Your Privacy Rights
What the FCRA Means for Background Checks
The short version
A background check only counts as a legal "consumer report" when it comes from a consumer reporting agency, and that label decides everything. FCRA-regulated screeners must get your written consent, warn you before a rejection, and fix errors you dispute. People-search sites like TruthFinder disclaim the FCRA, so none of those rights apply there - but their reports also cannot lawfully be used to screen you for a job or housing. Knowing which side of the line a company sits on tells you whether your move is a dispute or an opt-out.
What the FCRA actually is
The Fair Credit Reporting Act (FCRA) is the 1970 federal law that governs companies which compile and sell reports about people: the credit bureaus, but also the firms that run employment and tenant background checks. When it applies, you get enforceable rights - consent, notice, disputes, damages. When it does not, you get almost none of them.
Congress passed the FCRA in 1970, making it one of the oldest data-privacy laws in the world, and it now sits at Title 15, Section 1681 of the US Code. Two agencies police it: the Federal Trade Commission brings enforcement cases, and the Consumer Financial Protection Bureau writes the rules and takes consumer complaints.
That single question - does the FCRA cover this report? - is the quiet hinge of the entire background-check industry. It is why some companies proudly call themselves consumer reporting agencies, while others put "we are not a consumer reporting agency" in bold at the bottom of every page.
What counts as a "consumer report"
A consumer report is information from a consumer reporting agency bearing on your creditworthiness, character, general reputation, personal characteristics, or mode of living, used to decide your eligibility for credit, insurance, or employment. A consumer reporting agency (CRA) is any company that regularly assembles that information for money. The definitions turn on how the data is used, not on what the company calls itself.
The law then restricts who may pull a report. A CRA can only release one for a "permissible purpose": a credit application, insurance underwriting, employment screening with your consent, a court order, a government license, or your own written instructions. The CFPB's official summary of FCRA rights spells out who that covers in practice - a creditor, insurer, employer, landlord, or other business with a legitimate need.
Your rights when the FCRA applies
If a background check is FCRA-regulated, you must consent before it happens, be warned before it is used against you, and be able to fix it when it is wrong. These are not courtesies - they are legal obligations on the employer and the screening company, with damages attached when they are ignored.
- Written permission first. An employer must give you a clear written disclosure and get your written authorization before ordering a report (Section 604(b) of the Act).
- A warning before rejection. Before taking adverse action based on a report, the employer has to give you a copy of it plus a written summary of your rights, so you have a chance to respond.
- An adverse action notice. If you are turned down for a job, apartment, loan, or policy because of a report, you must be told, and given the name, address, and phone number of the agency that supplied it.
- A free look at your file. After any adverse action, you are entitled to a free file disclosure from that agency.
- The right to dispute. Inaccurate, incomplete, or unverifiable information must be corrected or deleted, usually within 30 days of your dispute.
How far back a background check can legally go
Under the FCRA, most negative information ages out of a consumer report after seven years, and bankruptcies after ten. Arrest records fall under the seven-year limit, but criminal convictions can be reported indefinitely under federal law. Some states layer stricter limits on top of these federal floors.
There is a catch worth knowing: the time limits vanish for bigger transactions. The seven-year clock does not apply to a job with an expected annual salary of $75,000 or more, a credit transaction of $150,000 or more, or a life-insurance policy at that same level. For senior roles, the lookback is effectively unlimited.
The sites that say the FCRA does not apply to them
People-search sites sell background reports to anyone with a credit card, yet nearly all of them disclaim the FCRA entirely. Spokeo's own site says it "is not a consumer reporting agency" and tells visitors not to use it for decisions about "credit, employment, tenant screening, or any purpose covered by the FCRA."
TruthFinder and Instant Checkmate carry the same kind of language in their terms of use. The disclaimer is not a technicality - it is the business model. By declaring themselves outside the FCRA, these sites avoid every duty the law imposes: no accuracy standard, no permissible-purpose checks, no consent requirement, no dispute process, and no free file. Our broker pages on TruthFinder and Instant Checkmate cover what each one publishes about you and how removal works.
When the disclaimer did not save them
A "we are not a consumer reporting agency" banner only works if the company actually stays out of the consumer-reporting business. The FTC has repeatedly penalized people-search sites that marketed their reports for employment or tenant screening while disclaiming the very law that governs those uses.
| Company | Year | Penalty | What the FTC alleged |
|---|---|---|---|
| Spokeo | 2012 | $800,000 | Marketed profiles to recruiters and HR as an employment screening tool without FCRA safeguards |
| MyLife | 2021 | $21 million | Teaser background reports implied criminal records that did not exist; alleged FCRA and billing violations |
| TruthFinder + Instant Checkmate | 2023 | $5.8 million | Operated as consumer reporting agencies while deceiving users about report accuracy |
Source: Federal Trade Commission press releases, June 2012, December 2021, and September 2023.
