What Are Consumer Reporting Agencies and Your Rights?

Consumer reporting agencies are companies that collect information about your financial and personal history and sell it to businesses deciding whether to give you credit, insurance, a job, or a place to live. The three you’ve probably heard of are Equifax, Experian, and TransUnion, but dozens of specialty agencies track narrower slices of your life, from checking account history to rental payments to prescription records. Federal law gives you real leverage over these companies: the right to see your file, correct what’s wrong, block access to it, and sue when the rules are broken.

What a Consumer Reporting Agency Is

Under the Fair Credit Reporting Act, a consumer reporting agency is any entity that regularly assembles or evaluates information about consumers and sells reports to third parties.¹ These agencies sit between the companies you already do business with and the ones deciding whether to start.

The cycle is simple. Banks, card issuers, and other creditors send data about your accounts to one or more agencies each month: balances, credit limits, payment history, whether anything has gone to collections. Agencies also pull public records like bankruptcy filings. All of it is compiled into a file tied to your name, Social Security number, and address. When a lender, insurer, landlord, or employer wants to evaluate you, they buy a copy.

Not every bill you pay ends up in that file. Most utility and telecom companies don’t report your on-time payments to the three major bureaus, so ten years of reliable electric payments probably isn’t lifting your credit. Miss enough of them, though, and the collections account almost certainly shows up.²

Who Can Look at Your Report

Nobody can pull your report because they feel like it. Federal law requires a “permissible purpose,” which covers things like evaluating you for credit, underwriting insurance, screening you for employment, or reviewing an account you already have.³ Curiosity, personal disputes, and marketing to strangers don’t qualify.

The Three Nationwide Bureaus and the Specialty Agencies

Equifax, Experian, and TransUnion focus on traditional credit: cards, mortgages, auto loans, student loans, and the like. Most lenders report to all three, but not always, which is why your reports from each can differ.

Beyond these three sits a much larger ecosystem. The CFPB publishes a list of companies that have identified themselves as consumer reporting agencies, grouped into categories including check and bank account screening, employment screening, tenant screening, medical records, personal property insurance, retail, and utilities.⁴ A few worth knowing:

ChexSystems tracks checking account applications, openings, closures, and check-writing history. Banks review it when you apply for a new account, and a negative record can get you denied.⁵
Tenant screening companies compile eviction records, rental payment history, and sometimes criminal background information for landlords.
Medical information bureaus maintain records on health and prescription history, typically used by life and health insurers during underwriting.
The National Consumer Telecom & Utilities Exchange tracks utility payment history among its members, who use it to decide whether to require a deposit for new service.

Your financial footprint isn’t sitting in three files. It’s spread across many, and errors in any of them can affect real decisions. You have the same rights to access and dispute information at a specialty agency as at the big three.

What’s in Your File

A standard credit report is organized into four categories:

Personal identification: legal name, current and former addresses, Social Security number, date of birth.
Account history: every open and closed credit account, with balances, limits, and a month-by-month record of on-time payments and any 30-, 60-, or 90-day delinquencies.
Public records: bankruptcy filings can stay on your report for up to ten years; other negative public records like civil judgments generally fall off after seven.⁶
Inquiries: a log of who has requested your report. Hard inquiries from credit applications can affect your score and stay for two years. Soft inquiries from pre-approved offers or your own checks are visible only to you.

Two categories of debt are in flux. The three major bureaus voluntarily stopped reporting medical debt under $500 starting in spring 2023, and that change remains in place. A broader CFPB rule that would have removed nearly all medical debt from credit reports was vacated by a federal court in July 2025. Several states have their own restrictions, some taking effect in 2025 and 2026, so what shows up depends partly on where you live.⁷

Buy now, pay later loans are being added inconsistently. TransUnion and Experian keep BNPL data in a separate section that doesn’t feed the core credit score. Equifax lets the BNPL provider choose whether the loan appears as a traditional account that does affect scoring. Reporting frequency varies too, with some bureaus moving toward biweekly updates. If you use these services regularly, check how they appear on each bureau’s report.

How to Get Your Reports

You can pull your credit report from each of the three major bureaus once per week for free through AnnualCreditReport.com. Equifax is offering six additional free reports per year through 2026 via the same site.⁸ That’s a large upgrade from the old one-per-year rule, and there’s no reason not to use it.

Requesting online is easiest: answer a set of identity verification questions and download the report. You can also request by phone or mail; a mailed request must be fulfilled within 15 days.⁹

Specialty agencies work differently. Each has its own request process, and the CFPB’s list of consumer reporting companies includes contact information for each one.⁴ Specialty agencies are also required to give you one free report per year on request.

