Consumer protection laws are the federal and state rules that limit what businesses may do when you borrow money, deal with a debt collector, have your credit history reported, receive calls or texts, or have personal information collected. Federal law sets a nationwide floor, and each state may add protections of its own.
Most people facing a collector who calls a relative, an account on a credit report they never opened, or texts that keep arriving after they replied STOP are not looking for a civics lesson. They want to know whether any law covers what is happening to them. Many have already read pages that list statute names without saying what those laws do. This page sets out the federal laws one at a time: who each covers, what it limits, which agency enforces it, and where a complaint can go.
What Consumer Protection Law Is
Consumer protection law is the body of federal and state statutes, regulations and agency rules that limit what businesses may do when dealing with people acting as consumers. That covers buying goods or services, borrowing money, receiving calls or texts, and having personal information collected or reported.
The structure has two layers. Federal law applies across the country and sets a minimum. A state may then pass its own laws that go further, so a person in one state can have rights a person in another state does not.
Two federal agencies do much of the enforcement work. The Federal Trade Commission (FTC) acts against unfair or deceptive business practices across many industries. The Consumer Financial Protection Bureau (CFPB) works on consumer financial matters, such as debt collection and credit reporting, and accepts consumer complaints. Each has its own mandate from Congress, and neither one replaces the other.
These laws do not cover every bad experience with a business. Each statute reaches particular companies and particular conduct, and whether a given situation falls under one depends on its facts.
The Major Federal Consumer Protection Statutes
Six federal statutes form the core of this map. Each has its own subject, and a rule from one does not carry over to another.
The Fair Debt Collection Practices Act (FDCPA), 15 U.S.C. § 1692 et seq.
Congress passed it, as 15 U.S.C. § 1692 says, "to eliminate abusive debt collection practices by debt collectors." It covers a "debt collector," which 15 U.S.C. § 1692a(6) defines as a person in "any business the principal purpose of which is the collection of any debts, or who regularly collects or attempts to collect, directly or indirectly, debts owed or due or asserted to be owed or due another." The definition has listed exclusions, including officers or employees of a creditor collecting in the creditor's name. The CFPB explains that the law generally does not cover the original creditor, or business debts. The FDCPA limits contact times, contact with third parties, harassment, false representations and unfair practices.
The Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq.
It requires consumer reporting agencies (the companies that gather and sell reports on consumers, often called credit bureaus) to adopt reasonable procedures that are fair to the consumer "with regard to the confidentiality, accuracy, relevancy, and proper utilization of such information." It also reaches furnishers (the companies that send account information to those agencies) and users of reports, such as lenders and employers.
The Telephone Consumer Protection Act (TCPA), 47 U.S.C. § 227 et seq.
It governs automated calls and texts, prerecorded and artificial voice calls, fax advertising and telemarketing, including the National Do Not Call Registry. Under 47 U.S.C. § 227(a)(1), an "automatic telephone dialing system" means equipment which has the capacity "(A) to store or produce telephone numbers to be called, using a random or sequential number generator; and (B) to dial such numbers."
Section 5 of the FTC Act, 15 U.S.C. § 45
It declares "unfair or deceptive acts or practices in or affecting commerce" unlawful and directs the FTC to prevent them, with listed exceptions such as banks and certain common carriers.
In practice, this is the broadest of the six. The other statutes each target one kind of business or one kind of conduct, such as debt collection or credit reporting. Section 5 instead sets a general standard that can reach unfair or deceptive conduct across many industries, which is why the FTC relies on it when it acts against business practices that no narrower statute addresses. Because of the listed exceptions, though, it does not reach every business. How the FTC uses this authority, through complaints against businesses and civil penalties in set circumstances, is described in the enforcement section below.
The Truth in Lending Act (TILA), 15 U.S.C. § 1601 et seq.
Its purpose is "a meaningful disclosure of credit terms," so consumers can compare credit offers, along with protection against inaccurate and unfair credit billing and credit card practices.
Put plainly, TILA works in two ways. First, it is a disclosure law: it requires that the terms of credit be set out clearly enough that a person weighing two loans or two credit cards can see what each one costs and compare them before agreeing. Second, it addresses what happens after credit is in use, by protecting against billing that is inaccurate or unfair and against unfair credit card practices. A borrower who was not given a clear picture of a loan's terms, or who is dealing with a billing problem on a credit account, is in the territory this statute covers.
The Electronic Fund Transfer Act (EFTA), 15 U.S.C. § 1693 et seq.
It provides a basic framework for the rights, liabilities and responsibilities of people in electronic fund and remittance transfers, with individual consumer rights as its main aim.
In plain terms, EFTA covers money that moves electronically rather than on paper, along with remittance transfers. It sets out who is responsible for what among the consumer, the financial institution and others involved in a transfer, so that the rules for these transactions are defined rather than left open. Congress stated that protecting individual consumers is the main goal of that framework, so a consumer's rights in an electronic transfer are the statute's central concern.
The Rights These Laws Create
No single statute lists a fixed set of consumer rights. Read together, though, these laws protect a handful of interests a person in the middle of a collection or credit problem tends to care about most.
Accurate information. The FCRA aims at accurate credit reporting, and TILA requires clear disclosure of credit terms. Under the CFPB's summary of FCRA rights, a consumer reporting agency in most cases may not report negative information more than seven years old, or bankruptcies more than 10 years old.
