Permissible Purpose Under the FCRA: When Someone Is Allowed to Pull Your Credit File

What Makes a Report a Consumer Report

The permissible purpose rules only apply to a "consumer report," so that definition is where any question about them starts. 15 U.S.C. 1681a(d)(1) defines it as a communication by a consumer reporting agency of information bearing on a consumer's "credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living" that is used, expected to be used, or collected for the purpose of serving as a factor in establishing eligibility for credit or insurance for personal, family or household purposes, for employment purposes, or for any other purpose authorized under section 1681b.

That definition is unusually wide on its subject matter — "character, general reputation, personal characteristics, or mode of living" is not limited to financial history — and unusually narrow on its source. It is a communication by a consumer reporting agency. A search a company runs itself, using its own records, is not a consumer report, and section 1681a(d)(2)(A)(i) makes that explicit by excluding reports containing information solely about transactions or experiences between the consumer and the person making the report.

The exclusions in paragraph (2) also carve out communications among corporate affiliates in certain circumstances, a credit card issuer's approval of a specific extension of credit, and a person's report of a credit decision back to the third party who asked for it. Paragraph (3) then claws some of that back where the information is medical information or a list based on the consumer's payment transactions for medical products or services.

The Permissible Purpose List

Section 1681b(a) is drafted as a closed set. It says a consumer reporting agency may furnish a consumer report "under the following circumstances and no other," and then lists them. The main entries are:

• A court order, a federal grand jury subpoena, or a subpoena under 31 U.S.C. 5318 or 18 U.S.C. 3486;
• The written instructions of the consumer to whom the report relates;
• A person the agency has reason to believe intends to use the report in connection with a credit transaction involving that consumer — including extending credit, reviewing an account, or collecting on one;
• A person the agency has reason to believe intends to use it for employment purposes, for underwriting insurance, or to determine eligibility for a government license or benefit where the law requires the agency to consider financial responsibility;
• A potential investor, servicer or current insurer valuing or assessing the credit or prepayment risk of an existing credit obligation;
• A person with a "legitimate business need" for the information in connection with a business transaction initiated by the consumer, or to review an account to determine whether the consumer continues to meet its terms;
• State and local child support enforcement agencies, on certification of the statutory conditions, and agencies administering a state plan under 42 U.S.C. 654; and
• The FDIC or the NCUA in connection with its powers over a failed or failing depository institution or credit union.

Two of these do most of the work in practice and are worth reading carefully. The credit and employment entries turn on what the agency "has reason to believe" the recipient intends to do, which places a judgment on the agency rather than a guarantee. And the "legitimate business need" entry in 1681b(a)(3)(F) is narrower than the phrase sounds: it is confined to a transaction the consumer initiated, or to reviewing an existing account. Curiosity about a person who is not a customer is not on the list, and there is no residual catch-all for it.

Written Instructions of the Consumer

Section 1681b(a)(2) makes the consumer's own written instructions a permissible purpose in their own right. This is the entry that supports the enormous volume of report-pulling that happens with a signature attached — tenant screening, volunteer vetting, insurance applications, most background checks — and its breadth is the point of contention around it. The statute sets no boundary on the purpose the consumer may authorize, and no form requirements for the instructions themselves.

The other side of that flexibility is that the strength of the protection depends entirely on the quality of the consent. Where the authorization is genuine and understood, 1681b(a)(2) is the consumer's own decision. Where it is a line inside a long form, the same provision supplies a lawful basis for a disclosure the consumer never registered agreeing to. That is the gap the CFPB tried to legislate into, discussed below.

Employment Purposes and the Extra Steps

Where the purpose is employment, having a permissible purpose is necessary but not sufficient. Section 1681b(b)(1) provides that an agency may furnish a report for employment purposes only if the person obtaining it certifies that it has complied with the disclosure and authorization requirements in paragraph (2), that it will comply with the adverse action requirements in paragraph (3) if they become applicable, and that the information will not be used in violation of any applicable equal employment opportunity law. The agency must also supply a summary of the consumer's rights.

