What Is a Consumer Reporting Agency (and Why People-Search Sites Are Not One for Hiring)
Updated 12 min read
What the FCRA calls a consumer reporting agency
01 Paid
“for monetary fees, dues, or on a cooperative nonprofit basis”
It charges for the work, or runs as a cooperative its members fund.
02 Regular
“regularly engages in whole or in part in the practice of assembling or evaluating”
Gathering or grading information on people is part of its business, not a one-off.
03 For others
“for the purpose of furnishing consumer reports to third parties”
The reports go to someone else, such as an employer.
04 Interstate
“uses any means or facility of interstate commerce”
Mail, phone or the internet. Almost every firm meets this.
A consumer reporting agency (CRA) is the Fair Credit Reporting Act's name for any business that is paid to gather or evaluate information about people and sell it to others. The three credit bureaus are the best known. For an employer, the CRA that matters is the background check company: the firm that searches county courts, verifies past jobs and degrees, pulls a driving record and hands you the result. Under the FCRA, a background check company that sells reports about people to employers is a consumer reporting agency.
“The term ‘consumer reporting agency’ means any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports.”
15 U.S.C. § 1681a(f)
Read the definition for what it does not say. It does not mention credit only (“or other information”), it does not require a license, and it does not care what the company calls itself. A website that sells profiles of people can meet all four parts. Whether it is a CRA turns on what it does, and the FTC has said so in plain words (see why people-search sites are not a hiring tool below).
What the agency sells is a consumer report: information bearing on a person's “credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living” used for, among other things, “employment purposes”. Employment purposes cover hiring, promotion, reassignment and retention, so the rules reach current staff too. And a CRA may only furnish a report to someone it has reason to believe “intends to use the information for employment purposes” or another purpose the statute lists.
What to do
- If an outside company is paid to search records about an applicant and sends you the result, treat it as a CRA and the result as a consumer report.
- Run the employer's FCRA steps for every such report, from the stand-alone disclosure on. The FCRA rules for employers walk through the sequence.
When a background check is a consumer report
The FCRA follows the source, not the content. The same fact (a conviction, a reference, a failed drug test) can arrive as a consumer report or as plain information, depending on who gathered it and handed it over. The FTC and the EEOC put the trigger this way: when you get background information “from a company in the business of compiling background information”, “there are additional procedures the FCRA requires beforehand”.
| Where the information came from | Under the FCRA | Basis |
|---|---|---|
| A screening firm searches courts, past jobs or a DMV and sends you the report | Consumer report | FCRA 1681a(d); FTC/EEOC, 2014 |
| A screening firm phones a former employer and passes on the answer | Consumer report | FTC staff, 603(d)-6F |
| Your own HR staff phone the references the applicant listed | Not a consumer report | FTC staff, 606-2B |
| A drug lab sends the result straight to you | Not a consumer report | FTC staff, 603(d)(2)(A)(i)-1C |
| A screening firm delivers the drug test result | Consumer report | FTC staff letter, June 9, 1998 |
Two rows deserve a second look. When your own people call references, FTC staff say you “do not have to comply with section 606 or other FCRA provisions” for that information, because no agency gathered it. Hand the same calls to a screening firm and they become a consumer report, even by phone or email. Drug results work the same way: straight from the lab they rest on the lab's own experience with the sample, but “when a CRA provides the test results, it is clearly making a ‘consumer report’ to the employer”, in the words of a 1998 FTC staff letter. Our drug testing guide covers the middle case, a third party that only collects and forwards samples.
Once the information is a consumer report, the employer owes the full sequence: a stand-alone written disclosure and written permission before ordering, a certification to the agency, and two notices before and after any decision against the person. The disclosure form builder drafts the first page.
What a consumer reporting agency owes you and the applicant
Being a CRA is not a label; it is a list of jobs. The statute puts most of the hard work of accuracy on the agency, which is why the employer's choice of agency is a compliance choice. Here is that list in the order a check runs.
Know who is asking
Users identify themselves and certify their purpose; the agency makes a reasonable effort to verify a new user.
15 U.S.C. § 1681e(a)
Get your certification
No employment report until you certify the disclosure, the permission and the adverse-action steps.
15 U.S.C. § 1681b(b)(1)
Tell you your duties
A notice of your responsibilities as a user of reports.
15 U.S.C. § 1681e(d)
Maximum possible accuracy
Reasonable procedures to get the facts about the right person right.