Disputing and correcting errors. The same CFPB summary says that when a consumer reports incomplete or inaccurate information, the agency must investigate unless the dispute is frivolous. That investigation is called a reinvestigation. Inaccurate, incomplete or unverifiable information must be removed or corrected, usually within 30 days, though the agency may keep reporting information it has verified as accurate. The summary also says anyone who uses a report to deny credit, insurance or employment must say so, and must give the reporting agency's name, address and phone number. More on this appears in our credit-report reinvestigation guide.
Freedom from harassment and deception. The CFPB describes the FDCPA as prohibiting abusive, unfair or deceptive collection practices. Its examples of harassment include repetitious calls or electronic messages intended to harass, obscene language, threats of violence, and calls made without giving a name. The FTC adds that a collector generally can't discuss a debt with anyone but the consumer or the consumer's spouse. It may contact other people to learn the consumer's address, home phone number and workplace, but usually only once, and it can never tell them the consumer owes a debt. Whether a particular call crosses a line depends on its facts.
Control over unwanted contact. The TCPA generally bars automated or prerecorded calls to cell phones without prior express consent, which means the called person's advance agreement, unless the call is for emergency purposes. Under 47 C.F.R. § 64.1200(a)(10), a person may revoke consent "using any reasonable method," and replying "stop," "quit," "end," "revoke," "opt out," "cancel," or "unsubscribe" to a text counts. A revocation must be honored "within a reasonable time not to exceed ten business days," and callers "may not designate an exclusive means" to revoke.
Complaining to an agency. The CFPB and the FTC each accept consumer complaints, as described below.
Each statute defines who it protects in its own words. The FDCPA, for example, defines a "consumer" as "any natural person obligated or allegedly obligated to pay any debt."
How Federal Agencies Enforce Consumer Protection Law
The FTC's authority starts with 15 U.S.C. § 45. When the Commission has reason to believe a business is using an unfair or deceptive practice and a proceeding is in the public interest, the statute lets it issue a complaint against that business. The statute also provides civil penalties for violating a final FTC order or certain FTC rules, under the conditions it sets out. The FTC publishes consumer guidance on debt collection and the National Do Not Call Registry.
The CFPB, which the FDCPA calls "the Bureau of Consumer Financial Protection," works on consumer financial laws. On its own pages it explains debt collection rights, publishes the model summary of rights under the FCRA, and states that a person who believes a collector is harassing them can submit a complaint to the CFPB.
The Federal Communications Commission (FCC) writes the TCPA's rules on robocalls and robotexts. Its consumer guide explains those rules, including that "You may opt out of any robocall or robotext at any time and in any reasonable manner, even if you previously gave consent for such calls."
State attorneys general form the third layer. The CFPB and FTC both point consumers to their state attorney general's office for questions about state law.
An agency complaint is an official process that the agency runs and describes on its own pages. Filing one does not guarantee any particular action or response. It is also separate from a private lawsuit; the stages of a consumer lawsuit are a different path.
The Federal–State Structure: How State Law Fits In
Federal statutes set a nationwide minimum, and a state may add rights or remedies above it. The FDCPA itself names, among its purposes, promoting "consistent State action to protect consumers against debt collection abuses."
The agencies describe that overlap in their own words. According to the CFPB, most states have debt collection laws, many similar to the FDCPA, and some of those state laws cover the original creditor while others don't. The CFPB's FCRA summary notes that states may enforce the FCRA, that many states have their own consumer reporting laws, and that in some cases a person may have more rights under state law. The FCC's guide notes that many states keep their own do-not-call lists.
State attorneys general enforce state consumer protection laws, and some state statutes also allow private lawsuits. Deadlines can differ as well. The CFPB notes that some state collection laws may allow more time to sue than the federal one-year limit described below.
Because state law changes from one state to the next, this page covers federal law. For someone whose problem began with a company in another state, the federal rules described here apply wherever they live.
What Complaints Can Be Filed and Where
The right agency depends on what happened. Each one describes the complaints it takes.
The CFPB. Its pages invite complaints from consumers who believe a debt collector is harassing them, and its work covers debt collection, credit reporting and other consumer financial products. The CFPB also offers sample letters a consumer may use to request information from a collector or to limit or stop further contact.
The FTC. The FTC takes reports of unwanted calls, scams and deceptive business practices, and it runs a separate federal resource for identity theft reports. Its Do Not Call guidance explains that the Registry "doesn't block calls" and won't stop scammers. A person who answers one of those calls may hang up and report the call to the FTC. The FTC uses report data to identify illegal callers, even when caller ID is faked.
State attorneys general. These offices handle complaints about businesses operating in their state, under that state's laws.
A complaint is separate from a lawsuit. The FTC states that a person may sue a collector in state or federal court, and that the lawsuit must be filed within one year of when the collector broke the law. The FTC adds that even if a court finds a violation, the consumer may still owe the debt. Our page on consumer rights remedies explains what each statute makes potentially available and what that depends on.
Records matter on every path. The CFPB describes keeping a collector's letters and noting the dates, times and content of calls as a record that can help when disputing a debt or going to court. Screenshots of texts, any STOP replies, and credit reports with dispute letters serve the same purpose for other problems.
If You'd Like a Consumer Rights Case Review
An overview like this can show which federal law may reach a problem, but each statute turns on details: who made the call or sent the report, what was said or listed, and when. A conversation can cover the company involved, the letters, texts and call logs, any dispute already sent and the answer that came back, and the dates that matter under each law. This page does not cover bankruptcy, debt settlement or credit repair services.
To talk through a situation like this with an attorney, request a consumer rights case review through Federal Consumer Rights.
