The Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq., was enacted in 1970 to ensure that the consumer reporting system is fair, accurate, and private. For decades, its primary application was straightforward: credit bureaus, employers, and landlords had defined, rule-governed duties. Today, those duties are increasingly performed by AI-driven screening systems that generate composite scores, risk predictions, and adverse determinations without transparent human review. The core FCRA obligations have not changed—but their application to algorithmic products raises new questions about accuracy, accountability, and the standing of plaintiffs to challenge systemic AI-generated errors in federal court.
FCRA Structure: Covered Entities and Core Duties
The FCRA regulates three types of actors:
- Consumer Reporting Agencies (CRAs): Entities that assemble or evaluate consumer information and furnish consumer reports for credit, employment, housing, or other specified purposes. 15 U.S.C. § 1681a(f). This includes the three major credit bureaus (Equifax, Experian, TransUnion), tenant screening companies, and increasingly, AI-based risk scoring platforms.
- Users of Consumer Reports: Employers, landlords, lenders, and others who obtain consumer reports from CRAs for covered purposes. 15 U.S.C. § 1681b.
- Furnishers: Entities that provide consumer data to CRAs (creditors, banks, landlords). 15 U.S.C. § 1681s-2.
AI-driven screening products may occupy more than one of these categories simultaneously. A vendor that collects consumer data, generates a proprietary risk score, and furnishes that score to landlords as a basis for housing decisions is arguably both a CRA (assembling consumer information) and a furnisher (providing data to users). This functional overlap has been the central liability question in several recent enforcement actions.
Spokeo and the Concrete Injury Requirement
Before reaching the merits of any FCRA claim, plaintiffs must satisfy Article III's standing requirements. The Supreme Court addressed FCRA standing in Spokeo, Inc. v. Robins, 578 U.S. 330 (2016). Spokeo operated a "people search engine" that aggregated consumer data; Robins alleged that Spokeo published false information about him, including an incorrect zip code, marital status, and wealth level. The Court held that a "bare procedural violation, divorced from any concrete harm" does not satisfy Article III's injury-in-fact requirement. An FCRA violation—even a technically unlawful one—is not automatically a compensable injury; the plaintiff must allege a concrete, real-world harm.
TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), sharpened this requirement in the FCRA context. The class at issue involved credit report errors flagging consumers as potential OFAC (terrorist watch list) matches. The Court held that only the 1,853 class members whose inaccurate reports had been disseminated to third-party businesses had suffered concrete reputational harm sufficient for standing; the 6,332 class members whose incorrect internal credit files were never shared with third parties lacked standing to sue for damages.
TransUnion's lesson for AI screening plaintiffs: dissemination matters. A plaintiff who received an adverse AI screening result that was transmitted to a landlord or employer—and denied housing or employment as a result—has concrete harm. A plaintiff who can show only that an AI system compiled inaccurate information about them that was never transmitted to a third-party user faces a harder standing argument. Complaint pleading must establish the chain from inaccurate AI report through third-party dissemination to tangible, real-world harm.
The SafeRent Litigation: FHA, Not Just FCRA
The most prominent recent algorithmic tenant screening litigation has proceeded under the Fair Housing Act rather than the FCRA—an important lesson in forum selection. Louis v. SafeRent Solutions, LLC (D. Mass.), a putative class action, alleged that SafeRent's algorithmic "SafeRent Score" assigned disproportionately low scores to Black and Hispanic rental applicants who used federally funded housing choice vouchers, in violation of the FHA's disparate impact prohibition.
On November 20, 2024, the Honorable Angel Kelley approved a $2.275 million settlement. The settlement also included significant injunctive relief: SafeRent agreed to discontinue using its AI-powered scores to evaluate voucher holders, replacing the algorithm's scoring with modified methodology that does not penalize housing voucher recipients. This case demonstrates that FHA disparate impact claims—which do not require the Spokeo/TransUnion concrete-injury showing required under FCRA—may be a more direct path in cases involving systemic algorithmic discrimination in housing.
FCRA's Accuracy Requirements Applied to AI Screening
The maximum possible accuracy standard. CRAs must "follow reasonable procedures to assure maximum possible accuracy of the information concerning the individual about whom the report relates." 15 U.S.C. § 1681e(b). This is not a perfection standard—it requires reasonable procedures, not perfect outcomes. However, an AI system that systematically generates inaccurate risk scores because of flawed training data, uncorrected model errors, or inputs from inaccurate underlying databases violates this standard if the inaccuracy was foreseeable and preventable through reasonable procedures.
The dispute mechanism. When a consumer disputes an inaccurate item in their consumer report, the CRA must conduct a "reasonable reinvestigation" within 30 days. 15 U.S.C. § 1681i. For AI-generated composite scores, the reinvestigation obligation is particularly complex: if the "score" reflects a proprietary algorithm rather than a specific data item, the CRA must disclose the factual inputs and methodology sufficient to allow the consumer to identify the error and provide counter-information. An AI scoring system that cannot provide this transparency may fail the reinvestigation requirement by design.
