Research
When a company that sells facts about you is a reporting agency
Federal law defines a category of business that assembles information about people and sells it, and then restricts who may receive the result. The definition is narrower than data broker and wider than credit bureau.
The short answer
Federal law defines a consumer reporting agency as any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports.
Four elements sit inside that sentence. Payment or cooperative arrangement. Regular activity, in whole or in part. Assembling or evaluating information on consumers. And a purpose of furnishing consumer reports to third parties.
The phrase or other information on consumers is why the definition is not limited to credit. What narrows it instead is the definition of a consumer report, which turns on what the information is used or expected to be used for.
Once a business is inside the definition, the statute states that it may furnish a consumer report under a listed set of circumstances and no other. Those three words at the end of the list are the operative restriction.
What makes a communication a consumer report
A consumer report means any written, oral, or other communication of any information by a consumer reporting agency bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living.
Character, general reputation, personal characteristics and mode of living are all in that list alongside credit. The subject matter is broad.
The narrowing comes from purpose. The communication has to be used, or expected to be used, or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for credit or insurance to be used primarily for personal, family, or household purposes, for employment purposes, or for any other purpose authorized by the permissible purposes section.
So the same fact about a person can be a consumer report in one hand and not in another, depending on what it is collected or expected to be used for. That is the hinge the whole scheme turns on.
The exclusions, and why they matter
The definition of consumer report carries exclusions, and leaving them out would make the statute look far wider than it is.
It does not include a report containing information solely as to transactions or experiences between the consumer and the person making the report. A company describing its own dealings with its own customer is, on that exclusion, outside the definition.
It does not include communication of that transaction-or-experience information among persons related by common ownership or affiliated by corporate control. Nor communication of other information among such persons, if it is clearly and conspicuously disclosed to the consumer that the information may be communicated among them, and the consumer is given the opportunity, before the information is initially communicated, to direct that it not be.
It also excludes an authorization or approval of a specific extension of credit by a credit card issuer, and a report in which a person asked by a third party to extend credit conveys the decision, subject to conditions the statute sets.
There is then a restriction that cuts back the affiliate exclusions specifically for health information. Except for information disclosed as the medical protection provision allows, those exclusions do not apply to information disclosed to a person related by common ownership or affiliated by corporate control where the information is medical information, an individualized list or description based on the consumer's payment transactions for medical products or services, or an aggregate list of identified consumers based on payment transactions for medical products or services.
That carve-back is written for exactly the situation of a list of people identified by what they paid a health business for.
How the statute defines medical information
The definition is worth reading closely because it does two things at once.
Medical information means information or data, whether oral or recorded, in any form or medium, created by or derived from a health care provider or the consumer, that relates to the past, present, or future physical, mental, or behavioral health or condition of an individual, the provision of health care to an individual, or the payment for the provision of health care to an individual.
Then it excludes: the age or gender of a consumer, demographic information including residence address or email address, and any other information about a consumer that does not relate to their physical, mental, or behavioral health or condition, including the existence or value of any insurance policy.
Two features stand out. The definition includes information created by or derived from the consumer, not only from a provider. And payment for the provision of health care is inside it, which is why the affiliate carve-back separately names lists built on payment transactions.
Who may receive a report at all
The permissible purposes section opens by stating that a consumer reporting agency may furnish a consumer report under the following circumstances and no other, and then lists them.
In response to a court order or a subpoena of a kind the section names. In accordance with the written instructions of the consumer to whom the report relates. To a person the agency has reason to believe intends to use it in connection with a credit transaction involving the consumer, for employment purposes, in connection with underwriting insurance, in connection with eligibility for a license or other benefit granted by a governmental instrumentality required by law to consider financial responsibility or status, or as a potential investor, servicer or current insurer in connection with valuing or assessing the credit or prepayment risks of an existing credit obligation.
It also permits furnishing to a person who otherwise has a legitimate business need for the information in connection with a business transaction initiated by the consumer, or to review an account to determine whether the consumer continues to meet its terms. And it names executive departments and agencies in connection with government-sponsored individually-billed travel charge cards, requests from state or local child support enforcement agencies subject to three certifications, agencies administering a named child support plan, and two federal financial regulators acting in named capacities.
The clause about a legitimate business need in connection with a business transaction initiated by the consumer is the one that does the most work in ordinary commerce, and it is bounded by the words initiated by the consumer.
The medical limits on top
The statute layers additional restrictions where medical information is involved, and they run in both directions.
A consumer reporting agency shall not furnish, for employment purposes or in connection with a credit or insurance transaction, a consumer report containing medical information about a consumer, other than medical contact information treated as a named section requires, unless one of three conditions is met.
For an insurance transaction, the consumer affirmatively consents to the furnishing of the report. For employment purposes or a credit transaction, the information must be relevant to process or effect that transaction and the consumer must provide specific written consent that describes in clear and conspicuous language the use for which the information will be furnished. Or the information must pertain solely to transactions, accounts or balances relating to debts arising from the receipt of medical services, products or devices, where the information other than account status or amounts is restricted or reported using codes that do not identify, or provide information sufficient to infer, the specific provider or the nature of the services.
