Consumer privacy law in this area means the federal statutes that govern how companies report, use, disclose or protect a person's personal information. This page covers four of them: the Fair Credit Reporting Act, the Fair Debt Collection Practices Act, the Telephone Consumer Protection Act and the Gramm-Leach-Bliley Act. State law may add more protection.
You may be here because a breach notice arrived in the mail, because a credit report lists an account you never opened, or because a collector told your sister about a debt you had never discussed with anyone. Whether particular conduct violates a federal statute depends on which company was involved and what it did.
This page explains which federal law reaches which kind of company, what each law requires, and what options the law gives a consumer.
Situations This Area of Law Covers
Consumer privacy matters involve the unauthorized collection, use or disclosure of personal information, along with the federal consumer-protection statutes that govern those matters. This page centers on four statutes:
- The Fair Credit Reporting Act (FCRA) governs credit bureaus, background-check companies, the businesses that send them information, and the businesses that use their reports.
- The Fair Debt Collection Practices Act (FDCPA) governs how debt collectors communicate, including whom they may tell about a debt.
- The Telephone Consumer Protection Act (TCPA) governs automated and prerecorded calls and texts, and the consent they require.
- The Gramm-Leach-Bliley Act (GLBA) sets a federal policy that financial institutions must protect the security and confidentiality of customers' nonpublic personal information.
The situations that bring people to this area of law tend to be specific: a data breach that exposed a Social Security number or financial details, identity theft that left fraudulent accounts on a credit report, a credit-report or background-check error, robocalls or robotexts that kept coming after a person said stop, or a debt collector who shared information about a debt with someone it should not have.
Each of these runs through a different statute, with its own rules and its own remedies. A broader overview of these laws appears on the page about what a consumer rights attorney covers.
Federal Laws That Protect Consumer Privacy
No single federal statute protects all personal information. Each law covers one kind of company and one kind of conduct.
The FCRA. Congress found that "the banking system is dependent upon fair and accurate credit reporting" (15 U.S.C. § 1681). A consumer report is a communication by a consumer reporting agency of information bearing on a consumer's creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics or mode of living that is used or expected to be used as a factor in establishing the consumer's eligibility for credit or insurance for personal, family or household purposes, for employment, or for another purpose the statute authorizes. A credit report is one example. A consumer reporting agency is a person that, for fees, dues or on a cooperative nonprofit basis, regularly assembles or evaluates information on consumers for the purpose of furnishing consumer reports to third parties. The FCRA addresses the accuracy of reports, the purposes for which a report may be obtained, and a consumer's right to dispute errors.
The FDCPA. Congress found "abundant evidence of the use of abusive, deceptive, and unfair debt collection practices by many debt collectors" (15 U.S.C. § 1692). The law limits whom a debt collector may contact and what it may disclose about a debt.
The TCPA. Codified at 47 U.S.C. § 227, it restricts calls and texts made with an autodialer or with an artificial or prerecorded voice, and it ties many of those restrictions to the consumer's consent.
The GLBA. Under 15 U.S.C. § 6801, each financial institution has "an affirmative and continuing obligation" to respect customer privacy. Under 15 U.S.C. § 6801(b), each agency or authority the statute names, other than the Bureau of Consumer Financial Protection, is to establish appropriate standards for the financial institutions under its jurisdiction relating to administrative, technical and physical safeguards. Those safeguards are meant to insure the security and confidentiality of the records, to protect against anticipated threats to them, and to protect against unauthorized access or use that could cause a customer substantial harm or inconvenience.
State law may add protections, and it differs from state to state. Whether particular conduct may violate any of these statutes depends on the company involved, what it did and the facts around it.
Data Breaches, Identity Theft, and the FCRA
When false information appears in a credit file, including through identity theft, the FCRA sets the process by which a consumer reporting agency and a furnisher handle a dispute about it. A furnisher is a business that provides information about a consumer to a consumer reporting agency, such as a lender or a collector reporting an account. A mixed file is a consumer report that contains information belonging to a different person. Identity theft can cause the same kind of problem: accounts the consumer never opened appear as theirs.
Reinvestigation is the process a consumer reporting agency must carry out when a consumer disputes the accuracy or completeness of information in their file. Under 15 U.S.C. § 1681i(a), when a consumer notifies the agency of a dispute, directly or through a reseller, the agency must conduct a reasonable reinvestigation free of charge. It must either record the current status of the information or delete it within 30 days of receiving the notice. That period may be extended by up to 15 days if the consumer sends relevant information during the 30 days. The extension does not apply if the information is found inaccurate or incomplete, or cannot be verified, during that period. The agency must notify the furnisher of the dispute within 5 business days, and it must consider all relevant information the consumer submits.
If disputed information is found inaccurate, incomplete or unverifiable, the agency must promptly delete or modify it. Deleted information may not be reinserted unless the furnisher certifies that it is complete and accurate. If it is reinserted, the agency must notify the consumer in writing within 5 business days. An agency may end a reinvestigation it reasonably determines is frivolous or irrelevant, but it must tell the consumer why within 5 business days.
An agency that skips these steps may violate the FCRA. Whether it did depends on the dispute, the response and the facts. Separately, the CFPB explains that a security freeze "prevents prospective creditors from accessing your credit file." The FTC describes fraud alerts as making lenders verify identity before granting new credit. Identity theft is covered in more detail on the page about identity theft and credit reports.
