Permissible Purpose and Tenant Consent: The FCRA Rules Before You Pull a Report

What Permissible Purpose Means

The Fair Credit Reporting Act (FCRA) does not let just anyone pull a consumer report on another person. Under Section 604 of the Act (codified at 15 U.S.C. 1681b), a consumer reporting agency may furnish a report only to someone who has a permissible purpose recognized by the statute. Pulling a report without one is itself a violation, regardless of what the report says or how you use it.

Permissible purposes listed in the statute include a person's written instructions, a credit transaction, employment screening, insurance underwriting, and use in connection with a legitimate business need initiated by the consumer. Reviewing a rental application falls into that last category: when an applicant asks to rent your unit, they have initiated a business transaction that gives you a permissible purpose to evaluate their eligibility.

This is a federal threshold question. It comes before any of the better-known FCRA steps like adverse action notices. If you never had a permissible purpose to obtain the report in the first place, nothing you do afterward cures the problem.

Tenant Screening Is a Permissible Purpose

Landlords, property managers, and rental agents generally have a permissible purpose to obtain a consumer report when they are screening someone who has applied to rent a unit. The FTC's guidance for landlords confirms that tenant screening is a recognized use, and that you may obtain credit reports, criminal background reports, and eviction history reports for that purpose.

The key word is applied. The permissible purpose attaches to a genuine rental transaction the applicant has started. You cannot pull a report on a former tenant out of curiosity, on a current tenant who is not seeking a new agreement, or on someone who merely inquired about a unit but never applied. Each report you order should be tied to an active application for a specific unit.

Getting the Applicant's Consent

Even though a rental application can supply the permissible purpose on its own, obtaining the applicant's written authorization before you order a report is a strong best practice and is required in some situations. Most screening companies and many state laws require the landlord to have the applicant's consent on file, and a signed authorization is the cleanest proof that you had permission.

Why Written Authorization Protects You

A signed authorization documents three things at once: that the applicant knew a report would be obtained, that they agreed to it, and the date you became entitled to order it. If an applicant later claims you pulled their file without permission, the signed form is your evidence. Keep the authorization with the rest of the applicant's file, and retain it according to your records-retention policy. Best practice is to use clear, plain language that states a consumer report may be obtained as part of the screening process.

The Employment Disclosure Rule Does Not Apply Here

There is a common point of confusion worth clearing up. The FCRA's strict standalone-disclosure rule, which requires a clear and conspicuous written disclosure in a document that consists solely of that disclosure, lives in Section 604(b) and applies to consumer reports obtained for employment purposes. That specific standalone-document requirement is an employment rule, not a housing rule. For tenant screening, the FCRA does not mandate a separate standalone disclosure document the way it does for employers. That said, plenty of landlords still use a clear written authorization because it is good practice and may be required by their screening provider or state law. When in doubt, follow your CRA's requirements and check your state statute.

Certifying Your Purpose to the Screening Company

The FCRA requires the person obtaining a report to certify to the consumer reporting agency the purpose for which the report is sought, and to certify that the report will not be used for any other purpose. In practice, you make this certification when you set up an account with a screening provider or when you submit each screening request. By certifying, you are promising that you are pulling the report to evaluate a rental applicant and for nothing else.

This certification is not a formality. Using a report you obtained for screening to instead market to the applicant, sell their data, or make a decision unrelated to the tenancy would breach the certification and the statute. Order reports only through providers that handle this certification properly, and only for applicants you are actively screening.

What You Cannot Do With a Report

Permissible purpose defines both when you can get a report and how you can use it. You cannot share an applicant's consumer report with people who have no role in the rental decision, repurpose it for an unrelated business, or keep pulling fresh reports on someone who is no longer applying. You also cannot use the report in a way that violates other laws, such as applying criminal-history information through a blanket policy that runs afoul of Fair Housing guidance.

If you reject an applicant, raise the deposit, require a co-signer, or take any other unfavorable step based even partly on a consumer report, the FCRA's adverse action requirements then come into play. Permissible purpose gets you the report; adverse action governs what you must tell the applicant after an unfavorable decision. They are separate obligations, and a compliant process handles both.

Penalties for Pulling a Report Without Permissible Purpose

Obtaining a consumer report without a permissible purpose exposes you to liability under the FCRA. For willful noncompliance, Section 1681n allows a consumer to recover either actual damages or statutory damages set by the statute at not less than $100 and not more than $1,000, plus potential punitive damages and reasonable attorney fees. For negligent noncompliance, Section 1681o allows recovery of actual damages plus costs and attorney fees.

Because attorney fees are recoverable and statutory damages can apply without proof of actual harm in willful cases, even a single improperly obtained report can become expensive. The safeguard is straightforward: only pull reports on applicants who have applied, document their consent, certify your purpose honestly to your screening provider, and use the report only to evaluate the tenancy.

Building a Compliant Intake Process

A clean process makes permissible purpose almost automatic. Collect a written application for each unit, include a clear authorization to obtain consumer reports, and order reports only after the applicant has applied and consented. Store the signed authorization with the applicant file so you can demonstrate permission later.

Screening platforms can help by tying every report to an application, capturing the applicant's consent, and producing an audit trail that shows when and why each report was obtained. None of this is a substitute for legal advice, and state requirements vary, so confirm your specific obligations with your screening provider and, where appropriate, an attorney.