FCRA Permissible Purpose and Disclosure: Getting Consent Right Before You Screen

Compliance Starts Before You Pull the Report

Most discussions of the Fair Credit Reporting Act (FCRA) focus on what happens after you deny an applicant, through the adverse action notice. But the FCRA also governs what has to happen before you ever request a consumer report. If you obtain a credit report, criminal background check, or eviction history report without a valid legal basis and proper consent, you can face liability even if you ultimately approve the applicant.

The FCRA applies whenever you use a report from a consumer reporting agency (CRA) to help make a rental decision. This includes the tenant screening companies that bundle credit, criminal, and eviction data. Because those reports are covered consumer reports, the front end of the process carries three core obligations: you must have a permissible purpose, provide a clear disclosure, and obtain the applicant's authorization. This article walks through each. It is general educational information, not legal advice, so confirm the specifics with counsel and your screening provider.

What Permissible Purpose Means

Permissible purpose is the FCRA's rule that you may only obtain a consumer report when you have a legitimate, statutorily recognized reason to do so. Section 604 of the FCRA (15 U.S.C. 1681b) lists the permissible purposes, and reviewing an application in connection with an actual rental transaction is one of them. In plain terms, a landlord or property manager screening a real applicant for a real unit has a permissible purpose.

The key phrase is actual rental transaction. Regulators have emphasized that a consumer report should be pulled only when it is tied to a genuine housing decision the applicant has applied for. Running a report on someone who has not applied, pulling reports out of curiosity, or reusing an old report for a different purpose can fall outside permissible purpose. If you screen an applicant for one property, that permission does not automatically extend to screening them for a different property or a different purpose later.

Disclosure and Authorization Are Two Separate Steps

Having a permissible purpose is not enough on its own. The FCRA also requires that you tell the applicant you intend to obtain a consumer report and that you get their permission. These are commonly treated as two related requirements: a clear disclosure and a written authorization. Best practice is to handle both cleanly and keep a record of them.

The Disclosure Should Be Clear and Standalone

The disclosure informs the applicant that you may obtain a consumer report and use it in your rental decision. Best practice, and the safer reading of the law, is to make this a clear, conspicuous statement that is not buried in dense application fine print. Many practitioners recommend presenting it as a standalone notice so there is no ambiguity that the applicant was informed. It is also good practice to identify the screening company you will use and briefly explain how the report factors into the decision.

Get Written Authorization You Can Prove

Authorization is the applicant's permission to run the report. Obtaining it in writing, whether on paper or through a clear digital checkbox and signature, gives you documentation that consent was granted. Collect authorization from each adult applicant separately, since each is a distinct consumer whose report you are requesting. Retain these signed authorizations with your screening records so you can demonstrate consent if it is ever questioned.

Certifying Your Purpose to the Screening Company

There is a fourth piece that many landlords never see directly because the screening platform handles it. Under the FCRA, whoever obtains a consumer report must certify to the CRA the permissible purpose for which the report will be used and certify that it will not be used for any other purpose. When you sign up with a tenant screening provider, the terms you agree to typically include this certification, and some providers verify your identity and legitimacy as a landlord before granting access.

This is why reputable screening services ask you to attest that you are screening a genuine applicant for housing. Do not treat that step as a formality. Using report data for a purpose other than the housing decision you certified, such as marketing or screening someone who never applied, can breach both your provider agreement and the FCRA.

How This Connects to Adverse Action

Permissible purpose, disclosure, and authorization all happen at the front of the screening process. The adverse action notice happens at the back, if you deny the applicant or offer less favorable terms based in whole or in part on the report. The two ends are connected: doing the front end correctly is what makes it lawful to obtain the report you later rely on, and the adverse action notice is what informs the applicant of their rights regarding that report.

A complete compliant workflow therefore has bookends. Before the report: permissible purpose, disclosure, authorization, and certification. After an unfavorable decision: a pre-adverse and adverse action notice that names the CRA and explains the applicant's right to a free copy of the report and to dispute inaccuracies. Skipping either end creates exposure.

What Getting It Wrong Can Cost

The FCRA allows consumers to sue for violations. For willful noncompliance, courts can award statutory damages that are commonly cited in the range of $100 to $1,000 per violation, along with actual damages, potential punitive damages, and the consumer's attorney fees. For negligent noncompliance, actual damages plus attorney fees may be available. The exact exposure depends on the facts and how a court characterizes the conduct, so treat these figures as general framing rather than a fixed number.

Because the front-end steps are inexpensive and easy to standardize, they are among the least justifiable violations to commit. A clear disclosure, a signed authorization, and a legitimate housing purpose cost almost nothing to implement and remove a whole category of risk.

Building a Compliant Intake Process

Standardize the front end so every applicant goes through the same steps in the same order. Present the disclosure clearly, collect written authorization from each adult applicant, obtain the report only for the specific unit they applied to, and store the disclosure and authorization records with the screening file.

Screening platforms such as TenantFort can help by building consent into the application flow and creating a timestamped record that consent was obtained before the report was requested. Software does not remove your legal responsibility, but a consistent, documented intake process is far easier to defend than reconstructing after the fact whether each applicant was properly informed.