Robocalls, Robotexts, and the TCPA
Calls that keep coming after a person has asked them to stop feel like a privacy intrusion, and the TCPA treats some of them as unlawful. Under 47 U.S.C. § 227(b)(1)(A), it is unlawful to make any call using an automatic telephone dialing system or an artificial or prerecorded voice to the following numbers, other than a call made for emergency purposes or with the prior express consent of the called party:
- any emergency telephone line, including any "911" line and any emergency line of a hospital, medical physician or service office, health care facility, poison control center, or fire protection or law enforcement agency;
- the telephone line of any guest room or patient room of a hospital, health care facility, elderly home, or similar establishment; or
- any telephone number assigned to a paging service, cellular telephone service, specialized mobile radio service, or other radio common carrier service, or any service for which the called party is charged for the call.
The statute's text also contained an exception for calls to collect government-backed debts. The Supreme Court held that exception invalid and severed it in Barr v. American Association of Political Consultants (No. 19-631, decided July 6, 2020).
An automatic telephone dialing system is "equipment which has the capacity (A) to store or produce telephone numbers to be called, using a random or sequential number generator; and (B) to dial such numbers" (47 U.S.C. § 227(a)(1)). Prior express consent is the called party's own agreement to receive such calls.
Revoking consent. Under 47 C.F.R. § 64.1200(a)(10), a called party may revoke consent, including prior express written consent, "by using any reasonable method." The regulation treats each of these as reasonable per se:
- an automated or key-press opt-out on a call;
- a reply text of "stop," "quit," "end," "revoke," "opt out," "cancel" or "unsubscribe"; and
- a website or telephone number the caller designates for opt-outs.
Other reply words count if a reasonable person would understand them as a request to revoke. A revocation must be honored within a reasonable time not to exceed ten business days. Covered callers may not designate an exclusive means of revocation.
Remedies. Under 47 U.S.C. § 227(b)(3), a person may, if otherwise permitted by the laws or rules of court of a State, bring in an appropriate court of that State an action to recover actual monetary loss from a violation of the automated and prerecorded call rules, or to receive $500 in damages for each such violation, whichever is greater. Under 47 U.S.C. § 227(c)(5), a person who has received more than one telephone call within any 12-month period by or on behalf of the same entity in violation of the do-not-call regulations may, if otherwise permitted by the laws or rules of court of a State, bring in an appropriate court of that State an action to recover actual monetary loss from such a violation, or to receive up to $500 in damages for each such violation, whichever is greater. A defendant has an affirmative defense under that subsection if it established and implemented, with due care, reasonable practices and procedures. Under each subsection, the court may, in its discretion, increase the award to not more than 3 times that amount if it finds the violation willful or knowing.
Being contacted by a debt collector is uncomfortable. The FDCPA also limits whom a collector may discuss a debt with.
A debt collector is "any person who uses any instrumentality of interstate commerce or the mails in any business the principal purpose of which is the collection of any debts, or who regularly collects or attempts to collect, directly or indirectly, debts owed or due or asserted to be owed or due another" (15 U.S.C. § 1692a(6)).
Under 15 U.S.C. § 1692c(b), a debt collector generally may not communicate about a debt with anyone other than these people and businesses:
- the consumer;
- the consumer's attorney;
- a consumer reporting agency, if otherwise permitted by law;
- the creditor;
- the creditor's attorney; or
- the debt collector's attorney.
The rule has exceptions. A collector may make these communications with the consumer's prior consent given directly to the collector, with a court's express permission, or as reasonably necessary to carry out a postjudgment remedy. The rule is also subject to the separate provision for contacts seeking location information, meaning a consumer's home address and telephone number there, or place of employment. A collector that discusses a debt with someone outside those limits may violate the FDCPA, depending on what was said and to whom.
Under 15 U.S.C. § 1692c(c), if a consumer notifies a collector in writing that the consumer refuses to pay a debt or wishes the collector to cease further communication, the collector generally may not communicate further with the consumer about that debt, except for the notices the statute lists. Debt validation refers to the statute's rule that when a consumer disputes a debt in writing within the 30-day period the statute describes, the collector must cease collection of the disputed debt until it obtains and mails the consumer verification of the debt or a copy of a judgment.
When a collector uses an autodialer or a prerecorded voice, both laws can apply. The FDCPA governs the collector's conduct, and the TCPA governs the calls themselves, each with its own conditions. The CFPB says an FDCPA lawsuit "must be filed within one year of the offense" (CFPB). Repeated calls are covered further on the page about a debt collector who keeps calling.
What This Site Covers — and What It Does Not
Federal Consumer Rights is a website that provides information and facilitates inquiries concerning consumer-protection matters. It is not a law firm.
This site covers the following areas under federal consumer-protection law:
- credit-report and background-check disputes under the FCRA;
- debt-collection conduct under the FDCPA;
- robocall and robotext matters under the TCPA; and
- identity theft and data-breach questions as those laws reach them.
This page does not cover employment law, immigration, criminal defense, personal injury, bankruptcy, debt relief, or matters outside federal consumer-protection statutes. It does not address whether any debt should be paid. Beyond noting that state law may add protections, it does not state any state's own rules.
How to Submit an Inquiry
A person with questions about a credit-report error, a background-check mistake, unwanted robocalls, a debt collector's disclosures, or personal information exposed in a breach may describe the situation through this site.
How each statute's remedies work is described on the page about consumer rights remedies. The stages of a federal case are explained on the page about how consumer lawsuits work.
Requesting a Consumer Rights Case Review
A reader with a question about a privacy matter of this kind may request a consumer rights case review through Federal Consumer Rights.