A parallel limit runs at creditors. Except as the statute permits elsewhere, a creditor shall not obtain or use medical information pertaining to a consumer, other than information treated as that named section requires, in connection with any determination of the consumer's eligibility or continued eligibility for credit.
The coding requirement in the third condition is the practical mechanism. It is designed so that a debt arising from health care can appear without disclosing who provided the care or what it was for.
What this settles and what it does not
The statute supplies a test, not a label. Whether a particular business is a consumer reporting agency depends on whether it regularly assembles or evaluates information on consumers, for fees or on a cooperative basis, for the purpose of furnishing consumer reports to third parties, and whether what it furnishes meets the purpose element of the consumer report definition.
That is a fact question about a specific business, and this article answers it for nobody. Nothing here says that any seller in this market, any advertising vendor, or any company that buys or sells information about people is or is not inside the definition.
What the definitions are good for is knowing which question to ask. Everyday language calls any company that traffics in personal information a data broker. The statute does not use that phrase, and the category it does define turns on eligibility purposes rather than on the volume of data held.
A company that only reports its own transactions and experiences with its own customers sits outside the definition of a consumer report by an express exclusion. A company assembling information from many sources for eligibility decisions is described by a different sentence. Reading a privacy notice with the difference in mind is more useful than reading it for the word broker.
Key takeaways
- The statutory category is a consumer reporting agency, defined by regular assembly or evaluation of information on consumers for furnishing reports.
- A consumer report is defined by purpose: serving as a factor in establishing eligibility for credit, insurance, employment or another authorised purpose.
- Reports of a company's own transactions and experiences with its own customer are expressly excluded from the definition.
- That exclusion is cut back for medical information and for lists built on payment transactions for medical products or services.
- The permissible purposes list ends with the words and no other, which is the restriction on who may receive a report.
- Additional limits apply to furnishing medical information in a report and to a creditor obtaining or using it.
Frequently asked questions
What is a consumer reporting agency?
Any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports.
Is every company that sells personal data one?
The statute supplies a test rather than a label, and it does not use the phrase data broker. The definition turns on regularly assembling or evaluating information on consumers for the purpose of furnishing consumer reports, and a consumer report is defined by the purpose the information is used, expected to be used, or collected for. Whether a particular business is inside the definition is a fact question about that business, and this article answers it for no one.
Does a company reporting its own customer dealings fall inside the definition?
The statute excludes from the definition of consumer report any report containing information solely as to transactions or experiences between the consumer and the person making the report. That is an express carve-out, subject to a separate restriction where the information is medical information, an individualized list based on payment transactions for medical products or services, or an aggregate list of identified consumers based on such transactions.
What does the statute count as medical information?
Information or data, whether oral or recorded, in any form or medium, created by or derived from a health care provider or the consumer, that relates to the past, present or future physical, mental or behavioral health or condition of an individual, the provision of health care to an individual, or the payment for that provision. It expressly excludes age, gender, demographic information including residence and email address, and other information not relating to health or condition, including the existence or value of an insurance policy.
Who is allowed to receive a consumer report?
The statute lists circumstances and then says and no other. They include a court order or named subpoena, the written instructions of the consumer, use in connection with a credit transaction, employment purposes, insurance underwriting, eligibility for a government licence or benefit where financial responsibility must be considered, assessment of an existing credit obligation by an investor, servicer or current insurer, and a legitimate business need in connection with a business transaction initiated by the consumer or to review an account.
Are there extra limits where health information is involved?
Yes, in both directions. An agency may not furnish a report containing medical information for employment purposes or in connection with a credit or insurance transaction unless one of three conditions is met, which involve affirmative consent for insurance, relevance plus specific written consent for employment or credit, or reporting restricted to medical debt information coded so as not to identify the provider or the nature of the services. Separately, a creditor may not obtain or use such medical information in determining eligibility for credit, except as the statute permits.
Sources
Each document below is named as it names itself, with the date printed on that document rather than the day it was read.
- United States Code Title 15, Section 1681a, Definitions; rules of construction — read at subsection (d) for the definition of consumer report, its four exclusions and the restriction on sharing medical information at (d)(3); (f) for the definition of consumer reporting agency; (g) file; (h) employment purposes; (i) for the definition of medical information and its exclusion paragraph; and (k) adverse action — Office of the Law Revision Counsel, U.S. House of Representatives, September 2026
- United States Code Title 15, Section 1681b, Permissible purposes of consumer reports — read at subsection (a) in full, including the closing words "and no other" and the legitimate business need clause at (a)(3)(F), and at subsection (g), Protection of medical information, paragraphs (1) and (2) — Office of the Law Revision Counsel, U.S. House of Representatives, September 2026