The pattern matters to you in two ways. First, the disclaimer on a people-search site is legally real: a report from one cannot lawfully be used to vet you for a job or an apartment. Second, if you suspect an employer or landlord actually did use one, that is a potential FCRA violation worth reporting to the FTC or CFPB.
Why the distinction decides your rights
Whether a company sits inside or outside the FCRA determines almost everything you can do about it. Regulated agencies owe you accuracy, consent, disclosure, and a dispute process. Unregulated people-search sites owe you nothing beyond their own privacy policy - your main lever against them is the opt-out.
On the regulated side, the CFPB maintains a public list of consumer reporting companies - roughly 64 of them as of its January 2025 update, spanning the three credit bureaus, employment screeners such as Checkr, tenant screeners, and specialty bureaus - and most will give you a free copy of your file on request. Sterling, HireRight, and First Advantage appear on the same list.
On the unregulated side, removal is the game. RedactZero keeps free, dated opt-out guides for the major people-search sites, plus a directory covering the credit and risk agencies that do fall under the FCRA, where the process is usually suppression or a security freeze rather than deletion.
What to do with all of this
Three moves cover most of the ground: pull your free credit reports, request your file from the specialty agencies that actually screen you, and remove yourself from the people-search sites that anyone can browse. None of it costs money, and each step closes a different kind of exposure.
Start at AnnualCreditReport.com, the only federally authorized source for your Equifax, Experian, and TransUnion reports - the FTC announced in 2023 that free weekly access is now permanent. Then check the CFPB's company list for the screeners relevant to your life, such as tenant screening if you rent or employment screening if you are job hunting.
Do not wait for Washington to redraw the line, either. In December 2024 the CFPB proposed a rule that would have treated many data brokers as consumer reporting agencies - and withdrew it in May 2025. For now, the FCRA covers what it covers, and the people-search world remains yours to manage. A free exposure scan shows which brokers likely list you, and nothing you type is stored.
Know what a search of you turns up
Run a free exposure scan to see which people-search sites and data brokers likely list you, plus any breaches tied to your email - no account, nothing stored.
Frequently asked questions
Can an employer legally use a people-search site to screen me?
No. Sites like TruthFinder and Spokeo state in their own terms that they are not consumer reporting agencies and that their results may not be used for employment, tenant, or credit decisions. An employer who wants a background check must use an FCRA-regulated screening company and get your written permission first.
Do employers need my permission to run a background check?
Yes. Under the FCRA, an employer must give you a clear, standalone written disclosure and get your written authorization before ordering a background check from a consumer reporting agency. Without that consent, the screening company is not allowed to hand over your report.
How far back can a background check go?
For most jobs, arrest records and other negative items can be reported for seven years, and bankruptcies for ten. Criminal convictions can be reported indefinitely under federal law. The seven-year limits do not apply to jobs expected to pay $75,000 or more a year, and some state laws are stricter.
What is an adverse action notice?
If an employer, landlord, insurer, or lender turns you down based on a consumer report, they must tell you and give you the name, address, and phone number of the agency that supplied the report. You are then entitled to a free copy of your file from that agency.
How do I dispute an error in a background check?
Dispute it in writing with the consumer reporting agency that issued the report. The agency must investigate, and information that is inaccurate, incomplete, or unverifiable must usually be corrected or deleted within 30 days. This right only exists because the FCRA applies - people-search sites offer no equivalent.
Are people-search sites covered by the FCRA?
They say no. Spokeo, TruthFinder, Instant Checkmate, and similar sites disclaim being consumer reporting agencies, which frees them from the law's accuracy, consent, and dispute rules. But the FTC has fined people-search companies whose marketing crossed into employment or tenant screening, so the disclaimer only holds while a site genuinely stays out of FCRA territory.
How do I get a free copy of my background check file?
The CFPB publishes a list of consumer reporting companies, including employment and tenant screening firms, and most will give you a free copy of your file on request. For your credit reports, AnnualCreditReport.com is the only federally authorized source, with free weekly access to all three bureaus.
Can I sue over an FCRA violation?
Yes. For willful violations, the law allows actual damages or statutory damages of $100 to $1,000 per violation, plus punitive damages, costs, and attorney's fees. In practice, most consumers start with a written dispute and a complaint to the CFPB or FTC before considering court.
Sources: 15 U.S.C. 1681 et seq. via the Cornell Legal Information Institute; the CFPB's "A Summary of Your Rights Under the Fair Credit Reporting Act" and its list of consumer reporting companies (January 2025 update); FTC press releases on Spokeo (June 2012), MyLife (December 2021), and TruthFinder / Instant Checkmate (September 2023); the Federal Register withdrawal notice for "Protecting Americans From Harmful Data Broker Practices" (May 15, 2025); Spokeo's published FCRA disclaimer.