own written authorization, a credit transaction, employment, insurance underwriting, a government benefit determination, or child support enforcement, among a short list of others. § 1681e(a) adds that a bureau must maintain reasonable procedures requiring prospective users to identify themselves and certify their purpose, must make a reasonable effort to verify the identity of a new prospective user and the uses it certifies before furnishing a report, and may not furnish a report where it has reasonable grounds to believe it will not be used for a permissible purpose.

Running a Background Check on a Job Applicant (§ 1681b(b))

Employment is one of § 1681b's permissible purposes, but it comes with its own two-step process under § 1681b(b) that applies once before an employer can pull a report and again before it can act on one.

Before procuring the report, § 1681b(b)(2)(A) requires the employer give the applicant a clear and conspicuous written disclosure that a consumer report may be obtained, in a document consisting solely of that disclosure, and get the applicant's written authorization.

Before taking adverse action based on the report, such as declining to hire or firing someone, § 1681b(b)(3)(A) requires the employer first give the applicant a copy of the report and a written description of FCRA rights, so the applicant has a chance to review it and dispute anything inaccurate before the decision becomes final. That pre-adverse-action copy is required for applicants generally, including those who apply online, by mail, or by phone. The only exception is narrow: under § 1681b(b)(3)(B) and (C), for a position whose qualifications or hours are set by the Secretary of Transportation under 49 U.S.C. § 31502, or a position subject to safety regulation by a state transportation agency, where the applicant's only contact with the employer has been by mail, phone, computer, or similar means, the employer may instead notify the applicant within 3 business days after the adverse action, including the reporting agency's contact information and notice of the right to a free report copy.

Every state layers its own background-check rules on top of that federal floor, including its own timing and disclosure requirements. See Background Check Laws by State, or a specific state's page such as Louisiana Background Check Laws or Michigan Background Check Laws, for what applies on top of § 1681b(b).

How Long Negative Information Can Legally Stay on Your Report (§ 1681c)

§ 1681c sets time limits on how long a credit bureau can report most negative information. Under § 1681c(a)(2) and (a)(4), collection accounts, charge-offs, civil suits, civil judgments, and arrest records generally drop off after 7 years. For a delinquent account, § 1681c(c) starts that 7-year clock at the end of the 180-day period of delinquency that led to the collection or charge-off, not at the date the account was opened.

Bankruptcies get a longer window: § 1681c(a)(1) allows them to be reported for up to 10 years.

Both limits disappear entirely for two categories of large transactions under § 1681c(b): credit or life-insurance underwriting involving a principal amount of $150,000 or more, and employment at an annual salary reasonably expected to equal $75,000 or more. For those, there is no statutory age cap on what a bureau can report.

Seeing Your Own File, Free Reports, and Security Freezes

§ 1681g gives every consumer the right to request everything in their own file: the information itself, its sources, and who has requested reports on them, a 2-year lookback for employment purposes and 1 year for everything else.

§ 1681j sets out when that disclosure is free. Nationwide CRAs must provide a free § 1681g disclosure once during any 12-month period on request. It is also free within 60 days of an adverse-action notice, for unemployed consumers seeking work, for public-assistance recipients, and for anyone who believes they are a fraud victim. Outside those triggers, a CRA may charge a modest fee, capped by the statute and adjusted periodically for inflation.

In practice, that statutory floor is no longer the ceiling on free access. Equifax, Experian, and TransUnion have permanently extended free weekly online credit reports through AnnualCreditReport.com, a measure that started as a COVID-era accommodation and has since become permanent industry practice layered on top of § 1681j's once-a-year statutory right.

§ 1681c-1 covers security freezes and fraud alerts. Under § 1681c-1(i)(2)(A), a CRA must place a security freeze free of charge, within 1 business day of a phone or electronic request or 3 business days of a mailed request. The same section covers initial fraud alerts lasting 1 year, extended fraud alerts for identity-theft victims lasting 7 years, and active-duty military alerts.

