CFPB: Worker Scores and Dossiers Can Be FCRA Reports

Source: Consumer Financial Protection Bureau
Citation: Consumer Financial Protection Circular 2024-06, 89 Fed. Reg. 88875 (Nov. 12, 2024) (withdrawn May 12, 2025)
Decided: October 24, 2024
Bottom line: The circular is withdrawn, but its analysis rested on the FCRA's own definitions. Whether a worker-monitoring or scoring vendor is a consumer reporting agency is now for courts to decide.

Background

The FCRA has covered employment background checks since 1970. A “consumer report” includes information from a consumer reporting agency bearing on a person’s “character, general reputation, personal characteristics, or mode of living” that is used for “employment purposes,” which the statute defines as evaluating someone “for employment, promotion, reassignment or retention as an employee.” 15 U.S.C. § 1681a(d), (h). Employers that use these reports must get the worker’s written authorization and, before taking adverse action, give the worker a copy of the report and a summary of rights. § 1681b(b).

Technology has changed what employers buy. Vendors now sell tools that track drivers, log keystrokes and web browsing, and generate productivity or “risk” scores. On October 24, 2024, the CFPB released Circular 2024-06 to address whether those products fall under the FCRA. It was published in the Federal Register on November 12, 2024.

What the circular said

The CFPB posed the question whether an employer can use “background dossiers, algorithmic scores, and other third-party consumer reports about workers” without following the FCRA. Its answer was “No.” It said such dossiers and scores, when obtained from third parties and used for hiring, promotion, reassignment, or retention, “are often governed by the FCRA.”

The circular told enforcers to ask two questions: whether the employer’s use is for “employment purposes,” and whether the report-maker “assembled” or “evaluated” consumer information to produce the report. It said a company that collects data to train an algorithm that scores workers could meet that test, for example a driving-app developer that uses data from other employer-customers or public sources to generate scores. It also said the exception for reports based solely on the report-maker’s own transactions with the consumer does not cover reports that include algorithmic scores built on outside data.

If the FCRA applies, the circular explained, employers must obtain authorization, give pre-adverse and adverse action notices, and use reports only for permissible purposes. Vendors must follow reasonable accuracy procedures, disclose files to workers on request, and investigate disputes.

Circulars are policy statements. They do not themselves impose legal requirements. On May 12, 2025, the CFPB withdrew Circular 2024-06, along with dozens of other guidance documents, and said it would not prioritize enforcement of the withdrawn guidance.

Our take

The circular did not create new law. Its reasoning tracked the statutory definitions courts have applied for decades to background screeners. Withdrawing it removed the CFPB’s view, not the statute. A vendor that gathers information about workers from multiple sources and sells scores or dossiers to employers for employment decisions may still meet the definition of a consumer reporting agency. Whether a particular product does depends on facts about how the data is collected, combined, and sold.

There are fair arguments on the other side. Some monitoring tools only process an employer’s own data for that employer, and the FCRA excludes certain workplace misconduct investigations. Courts will draw those lines case by case, and after Loper Bright they will not defer to the CFPB’s reading in any event.

What it means if your report is wrong

If an employer turned you down, demoted you, or let you go based in part on a report, score, or “assessment” from an outside company, ask which company supplied it. You may be entitled to a copy of the report before adverse action, and you can request your file from the vendor and dispute errors. Keep any notices you received, or note that you received none. A free case review can assess whether the FCRA applies to the report used against you, and there is no fee unless we win.

Sources

Primary

Commentary we reviewed

Updated November 1, 2026. "Our take" is the firm's opinion. This page is general information, not legal advice, and later decisions may change the law.