15 U.S.C. § 1681e(b)
Respect the time limits
Most negative items older than seven years drop off; convictions have no federal limit; the limits lift for jobs paying $75,000 or more.
15 U.S.C. § 1681c
Court records for jobs
Notify the applicant when it reports adverse public records, or keep strict procedures so the record is complete and up to date.
15 U.S.C. § 1681k(a)
Reinvestigate disputes
Generally within 30 days of the dispute, up to 15 more if the applicant sends new information.
15 U.S.C. § 1681i(a)(1)
A free copy after a rejection
If the person asks within 60 days of receiving your final notice.
15 U.S.C. § 1681j(b)
The accuracy duty is the one that protects your hiring decision. The statute's words are that the agency “shall follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates”. In practice that means matching records to the right person on more than a name, checking that a court case was not later dismissed or sealed, and stating what was searched. A report that mixes up two people with the same name is exactly the failure this duty exists to prevent. Our guide to what shows up on a background check covers the reporting limits search by search, and the lookback checker tests a single record.
The dispute, the free copy and the corrected report all run through the agency. Your pre-adverse notice gives the applicant the copy and the Summary of Rights so they can use them; your final notice names the agency and says it did not make the decision. Both letters are in the adverse action notice guide.
What to do
- Keep the agency's notice of user responsibilities and your signed certification in the hiring file.
- When an applicant says a record is wrong, point them to the agency's dispute process and weigh the outcome before you decide.
- Ask the agency how it matches records to a person and how it checks that a court record is current.
Why people-search sites are not a hiring tool
People-search websites sell instant profiles of almost anyone: addresses, relatives, phone numbers, and what they present as court and arrest records. They are cheap and need no consent form, which is exactly the problem. Sites of this kind often carry a disclaimer that they are not consumer reporting agencies: the FTC pointed to one on a respondent's website in 2014 and to “disclaimers on their websites” in 2023. Read the disclaimer as a warning. A site that says it is not a CRA is telling you it is not doing the jobs the FCRA gives a CRA: no one checking who is asking, no accuracy procedure aimed at your applicant, no dispute process behind the report.
Do not use a people-search website for any hiring, promotion, retention or other employment decision, and do not let a manager look someone up on one “just to check”. Use a consumer reporting agency that runs the FCRA steps with you.
The FTC has gone further than the disclaimers. Where a site marketed its reports for screening workers, the Commission treated it as a CRA whatever its terms said, and charged it with the duties it skipped. Its business blog put the point bluntly after the 2014 case:
“If you walk like a CRA and quack like a CRA, you're a CRA, regardless of an attempt to run from that label.”
Keep FCRA in the foreground when the subject is background screening
| Announced | Respondent named by the FTC | What the FTC said it did | Outcome |
|---|---|---|---|
| June 2012 | Spokeo, Inc. | Sold profiles to HR, screening and recruiting firms as an employment tool | $800,000 civil penalty |
| April 2014 | Instant Checkmate, Inc. | Marketed public-record searches to landlords and employers | $525,000 civil penalty |
| April 2014 | InfoTrack (a screening firm) | Reported possible sex-offender matches that were not the applicant | $1 million, all but $60,000 suspended |
| September 2023 | TruthFinder and Instant Checkmate | Marketed and sold reports for employment and tenant screening | $5.8 million civil penalty (proposed order) |
The charges repeat across the decade: no procedure to confirm a lawful purpose, no reasonable steps toward accuracy, no notice to users of their duties, and, in 2023, a failure “to investigate and respond to consumer complaints about inaccuracies in their reports”. The 2023 release also described marketing emails and push notifications claiming that the subject of a report had a criminal or arrest record “when the record was merely a traffic ticket”. Those are the same duties listed in the section above, and they are the ones an employer depends on most.
The risk does not stay with the website. An employer that pulls a report without the stand-alone disclosure and written permission, or rejects someone without the two notices, is exposed on its own account: a willful FCRA violation can cost $100 to $1,000 per affected person in statutory damages, plus punitive damages and the other side's attorney's fees. A site that never asked you to certify anything has not walked you through any of it.
15 U.S.C. § 1681n(a)
What to do
- Write it into your hiring policy: no people-search sites, no casual searches by managers.
- If one was already used for a decision, stop, order a proper report through a CRA with a fresh disclosure and permission, and decide on that.