Disputing Inaccurate Information (§ 1681i)

§ 1681i(a)(1)(A) requires a credit bureau to complete its reinvestigation of a disputed item before the end of the 30-day period beginning on the date it receives the dispute. That window can extend by up to 15 more days if the consumer supplies new relevant information during the initial 30 days.

The bureau must also notify the furnisher of the disputed information within 5 business days of getting the dispute, under § 1681i(a)(2)(A), and must give the consumer written results of the reinvestigation within 5 business days of completing it, under § 1681i(a)(6)(A).

When You're Turned Down: Adverse-Action Notices (§ 1681m)

§ 1681m puts duties on the person or company using the report, not the bureau that generated it. When someone takes adverse action based on a consumer report, whether that means denying credit, insurance, or employment, § 1681m requires notice of the adverse action; the name, address, and phone number of the CRA that furnished the report; a statement that the CRA did not make the decision and cannot explain the specific reasons for it; and notice of the consumer's right to a free report copy within 60 days and to dispute inaccurate information.

Private enforcement of § 1681m is less settled than for most FCRA duties. § 1681m(h)(8), added with the risk-based-pricing notice rules, states that §§ 1681n and 1681o "shall not apply to any failure by any person to comply with this section," and that the section is enforced exclusively by federal agencies and officials under § 1681s. Because the text says "this section" rather than "this subsection," courts have divided over whether it bars private lawsuits over all of § 1681m, including ordinary adverse-action notices under § 1681m(a), or only over the risk-based-pricing notices in § 1681m(h). Anyone relying on a private claim for a § 1681m violation should check how courts in their jurisdiction have read it.

Enforcement: Regulators, Private Lawsuits, and How Courts Have Limited Them

Two federal agencies split FCRA enforcement. § 1681s(b)(1)(H) gives the Consumer Financial Protection Bureau primary administrative enforcement authority over most entities the FCRA covers, and § 1681s(e)(1) gives the Bureau general FCRA rulemaking authority, reflecting Dodd-Frank's 2010 shift of that authority away from the FTC. § 1681s(a)(1) still authorizes FTC enforcement, except where enforcement is specifically committed to another agency.

Consumers also have a private right of action. § 1681n(a)(1)(A) covers willful noncompliance: a violator is liable for actual damages, or statutory damages of not less than $100 and not more than $1,000, whichever is greater, plus possible punitive damages at the court's discretion, and attorney's fees and costs for a prevailing consumer. § 1681o covers negligent noncompliance and provides for actual damages only, with no statutory floor, plus fees and costs for a prevailing consumer.

That right of action is narrower than the bare text suggests. In Spokeo, Inc. v. Robins, 578 U.S. 330 (2016), the Supreme Court held that a plaintiff cannot satisfy Article III's injury-in-fact requirement by alleging only a bare procedural violation, divorced from any concrete harm, such as the dissemination of a merely incorrect zip code. The Court sharpened that line in TransUnion LLC v. Ramirez, 594 U.S. 413 (2021): of a certified class whose files were falsely flagged with a potential-terrorist alert, only the members whose reports were actually sent to a third-party business had suffered a concrete reputational harm sufficient for standing. Class members whose inaccurate file was never disclosed to anyone had no standing to recover damages, even though the underlying FCRA violation was real.

Timing matters too. In TRW Inc. v. Andrews, 534 U.S. 19 (2001), the Court held that the FCRA's statute of limitations does not carry a general discovery rule; the statute expressly delineates the one narrow circumstance, willful misrepresentation, in which the clock starts on discovery rather than on the violation itself, and courts cannot expand that exception into a general rule for every FCRA claim.

For a live example of federal enforcement in this space, see FTC Fines Amazon $2.25 Million for Denying Identity-Theft Victims Their Fraud Records Under the FCRA.

Does the FCRA Override State Background-Check and Credit-Reporting Laws?