Adverse action notice requirements. When a user takes adverse action against a consumer based in whole or in part on a consumer report, the user must provide notice of the adverse action, the name and contact information of the CRA that furnished the report, and a statement of the consumer's right to a free copy of the report and to dispute its accuracy. 15 U.S.C. § 1681m. For AI-driven tenant screening, this means the landlord must provide a notice identifying the screening company—even if the landlord never received a traditional "credit report" but only a composite "score" or "recommendation." The obligation turns on whether the screening company is a CRA and whether the score is a "consumer report."
The definition of "consumer report." A "consumer report" includes any written, oral, or other communication by a CRA bearing on a consumer's creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used as a factor in establishing eligibility for credit, employment, or housing. 15 U.S.C. § 1681a(d). AI-generated risk scores and suitability ratings for housing clearly fall within this definition if they are used in eligibility determinations—regardless of whether the vendor labels the product a "score," "recommendation," or "intelligence."
Identifying the CRA in AI Screening Products
Whether an AI screening vendor qualifies as a CRA—and is therefore subject to FCRA's full obligations—turns on two questions: (1) does it assemble or evaluate consumer information? and (2) does it furnish consumer reports for a qualifying purpose?
Traditional tenant screening companies that pull credit data, eviction records, criminal history, and income verification clearly qualify. The harder question arises with newer "alternative data" screening platforms that use social media behavior, rental payment histories, geolocation patterns, or other non-traditional inputs to generate a proprietary score. Courts and the FTC have generally held that the functional analysis controls: if the platform generates a report used in housing eligibility decisions, it is a CRA subject to FCRA, regardless of how it labels itself.
The FTC has taken enforcement action under FCRA against alternative data screening companies. The SafeRent enforcement (the original FTC/HUD action, prior to the private class action settlement) and subsequent FTC enforcement against housing screening companies demonstrate regulatory attention to this issue. Practitioners should evaluate whether any AI vendor whose product was used against their client meets the CRA definition—because if so, both the vendor and the user who obtained the report may face FCRA liability.
Willful vs. Negligent Violations
FCRA provides two damages regimes. Under 15 U.S.C. § 1681o, a negligent violator is liable for actual damages and attorney's fees. Under 15 U.S.C. § 1681n, a willful violator is liable for the greater of actual damages or statutory damages of $100–$1,000 per violation, plus punitive damages and attorney's fees.
"Willful" under Safeco Insurance Co. of America v. Burr, 551 U.S. 47 (2007), means either knowing violation or reckless disregard for the statute's requirements. An AI screening company that knows its system produces inaccurate results but continues to market and deploy it without correcting the accuracy failures—or that knows its adverse action notice process is legally deficient but maintains it anyway—may be liable for willful violations and the full range of § 1681n damages.
In class action FCRA cases, willful violations are particularly significant because statutory damages can be recovered without proof of individual actual harm, providing a basis for aggregated recovery that survives Spokeo/TransUnion standing challenges for at least some class members.
Adverse Action Notice: The Practical Trap
The most reliably provable FCRA violation in AI screening cases is the failure to provide a legally adequate adverse action notice. Landlords routinely deny rental applications based on algorithmic screening reports without providing: (1) the CRA's name and contact information; (2) notification of the right to dispute; and (3) notification of the right to a free copy of the report.
This failure is often systemic—large property management companies using automated screening pipelines may generate denial letters that never reference the screening company or provide dispute information. Each denied applicant who did not receive adequate adverse action notice is a potential plaintiff with a discrete, verifiable FCRA violation.
TransUnion requires that even this technical violation be tied to a concrete harm (the loss of the housing opportunity, actual emotional distress, out-of-pocket costs of relocation) to sustain federal standing for damages. But the violation itself, combined with a provable real-world housing loss, provides a straightforward claim.
Practice Notes
Obtain the consumer report. Request the full consumer report—including any proprietary scoring criteria and the underlying data—from the screening company before or at the outset of litigation. Consumers are entitled to a free copy of the report used in an adverse action under 15 U.S.C. § 1681g.
Identify the CRA and all users. The screening company and the landlord or employer who obtained the report are potentially joint defendants with different FCRA obligations.
Consider FHA claims alongside FCRA. Where the AI screening tool produces disparate impact on race, national origin, or familial status, FHA claims provide complementary (and in some ways easier) theories that bypass Spokeo/TransUnion standing issues.
Plead concrete harm specifically. Allege the specific housing or credit opportunity lost, the financial and non-financial consequences, and how they flow from the inaccurate report or failure of notice. Do not plead a bare FCRA procedural violation without tethering it to real-world harm.
Talk to Yates Anderson
If you are litigating a matter in this area — or weighing whether to — the working analysis above only goes so far. Request a case evaluation and a Yates Anderson attorney will respond within one business day.
Informational only. Not legal advice. No attorney-client relationship is created by reading this post. Consult a licensed attorney in your jurisdiction.