- Use a screening firm that asks you to certify your purpose before it sells you anything. That question is a sign the agency is doing its own job.
How to choose a consumer reporting agency that complies
Every legitimate screening firm is a CRA, so the question is not whether to use one but how to tell a careful one from a careless one. Six questions sort them quickly. A careful firm can answer each one in writing.
- 01
Will you ask me to certify my purpose and my FCRA steps before the first report?
A CRA may not furnish an employment report without it.
15 U.S.C. § 1681b(b)(1); 1681e(a)
- 02
Where is your notice of user responsibilities, and which Summary of Rights do you supply?
The agency owes you the notice; the current Summary of Rights is the CFPB's March 2023 version.
15 U.S.C. § 1681e(d); 1681g(c)
- 03
How do you match a court record to my applicant?
Maximum possible accuracy is the agency's duty.
15 U.S.C. § 1681e(b)
- 04
For adverse court records, do you notify the applicant or run strict currency checks?
One of the two is required for employment reports.
15 U.S.C. § 1681k(a)
- 05
How does an applicant dispute a report, and how fast do you answer?
Generally 30 days from the dispute.
15 U.S.C. § 1681i(a)(1)
- 06
Do you build the pre-adverse and final notices into the order flow?
The notices stay your duty; a built-in workflow makes them hard to skip.
15 U.S.C. § 1681b(b)(3); 1681m(a)
One outside signal helps. The Professional Background Screening Association runs a voluntary accreditation program in which an outside auditor checks a firm against PBSA's U.S. Employment Screening Standard, a standard centred on FCRA and Driver's Privacy Protection Act compliance. Accreditation lasts five years, with a surveillance audit in year three. It is not required by law and it does not certify an accuracy rate, but it does mean someone outside the firm read its procedures.
Our PBSA-accredited screeners directory lists 131 firms from PBSA's own list, and the FCRA-compliant background check companies comparison sets the best known of them against the duties above.
What to do
- Send the six questions before you sign, and keep the answers with the contract.
- Prefer a firm that builds the disclosure, permission and both notices into its order flow.
- Check the firm on PBSA's list yourself; accreditation runs in five-year cycles.
Quick reference
- Definition of a CRA
- Paid, regular, for third parties15 U.S.C. § 1681a(f)
- Report from a screening firm
- Consumer report15 U.S.C. § 1681a(d)
- References called by your own staff
- Not a consumer reportFTC staff, 606-2B
- Accuracy standard
- Maximum possible accuracy15 U.S.C. § 1681e(b)
- Notice of your duties
- From the agency15 U.S.C. § 1681e(d)
- Dispute reinvestigation
- 30 days (+15)15 U.S.C. § 1681i(a)(1)
- Free copy after a rejection
- Asked within 60 days15 U.S.C. § 1681j(b)
- Willful violation
- $100 to $1,000 per person15 U.S.C. § 1681n(a)
- People-search sites for hiring
- Do not useFTC actions, 2012 to 2023
Questions employers ask
Is a background check company a consumer reporting agency?
Yes. A company paid to gather information about people and sell reports to employers meets the definition in 15 U.S.C. § 1681a(f), and its reports are consumer reports when used for employment.
Is the employer a consumer reporting agency?
Not for checking its own applicants. The employer is the user of the report. It owes the user's steps: the stand-alone disclosure, written permission, the certification and both adverse-action notices. The FCRA rules for employers list them in order.
Can I use a people-search website to check an applicant?
No. Those sites often disclaim being consumer reporting agencies, so they do not run the accuracy, purpose and dispute steps the FCRA requires, and the FTC has brought cases against sites that sold reports for employment screening anyway. Use a CRA and run the FCRA steps.
Does the FCRA apply to a business with a few employees?
Yes. The FCRA has no headcount floor: its hiring steps apply to any employer that orders a background report, a one-person business included.
Is a Google search of an applicant a consumer report?
Generally not when your own staff run it, since no agency gathered the information; FTC staff reason the same way about reference calls your own people make. It can still surface things you may not lawfully weigh, and nobody owes you an accuracy check on it. If a firm runs internet or social media searches for you, the FTC treats the result as part of employment screening under the FCRA.
What should the applicant do if the report is wrong?
Dispute it with the agency that prepared it. The agency generally has 30 days to reinvestigate. Your pre-adverse notice gives them the copy and the Summary of Rights they need to do it.