No, not broadly. § 1681t(a) states that the FCRA does not generally override state laws on consumer information unless they directly conflict with it. § 1681t(b) preempts state law only on a specific enumerated list of topics: prescreening under § 1681b, dispute timelines under § 1681i, adverse-action notices under § 1681m, report-content restrictions under § 1681c, furnisher duties under § 1681s-2, and security freezes under § 1681c-1, with grandfather carve-outs preserving some state laws that predate September 30, 1996.

Outside that list, most state consumer-reporting and background-check protections coexist with the FCRA as a floor, not a ceiling. A state can generally add stronger protections than § 1681b(b) requires; it just cannot weaken the specific federal rules on the preempted list. See Background Check Laws by State for how that plays out state by state.

What Changed in 2025: Mortgage Trigger Leads

The Homebuyers Privacy Protection Act, signed September 5, 2025 as Public Law 119-36, amends § 1681b(c) to add a new paragraph (4) governing "prescreened" or "trigger lead" reports tied to mortgage shopping. Under the amendment, if someone requests a report in connection with a residential mortgage loan credit transaction, the credit bureau may not furnish a prescreened consumer report to another party based on that request unless the transaction is a firm offer of credit or insurance, and the recipient either has the consumer's authorization, already originated or services the consumer's current mortgage, or is a depository institution or credit union holding the consumer's current account.

The law takes effect 180 days after enactment, which places its effective date at March 4, 2026. It also requires a GAO study, due within 12 months of enactment, on trigger leads delivered by text message. For most consumers, the practical effect is fewer unsolicited calls and offers immediately after applying for a mortgage.

Common Misconceptions About 15 U.S.C. § 1681 and the FCRA

"15 U.S.C. § 1681" is the Fair Credit Reporting Act. It is only the findings and purpose section. The operative law that actually regulates credit reporting spans §§ 1681a through 1681x.

The FCRA fully overrides state background-check and credit-reporting laws. § 1681t preempts state law only on a specific enumerated list of topics. Most state consumer-reporting protections coexist with the FCRA as a floor, not a ceiling.

You only get one free credit report a year, period. That is the statutory floor under § 1681j. Equifax, Experian, and TransUnion now permanently offer free weekly reports through AnnualCreditReport.com on top of it.

An employer can pull your credit report or background check without telling you. § 1681b(b)(2)(A) requires a clear written disclosure and your written authorization before an employer can procure a report, and § 1681b(b)(3)(A) requires giving you a copy of the report and a summary of FCRA rights before taking adverse action on it.

A technical FCRA violation is automatically worth $100 to $1,000 in court. Spokeo and TransUnion hold that a bare procedural violation with no concrete harm does not give a plaintiff standing to sue in federal court, and the § 1681n statutory-damages range only applies to willful, not merely negligent, violations.

Every part of § 1681m can be privately enforced. § 1681m(h)(8) states that the FCRA's damages provisions do not apply to failures to comply with "this section" and assigns enforcement to federal agencies under § 1681s. Courts have divided over whether that bars private suits over all of § 1681m or only the risk-based-pricing notices in § 1681m(h).

Negative items always fall off after exactly 7 years, no exceptions. Bankruptcies get 10 years under § 1681c(a)(1), and the age cap disappears entirely for large transactions: $150,000-plus credit or life-insurance underwriting, or a job paying $75,000 or more a year, under § 1681c(b).

Any company that collects or sells data about me is bound by the FCRA. Data brokers that sell contact or location information generally fall outside § 1681a(f)'s consumer-reporting-agency definition unless they are actually assembling information for the purpose of furnishing consumer reports. See How to Opt Out of Data Brokers for that separate problem, and Employee Data Privacy: Employer Obligations by State for how FCRA employment rules interact with broader state privacy law.

Disclaimer

This article provides general information about 15 U.S.C. § 1681 and the federal Fair Credit Reporting Act, as in effect and verified against primary federal sources on the date noted above. It is not legal advice and does not create an attorney-client relationship. State background-check and credit-reporting laws add further requirements on top of the federal floor described here, and statutory dollar figures such as free-disclosure fee caps are periodically adjusted for inflation. Confirm current details with the Consumer Financial Protection Bureau, the Federal Trade Commission, or a licensed attorney before relying on anything here for a specific situation.

