Consumer Reporting Agency vs. Data Broker: Who Holds Your Records?

The Core Legal Distinction

The terms Consumer Reporting Agency (CRA) and data broker are often used loosely, but they occupy very different legal positions under U.S. law. Understanding that difference is the foundation of knowing your rights.

A CRA is defined under the Fair Credit Reporting Act (FCRA) as any entity that regularly assembles or evaluates consumer information for the purpose of furnishing consumer reports to third parties. A consumer report is specifically one used — or expected to be used — to evaluate a person for employment, housing, credit, insurance, or similar purposes. Because of that intended use, CRAs carry strict legal obligations: permissible-purpose requirements, mandated disclosure rights, and formal dispute procedures. For a deeper look at how those rules operate, see FCRA Basics: The Law That Governs How Background Checks Must Be Run.

Data brokers, by contrast, collect, aggregate, and sell personal information — but they typically do so for purposes that fall outside the FCRA's definition of a consumer report. Because their products are not formally used in credit or employment decisions (at least not in the way the statute defines), many brokers operate without equivalent federal consumer-protection obligations. The data they sell may end up in marketing lists, fraud-detection tools, or people-search websites, but the legal accountability framework is fundamentally different.

What Each Entity Does With Your Data

CRAs compile records from courts, financial institutions, and public databases, then furnish structured reports in response to a permissible-purpose request — such as a background check initiated by a prospective employer. The subject of the report must generally receive a disclosure, and if an adverse decision follows, the FCRA mandates specific notices and a right to dispute. See What a Consumer Reporting Agency Actually Does with Your Data for a detailed breakdown of this workflow.

Data brokers pull from many of the same underlying sources — public records, commercial transaction data, social media signals, and licensing databases — but they package and sell that information differently. Their clients may include advertisers, insurers assessing risk pools, private investigators, or anyone willing to pay for a profile. Because the broker is not furnishing a consumer report under the FCRA's definition, the subject typically has no federally guaranteed right to see, correct, or dispute that file. To understand how public and private data overlap in these profiles, see Public Records vs. Private Data in a Background Check.

Some data brokers have voluntarily adopted opt-out mechanisms in response to state laws — California's CCPA and deletion-request framework being the most prominent example — but these protections are not uniform nationwide.

Your Rights: A Practical Comparison

When a CRA holds records about you, federal law grants concrete remedies. You can request your file, challenge inaccurate or incomplete entries, and receive a written response within a defined timeframe. Employers and landlords who use CRA reports must follow adverse-action procedures before penalizing you based on findings.

With data brokers, your remedies are narrower and patchwork. A handful of states — California, Virginia, Colorado, and others — have enacted comprehensive privacy laws that give residents rights to access and delete data held by brokers. Outside those states, your options depend on the broker's own policies. For context on where the public-records domain ends and private data begins — which directly affects what brokers can legally collect — see Public Records vs. Private Data: Understanding the Difference.

It is also worth noting that the line between CRA and data broker is not always clean in practice. Some companies provide products that function as consumer reports without formally registering as CRAs, which has generated regulatory scrutiny from the Consumer Financial Protection Bureau (CFPB). If a company's report was used in an employment or housing decision affecting you, it may be subject to FCRA rules regardless of how the company labels itself.

Why the Distinction Matters for Accuracy and Dispute

Errors in background check records can follow a person for years. The practical importance of knowing whether a CRA or a data broker holds the flawed record is this: only CRA disputes carry federal legal force. If you identify an error in a CRA-generated report, the FCRA requires the agency to investigate and correct or delete unverifiable information. If the same error sits in a data broker's database, there is no equivalent federal mandate compelling a correction.

Additionally, data broker profiles can feed into CRA reports indirectly — a broker's records may be one of the upstream sources a CRA consults. This means an error introduced at the broker level can propagate into a federally regulated consumer report, making source-level accuracy worth monitoring. The privacy implications of online aggregators are explored in depth in a related guide.

Consumers who suspect a formal screening decision was based on inaccurate information should first identify whether the report was furnished by a registered CRA, then exercise their FCRA dispute rights directly with that agency. Consulting a consumer-rights attorney is advisable when a dispute is denied or the stakes are significant — the FCRA provides for civil remedies in cases of willful noncompliance.

This article is for general informational purposes only and does not constitute legal advice. Readers with specific disputes or concerns about their consumer rights should consult a licensed attorney familiar with the FCRA and applicable state law.