Three Categories, Very Different Rules
If you’ve ever searched for yourself online, you’ve probably run into people search sites, heard about credit bureaus, and maybe even seen the term “consumer reporting agency” thrown around. These three categories sound similar, but the legal rules governing each one are very different. Those differences matter when it comes to your privacy, your rights, and how your personal data can be used.
This article is for informational purposes only and is not legal advice. If you have specific legal questions about your rights under the Fair Credit Reporting Act or any other law, consult a qualified attorney.
What Is a Consumer Reporting Agency (CRA)?
A consumer reporting agency is a legal term defined by the Fair Credit Reporting Act (FCRA), the federal law enacted in 1970 that regulates how consumer information is collected, shared, and used. Under the FCRA, a CRA is any entity that regularly assembles or evaluates information about consumers and provides that information to third parties in the form of “consumer reports.”
The definition is broader than most people realize. Courts have held that private investigators, collection agencies, tenant screening companies, and employment background check firms can all qualify as CRAs if they meet the statutory definition.
CRAs have significant legal obligations under the FCRA, including:
- Ensuring reasonable accuracy of the information they report
- Only providing consumer reports for “permissible purposes” (such as credit decisions, employment screening, or tenant screening)
- Giving consumers the right to dispute inaccurate information
- Notifying consumers when information in a report is used to make an adverse decision against them
What Is a Credit Bureau?
“Credit bureau” is an industry term, not a separate legal category. The three major national credit bureaus, Equifax, Experian, and TransUnion, are consumer reporting agencies under the FCRA. They collect credit account information from lenders, creditors, and public records, then compile it into credit reports that are used for lending decisions, insurance underwriting, and other permissible purposes.
Because credit bureaus are CRAs, they are bound by all the obligations listed above. You have the legal right to request your credit report, dispute errors, and receive notice when a credit report is used against you.
It is worth noting that even the major credit bureaus sell some data products that they claim fall outside the FCRA, such as marketing lists and aggregated data. Consumer advocates and the CFPB have pushed back on this practice, arguing that the FCRA’s protections should apply more broadly to the data these companies handle.
What Is a People Search Site?
People search sites (sometimes called data brokers or people-finder sites) are companies like Spokeo, BeenVerified, TruthFinder, and WhitePages that aggregate publicly available records and sell access to personal information. These records can include names, addresses, phone numbers, relatives, court records, property records, and more.
Nearly every people search site includes a disclaimer stating that it is not a consumer reporting agency and that its data cannot be used for employment decisions, tenant screening, credit decisions, or any other purpose covered by the FCRA.
Why Do They Disclaim CRA Status?
The reason is straightforward: if a company qualifies as a CRA, it must comply with the FCRA’s accuracy, dispute, and permissible purpose requirements. Those obligations are expensive and operationally complex. By disclaiming CRA status, people search sites attempt to avoid those legal burdens.
However, the FTC has made clear that a disclaimer alone is not enough. If a company actually functions as a CRA, the disclaimer does not change its legal status. In a notable enforcement action, the FTC found that TruthFinder and Instant Checkmate operated as consumer reporting agencies despite their disclaimers, because they marketed and sold background reports for employment and tenant screening purposes. The companies were required to pay a $5.8 million penalty.
Why This Matters for You
The practical impact of these distinctions comes down to your rights as a consumer:
- With a CRA or credit bureau: You have the legal right under the FCRA to access your file, dispute inaccurate information, and receive notice when a report is used against you.
- With a people search site that is not a CRA: You generally do not have the same federal rights. Your options for removing or correcting information are usually limited to the site’s own opt-out process, which varies widely in difficulty and effectiveness.
This distinction also means that employers, landlords, and lenders are not supposed to use people search site data for screening decisions. If they do, and the people search site has not complied with the FCRA, both the site and the decision-maker could face legal liability.
The Landscape Is Shifting
Regulators have been working to close the gap between data brokers and CRAs. In December 2024, the Consumer Financial Protection Bureau (CFPB) proposed a rule that would treat data brokers selling certain types of consumer information as consumer reporting agencies subject to the FCRA. If finalized, this could significantly expand consumer protections and force many people search sites to comply with the same rules that credit bureaus follow.
What You Can Do Right Now
- For credit bureaus: Request your free annual credit reports at AnnualCreditReport.com. Dispute any errors directly with the bureau.
- For people search sites: Use each site’s opt-out process to request removal of your information. Many sites require you to opt out individually, which can be time-consuming but is worth the effort.
- Know the difference: If an employer or landlord tells you they found something about you online, ask whether they used a consumer report from a CRA. If they did, you have specific rights under the FCRA, including the right to see the report and dispute inaccuracies before a final decision is made.
Understanding these categories is the first step toward taking control of your personal information online. The rules are different depending on who holds your data and how they use it, and knowing those differences puts you in a stronger position to protect your privacy.