Your Rights Under the FCRA

The Fair Credit Reporting Act is the federal law that governs these companies, and it gives you concrete protections. On request, every agency must clearly disclose all information in your file.¹⁰ Beyond access, you have the right to:

Expect the information in your file to be accurate, with reasonable procedures in place to keep it that way.
Dispute anything you believe is wrong or incomplete.
Be told when information in your file has been used against you.
Place fraud alerts or security freezes.
Learn the name of the agency that provided a report used to deny you credit, insurance, or employment.¹¹

Disputing an Error

Errors on credit reports aren’t unusual. You can file a dispute directly with the agency online, by phone, or by mail. Send copies of any supporting documents, not originals. The agency generally has 30 days to investigate.¹²

That deadline stretches to 45 days in two situations: if you filed shortly after receiving your free annual report, or if you submit additional supporting documents during the investigation. Once the investigation ends, the agency has five business days to notify you of the results.

If the investigation goes against you and you still believe the information is wrong, you can add a statement of up to 100 words to your file explaining your side. It gets included in future reports the agency issues about you. It isn’t as good as deletion, but it puts your version on record.

One rule that matters: if a disputed item is deleted and the agency later wants to put it back, it must first get certification from the source that the information is complete and accurate, then notify you in writing within five business days of the reinsertion.¹³ Deleted items can’t quietly reappear.

What to Do If You’re Denied

When a business denies your application for credit, insurance, or employment based on a consumer report, it must send you an adverse action notice. That notice has to include:

The name, address, and phone number of the agency that supplied the report.
A statement that the agency did not make the decision and cannot explain it.
Your credit score, if one was used.
Notice of your right to a free copy of the report within 60 days.
Notice of your right to dispute anything inaccurate in the report.¹¹

That 60-day free report is separate from your weekly reports through AnnualCreditReport.com. You request it from the agency named in the notice.¹⁴ Most disputes start here: you get denied, pull the report, find the mistake, and file. Doing nothing after a denial leaves a free investigation on the table.

Freezes and Fraud Alerts

A security freeze and a fraud alert are both identity theft tools, but they work differently. A freeze blocks all access to your report, so nobody, including you, can open new accounts until you lift it. A fraud alert leaves your report accessible but tells lenders to verify your identity before approving anything.¹⁵

Both are free under federal law. A freeze stays in place until you remove it, and you can lift it temporarily when applying for credit. Removal requests made by phone or online must be honored within one hour; mail requests take up to three business days.¹⁶ You have to contact each bureau separately: freezing Experian does not freeze Equifax or TransUnion.

Fraud alerts come in three forms. An initial fraud alert lasts one year and is renewable; you only need to contact one bureau, which must notify the other two. An extended fraud alert lasts seven years and is available if you’ve filed an identity theft report. An active duty alert lasts one year and is renewable for the length of a military deployment.¹⁷

A freeze gives stronger protection. If you aren’t actively applying for credit, freezing all three bureaus is the safer default. Fraud alerts are easier to manage and make sense when you need lenders to keep accessing your report.

When You Can Sue

The FCRA has teeth. If an agency or a company that supplies data to one willfully violates the law, you can sue for statutory damages of $100 to $1,000 per violation plus any actual damages you suffered. Courts can also award punitive damages and require the violator to pay your attorney’s fees.¹⁸

For negligent violations, you can still recover actual damages and attorney’s fees.¹⁹ The distinction matters because willful conduct unlocks statutory and punitive damages. An agency that repeatedly ignores your dispute or reinserts deleted information without following the rules faces more exposure than one that makes a good-faith mistake. The attorney’s fees provision is why some lawyers will take these cases on contingency. If you’ve documented the dispute, kept your correspondence, and the agency still won’t fix a clear error, those records are the foundation of a claim.

1
GovInfo. 15 U.S.C. 1681a
2
Consumer Financial Protection Bureau. Does My History of Paying Utility Bills Go in My Credit Report
3
Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports
4
Consumer Financial Protection Bureau. List of Consumer Reporting Companies
5
Consumer Financial Protection Bureau. Chex Systems, Inc.
6
Office of the Law Revision Counsel. 15 USC 1681c – Requirements Relating to Information Contained in Consumer Reports
7
NCLC Digital Library. The Latest on Keeping Medical Debt Out of Credit Reports
8
Federal Trade Commission. Free Credit Reports
9
Office of the Law Revision Counsel. 15 USC 1681j – Charges for Certain Disclosures
10
Office of the Law Revision Counsel. 15 USC 1681g – Disclosures to Consumers
11
Office of the Law Revision Counsel. 15 U.S. Code 1681m – Requirements on Users of Consumer Reports
12
Consumer Financial Protection Bureau. How Long Does It Take to Repair an Error on a Credit Report
13
Office of the Law Revision Counsel. 15 U.S. Code 1681i – Procedure in Case of Disputed Accuracy
14
Consumer Financial Protection Bureau. How Do I Get a Free Copy of My Credit Reports
15
Consumer Advice – FTC. Credit Freezes and Fraud Alerts
16
Consumer Financial Protection Bureau. What Is a Credit Freeze or Security Freeze on My Credit Report
17
Military OneSource. FTC Active-Duty Fraud Alert
18
Office of the Law Revision Counsel. 15 U.S. Code 1681n – Civil Liability for Willful Noncompliance
19
Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance