CFPB 2022 Opinion: Permissible Purpose Is Person-Specific

Source: Consumer Financial Protection Bureau
Decided: July 7, 2022
Bottom line: The opinion is withdrawn, but the statute it interpreted is unchanged: a report can only go to someone with a legitimate reason to see your file, not a stranger's.

Background

The FCRA is a privacy law as much as an accuracy law. Section 604, 15 U.S.C. § 1681b, lists the only circumstances in which a consumer reporting agency may furnish a consumer report, “and no other”: for example, in connection with a credit transaction, employment, insurance, or a legitimate business need in a transaction the consumer starts. Since 1996, § 604(f) has also barred anyone from using or obtaining a consumer report without a permissible purpose.

Background check and tenant screening companies often search public records by name. When several people share a name, some companies send the client every record that might match, sometimes with a disclaimer saying the record may not belong to the applicant. In November 2021 the CFPB had issued an advisory opinion saying name-only matching is not a reasonable procedure to assure accuracy. In 2022 it addressed the same practice from the privacy side.

What the rule does

The CFPB issued the advisory opinion on July 7, 2022, and it was published in the Federal Register on July 12, 2022, effective that day. It made four main points:

Permissible purpose is consumer specific. The purposes in § 604(a)(3) apply “only with respect to the consumer who is the subject of the user’s request.” A request about one person gives the agency no reason to believe the user has a purpose to see anyone else’s information.
All the information must belong to that consumer. An agency “may not provide a consumer report under FCRA section 604(a)(3) unless it has reason to believe that all of the consumer report information it includes pertains to the consumer who is the subject of the user’s request.” Sending a list of “possible matches” found through name-only matching means furnishing reports about other people to someone with no right to them.
Disclaimers do not fix it. The opinion stated that “[d]isclaimers will not cure a failure to have a reason to believe that a user has a permissible purpose.”
Users face a strict rule. The Bureau read § 604(f) to strictly prohibit users from obtaining or using reports without a permissible purpose, and noted that some courts had applied a looser “reason to believe” standard drawn from a pre-1996 decision.

The opinion applied to all consumer reporting agencies, not only the nationwide credit bureaus.

Later developments. On May 12, 2025, the CFPB withdrew this advisory opinion, along with its 2021 name-only matching opinion and dozens of other guidance documents, stating it did not intend to prioritize enforcement of the withdrawn guidance. Withdrawal of guidance does not change the statute, which consumers can still enforce in court.

Our take

The opinion connected two problems that are usually treated separately. A background report that lists another person’s criminal record is inaccurate, but it is also a disclosure of that other person’s private information to a stranger. Reading § 604 as person-specific follows naturally from its text, which repeatedly refers to “the consumer” on whom the information is to be furnished.

Industry commentators noted the opinion pushed agencies of every size to audit matching procedures, and some noted the Bureau was relying on guidance rather than formal rulemaking. That point carries more weight now that the guidance has been withdrawn. But the core reasoning did not depend on the CFPB. Courts read § 604 directly, and a company that sends a client records about the wrong person still risks liability under §§ 1681b and 1681e(b).

What it means if your report is wrong

If a background or tenant screening report includes records that belong to someone with a similar name, request a copy of your file from the company that prepared it and dispute the records in writing. Point out the identifiers that do not match, such as date of birth, middle name, or address. If a company pulled your credit without your application or another legitimate reason, keep the inquiry record and the company’s explanation. Both situations can support FCRA claims. A free case review can assess what happened, and there is no fee unless we win.

Sources

Primary

Commentary we reviewed

Updated November 1, 2026. "Our take" is the firm's opinion. This page is general information, not legal advice, and later decisions may change the law.