What the Fair Credit Reporting Act Requires When You Use Credit Reports

If you use credit reports to decide whether a consumer qualifies for credit, insurance, housing, or employment, the Fair Credit Reporting Act (FCRA) applies to you. The FTC frames the obligation in three parts: use the information responsibly, report and handle it accurately, and dispose of it securely. The FTC's site points businesses to FCRA guidance for exactly this scenario — using credit reports to make eligibility decisions about consumers.

Who this applies to

The trigger is not the size of your business but the role you play. You are covered when you:

• Obtain a consumer report (or any information from one) to evaluate eligibility for credit, insurance, a rental, a job, or similar benefits
• Furnish information to a consumer reporting agency, such as reporting a customer's payment history
• Hold or handle consumer report data at any point in its lifecycle

If you only pull a report once and never act on it, you are still handling regulated data. The FTC's guidance is aimed at organizations that make eligibility decisions, so treat the three duties below as a checklist for your process.

The three duties the FTC highlights

Use reports responsibly

Before you request a report, confirm you have a permissible purpose — typically the consumer's application or written authorization. When you take adverse action based on the report (denying credit, raising a deposit, declining a rental), the consumer has a right to know why and to dispute inaccurate information. Build that notice and dispute path into your workflow rather than treating it as an afterthought.

Report and handle information accurately

If you furnish data to a consumer reporting agency, accuracy is your responsibility. Errors you supply can follow a consumer into future eligibility decisions, and disputes must be investigated. Keep records that let you trace what you reported and when.

Dispose of information securely

The FTC's page explicitly includes disposal in its guidance. When reports are no longer needed, destroy them in a way that prevents reconstruction — this is a data-handling obligation, not just a housekeeping preference.

A practical example

A small landlord screens applicants with a credit report and denies one applicant because of a collections item. Under the FCRA framework the FTC describes, the landlord should have a permissible purpose for the pull, tell the applicant about the adverse action and the reporting agency involved, and later dispose of the stored report securely. Skipping the notice step is where many small operators get into trouble.

Where to go on ftc.gov

The FTC's site is the entry point for both compliance guidance and enforcement context:

The site also warns that scammers impersonate the FTC — the agency will never threaten you or demand money transfers. That matters for compliance communications: verify any "FTC" contact through ftc.gov directly.

Common sticking points

• Assuming a one-time pull is exempt. The duty to dispose of data applies whenever you hold it.
• Treating adverse-action notice as optional. It is part of responsible use, not a courtesy.
• Ignoring furnisher accuracy. If you report data, disputes must be handled, not deflected.
• Relying on the homepage alone. The FCRA guidance is linked from the site but sits on its own pages; follow the link rather than skimming the front page.

For the exact statutory language and current requirements, use the FCRA guidance linked on ftc.gov and check enforcement actions for how the rules are being applied in practice.