There is a separate limit on medical information at section 1681b(g). An agency may not furnish a report containing medical information for employment purposes or in connection with a credit or insurance transaction unless specified conditions are met — affirmative consent for insurance, or, for employment and credit, that the information is relevant to the transaction and the consumer has given specific written consent describing in clear and conspicuous language the use for which it will be furnished.

Obtaining a Report Without Permissible Purpose

The FCRA does not stop at telling agencies what they may furnish. Section 1681b(f) states that "[a] person shall not use or obtain a consumer report for any purpose unless" the report is obtained for a purpose for which it is authorized to be furnished and that purpose is certified under section 1681e. The prohibition runs to the user, independently of anything the agency did or failed to do.

Section 1681e(a) is the machinery that connects the two. It requires every consumer reporting agency to maintain reasonable procedures to limit furnishing to the purposes listed in section 1681b, and specifies what those procedures must include: prospective users must identify themselves, certify the purposes for which the information is sought, and certify that it will be used for no other purpose. The agency must make a reasonable effort to verify the identity of a new prospective user and the uses certified. And it may not furnish a report to anyone "if it has reasonable grounds for believing that the consumer report will not be used for a purpose listed in section 1681b."

Obtaining a report by lying about the reason is separately a crime. Section 1681q provides that any person who knowingly and wilfully obtains information on a consumer from a consumer reporting agency under false pretenses "shall be fined under title 18, imprisoned for not more than 2 years, or both."

Liability for Users of Reports

The FCRA's civil remedies split by state of mind. Section 1681o covers negligent non-compliance and allows actual damages plus costs and reasonable attorney's fees on a successful action. Section 1681n covers wilful non-compliance and allows actual damages or statutory damages of not less than $100 and not more than $1,000, plus punitive damages as the court may allow, plus costs and fees.

Permissible purpose has its own entry inside that structure. Section 1681n(a)(1)(B) provides that in the case of liability of a natural person for obtaining a consumer report under false pretenses or knowingly without a permissible purpose, the measure is actual damages or $1,000, whichever is greater — a floor rather than a capped range. Section 1681n(b) adds a claim in favor of the agency itself: a person who obtains a report under false pretenses or knowingly without a permissible purpose is liable to the consumer reporting agency for its actual damages or $1,000, whichever is greater.

The CFPB Data Broker Rulemaking

On December 13, 2024 the Consumer Financial Protection Bureau published a proposed rule, Protecting Americans From Harmful Data Broker Practices (Regulation V), aimed squarely at two of the gaps described above. It would have provided that the term "consumer report" includes a consumer reporting agency's communication of personal identifiers collected in whole or in part to prepare consumer reports — the "credit header" data that sits at the top of a file, including names, dates of birth, addresses, Social Security numbers and telephone numbers — so that such data could be sold only to users with a permissible purpose. The proposal recorded the Bureau's view that agencies "currently sell 'credit header' information for purposes that are not permissible purposes under the FCRA."

The proposal's second half addressed written instructions. It would have allowed the 1681b(a)(2) purpose to be used for any reason a consumer specifies, but only where the consumer signs a separate authorization that is not hidden in fine print and that discloses the reason the report is being obtained — a response to consent "buried within lengthy terms and conditions or otherwise presented to the consumer in a manner that interferes with the consumer's ability to make informed decisions."

Neither took effect. After extending the comment period in March 2025, the Bureau published a withdrawal notice effective May 15, 2025, stating that it "has determined that legislative rulemaking is not necessary or appropriate at this time to address the subject matter" and that it "will not take any further action on the NPRM." The stated reasons were that the proposal was in many respects "not aligned with the Bureau's current interpretation of the FCRA, which it is in the process of revising, and its changed policy objectives."

The practical effect is that the statutory text described in this post is the operative law on both questions. Credit header data sold outside a consumer report remains outside the permissible purpose regime as the Bureau described the market, and what qualifies as "written instructions" under 1681b(a)(2) is still governed by the phrase itself rather than by any implementing formality.

Frequently Asked Questions