Chapter 9: Financial Privacy

Users and Furnishers Under the FCRA

Reviewed by Victor Humenhuk. Published 22 June 2026. Reviewed 31 August 2026.

Beyond CRAs, the FCRA binds users (lenders, insurers, employers who use reports) and furnishers (lenders, retailers who supply data to CRAs). Users need a permissible purpose, must certify it, and must give adverse-action notices; furnishers must provide accurate data and handle disputes.

How this supports CIPP/US study

Use this lesson to separate sectoral scope, data type and regulated entity before testing an exception. Continue with the CIPP/US practice exam.

FCRA roles compared
Role	Who	Core duties
CRA	Experian, Equifax, TransUnion, smaller bureaus	Provide access/dispute, ensure maximum possible accuracy, drop outdated negatives, furnish only for permissible purpose
User	Lenders, insurers, employers	Have and certify a permissible purpose; give adverse-action notice
Furnisher	Lenders, retailers	Provide accurate info, correct/update, give notice of dispute, respond to identity-theft info

Memory hook

CRA sells the report, the user uses it, the furnisher feeds data into it. Each has distinct FCRA duties.

Companies that extend credit, even without using reports to decide, must also run a Red Flags Rule program to detect and deter identity theft.

Key terms - quick answers

What is “User”?

An entity such as a lender, insurer or employer that uses a consumer report; must have and certify a permissible purpose and provide adverse-action notice.

What is “Furnisher”?

An entity such as a lender or retailer that supplies credit history or other personal information to CRAs; must provide accurate data and respond to disputes.

Sources and study method

This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.

Previous lessonCRAs and Consumer Reports Defined Next lessonCRA Core Requirements: Access, Accuracy, Obsolescence