What a Consumer Reporting Agency Actually Does with Your Data

Where CRAs Fit in the Background Check Process

When an employer, landlord, or lender orders a background check, they rarely gather raw data themselves. Instead, they turn to a consumer reporting agency — a regulated intermediary that has already assembled records from dozens of sources into a searchable database.

CRAs sit at the center of America's formal screening infrastructure. They pull information from county and federal court systems, credit data furnishers, motor vehicle departments, and employer verification networks. That data is then packaged into a structured consumer report tailored to the requester's legal purpose. Understanding this architecture matters because the rules governing CRAs — chiefly the Fair Credit Reporting Act — are what protect consumers throughout the process.

It's also worth noting that not every entity holding records about you qualifies as a CRA. The distinction between a CRA and a data broker, for example, carries significant consequences for what rights you can enforce. See our companion piece on CRAs versus data brokers for a detailed comparison.

How CRAs Collect and Store Personal Data

CRAs do not generate records — they aggregate them. Their data pipelines draw from three primary channels:

• Public records: Court filings, bankruptcy records, liens, judgments, and sex offender registries are harvested from federal, state, and county sources. Some CRAs access these directly; others use data resellers. For a closer look at how these records originate, see our guide on how courts and agencies generate fraud records.
• Credit data furnishers: Banks, credit card companies, and debt collectors routinely report account activity to credit bureaus — themselves a category of CRA — under formal data-sharing agreements.
• Verification partners: Employment and education verification often relies on third-party record keepers, such as payroll processors, that provide standardized data to CRAs.

Once collected, this data is stored in structured consumer files linked to identifying information — name, date of birth, Social Security number, and address history. CRAs apply matching algorithms to associate records with the correct individual, a process that is imperfect and one source of the errors consumers sometimes find in their reports.

Permissible Purpose: The Gatekeeper Rule

One of the FCRA's most important protections is the permissible purpose requirement. A CRA cannot legally furnish a consumer report to just anyone who asks. Requesters must fall into a recognized category — employers conducting pre-hire screening (with written authorization from the applicant), landlords evaluating rental applications, creditors assessing loan applications, and certain government agencies among them.

This rule means your report is not accessible to curiosity seekers, private investigators without a lawful basis, or marketers. When a CRA releases a report outside these defined purposes, it violates federal law and exposes itself to civil liability.

Consumers also have rights on the receiving end of this transaction. If a background check leads to an adverse action — a rejected job offer, a denied apartment — the requester must notify you, identify the CRA that supplied the report, and give you a chance to dispute it. The full framework of these protections is laid out in our plain-language FCRA explainer.

Data Accuracy, Retention, and Your Right to Dispute

CRAs are legally required to maintain reasonable procedures to ensure maximum possible accuracy — but errors still occur. Records may be misattributed to the wrong person, outdated information may linger past legal retention limits, or a court record may be updated without that update reaching the CRA's database.

Federal law sets clear retention windows. Most adverse civil and financial information must drop off after seven years. Chapter 7 bankruptcies may remain for ten years. Many types of criminal conviction data can be reported indefinitely at the federal level, though some states impose shorter windows.

If you discover an error, the FCRA gives you the right to file a dispute directly with the CRA. The agency must investigate, typically within 30 days, and correct or delete records that cannot be verified. Proactively reviewing your file is a smart first step — our article on checking your own background report walks through how to do this before a screening happens.

For a broader view of the types of records that surface in these reports, the What Records Appear hub is a useful reference, and the Rights and Accuracy hub covers your full range of consumer protections in detail.

This article is for general informational purposes only and does not constitute legal advice. Readers with specific questions about their consumer file or dispute rights should consult a qualified attorney or contact the Consumer Financial Protection Bureau.