---

Last updated: August 12, 2026.

Frequently Asked Questions

What is 15 U.S.C. § 1681, and is it the whole Fair Credit Reporting Act?

No. Section 1681 is only the FCRA's findings and purpose section; it grants no consumer right and imposes no credit bureau duty on its own. The operative FCRA rules, covering permissible purposes, background checks, disputes, and damages, are codified at §§ 1681a through 1681x.

What does the Fair Credit Reporting Act actually regulate?

The FCRA regulates consumer reporting agencies and the people who use their reports. It controls who can pull a report and why under § 1681b, how long negative information can stay on a report under § 1681c, a consumer's right to see and dispute their own file under §§ 1681g and 1681i, and the notice and damages rules that apply when a report is used to deny credit, insurance, or a job under §§ 1681m, 1681n, and 1681o.

How long can negative information legally stay on my credit report?

Most collections, charge-offs, civil judgments, and arrest records fall off after 7 years under § 1681c(a). Bankruptcies can stay for 10 years. Both limits disappear entirely for credit or life-insurance transactions of $150,000 or more, or for employment paying $75,000 or more a year, under § 1681c(b).

Can an employer run a background check on me without my permission?

No. Under § 1681b(b)(2)(A), an employer must give you a clear written disclosure and get your written authorization before procuring a background check for employment purposes, and under § 1681b(b)(3)(A) it must give you a copy of the report and a summary of your FCRA rights before taking adverse action based on it.

How many free credit reports am I entitled to each year?

The statutory floor under § 1681j is one free disclosure every 12 months from each nationwide credit bureau, plus additional free disclosures after an adverse-action notice or for unemployed and public-assistance consumers. In practice, Equifax, Experian, and TransUnion now permanently offer free weekly online reports through AnnualCreditReport.com on top of that floor.

What can I do if a company violates the FCRA?

Start by disputing the inaccurate information with the credit bureau under § 1681i, which generally has 30 days to investigate. If a company willfully or negligently violates the FCRA and you suffered concrete harm as a result, §§ 1681n and 1681o allow a private lawsuit for damages and, if you prevail, attorney's fees and costs.

Do I have to prove I was actually harmed to sue under the FCRA?

Yes. In Spokeo, Inc. v. Robins and TransUnion LLC v. Ramirez, the Supreme Court held that a bare procedural violation of the FCRA, without a concrete, real-world harm, does not give a plaintiff Article III standing to sue in federal court.

What is the difference between a willful and a negligent FCRA violation?

Under § 1681n, a willful violation allows actual damages or statutory damages of $100 to $1,000, whichever is greater, plus possible punitive damages. Under § 1681o, a negligent violation allows only actual damages, with no statutory floor. Both allow attorney's fees and costs for a prevailing consumer.

What is a security freeze, and does it cost anything?

A security freeze restricts access to your credit file so most lenders cannot see it, which helps prevent new accounts from being opened in your name. Under § 1681c-1(i)(2)(A), a credit bureau must place, lift, or remove a freeze free of charge, generally within 1 business day of an electronic or phone request.

How long does a credit bureau have to investigate a dispute?

Generally 30 days from receiving the dispute under § 1681i(a)(1)(A), extendable by up to 15 more days if you supply new relevant information during that initial window.

Does the FCRA override my state's background-check or credit-reporting laws?

No, not broadly. § 1681t preempts state law only on a specific enumerated list of topics, such as prescreening, dispute timelines, and security freezes. Most other state consumer-reporting and background-check protections coexist with the FCRA as an added floor.

What changed under the 2025 Homebuyers Privacy Protection Act (mortgage trigger leads)?

Signed September 5, 2025 as Public Law 119-36 and effective March 4, 2026, it amends § 1681b(c) so a credit bureau generally cannot sell a prescreened trigger lead list based on a mortgage-related credit pull unless the offer is a firm offer of credit and the recipient already has a relationship with the consumer or the consumer's authorization.