California Fair Credit Reporting Act Requirements and Rights

The California Fair Credit Reporting Act, codified at Civil Code sections 1785.1 through 1785.36, gives California residents stronger credit reporting rights than the federal Fair Credit Reporting Act alone provides. It restricts who can pull your credit report, limits what can appear on it, gives you tools to fix errors and recover from identity theft, and lets you sue for violations. Where state and federal law overlap, the rule that gives you more protection controls.

What the CFCRA Adds Beyond Federal Law

Federal law sets a national floor. California builds on it in several ways that change what actually shows up on your report and who is allowed to see it.

Employers can only run credit checks on a short list of job types. For most positions in the state, the practice is off the table.¹
Medical debt cannot be reported on a California consumer credit report at all.²
Arrests, indictments, and misdemeanor complaints drop off after seven years from disposition, release, or parole, and come off entirely if there was no conviction.²
Identity theft victims with a police report get up to 12 free credit reports a year and can have fraudulent entries permanently blocked.³
You have up to seven years from when a violation first occurred to sue, compared to five years under federal law.⁴

How Long Negative Information Can Stay on Your Report

Credit bureaus cannot keep adverse items on your file indefinitely. Nothing negative can appear for more than 10 years under any circumstance, and most categories fall off sooner.²

Bankruptcies: 10 years from the date of the order for relief.
Lawsuits and judgments: 7 years from entry or renewal, or until the statute of limitations expires, whichever is longer.
Collection accounts and charge-offs: 7 years, starting 180 days after the delinquency that led to the collection activity.
Paid tax liens: 7 years from date of payment.
Criminal records: 7 years from disposition, release, or parole. Removed entirely if a conviction was pardoned or if an arrest led to no conviction.
Unlawful detainer (eviction) actions: reportable only if the landlord prevailed by default judgment, summary judgment, trial verdict, or a written settlement that specifically allows reporting.
Medical debt: not reportable.

Selling a debt to a new collection agency does not restart the clock. The seven-year period runs from the original delinquency, no matter how many hands the debt passes through.²

Who Is Allowed to Pull Your Report

A credit bureau can only release your report to someone with a permissible purpose spelled out in the statute.⁵ Those purposes include:

A court order from a court with jurisdiction.
Your own written authorization.
Extending, reviewing, or collecting on a credit account.
Evaluating you for hiring, promotion, reassignment, or retention.
Underwriting a personal insurance policy or settling a claim.
Evaluating your application for a rental unit.
Determining eligibility for a license or government benefit that requires review of financial responsibility.
A legitimate business transaction involving you that requires credit information.

Anyone who obtains your report under false pretenses or without a permissible purpose owes at least $2,500 in damages, regardless of what you can prove you lost.⁶

When You Can Get a Free Copy of Your Report

Federal law gives every consumer one free report per year from each nationwide bureau through AnnualCreditReport.com. California layers additional free-copy rights on top of that.

After an adverse action based on your credit, you can request a free copy within 60 days from the bureau that supplied the report.⁷
Identity theft victims with a valid police report qualify for up to 12 free reports over 12 consecutive months, capped at one per month.³
When a 90-day fraud alert on your file expires, you have the right to a free copy at that point.⁷
Unemployed consumers and recipients of public assistance qualify for additional free reports, and the California Attorney General’s office confirms those federal rights apply in the state.⁸

The report you receive has to be understandable. Bureaus must explain codes and abbreviations and maintain toll-free lines and online tools for requests.

Disputing Errors on Your Report

If something on your report is wrong, you can dispute it directly with the credit bureau. The bureau must open a reinvestigation and finish it within 30 business days, and it must notify the furnisher that supplied the disputed information within five business days of receiving your dispute.⁹

The bureau has to consider everything relevant you submit. If the item turns out to be inaccurate, incomplete, or can no longer be verified, it has to be corrected or deleted promptly. The furnisher carries a parallel duty to investigate within the same 30-business-day window and report back to the bureau.¹⁰

A bureau can refuse to reinvestigate if it has reasonable grounds to treat the dispute as frivolous, such as when you haven’t provided enough information to look into the issue. It must tell you that within five business days and explain why.⁹

If a previously deleted item is reinserted, the furnisher must first certify that the information is accurate, and the bureau must promptly tell you the reinsertion happened. If the reinvestigation doesn’t resolve things to your satisfaction, you can add a brief statement of your position to your file.⁹

Identity Theft Rights

California’s identity theft protections are among the strongest anywhere. If you think you are a victim, contact a credit bureau. It must promptly send you a written explanation of your CFCRA rights.³

Once you file a police report under Penal Code 530.5, several stronger tools open up. The bureau must permanently block any information you identify as fraudulent so it no longer appears on your report or gets shared with third parties, and must notify the furnisher of the block. A blocked item can only come back if the bureau finds that your report was materially false, you agree the block was made in error, or you knowingly benefited from the fraudulent transaction.¹¹

Victims with a police report also qualify for those 12 free reports over 12 months, one per month, which is what most people need to actually monitor and clean up a compromised file.³

Security Freezes

A security freeze blocks a credit bureau from releasing your report to anyone without your express authorization, which effectively stops new accounts from being opened in your name. You can request a freeze from any bureau, and it must be placed within three business days. Within 10 business days you receive written confirmation and a unique PIN or password.¹²

To apply for credit while a freeze is in place, you can lift it for a specific party or period, or remove it entirely. Either request has to be processed within three business days once you provide your ID and PIN. Placing, lifting, and removing a freeze is free under federal law, which overrides older California fee provisions.

While the freeze is on, a bureau cannot change your name, date of birth, Social Security number, or address on file without sending you written confirmation within 30 days.

Adverse Action Notices When You Are Denied

When a business denies you credit, rejects a rental application, raises your insurance premiums, or takes another negative action based partly or entirely on your credit report, it has to send you a written notice containing:¹³

A statement that adverse action was taken.
The name, address, and telephone number of the credit bureau that supplied the report.
A statement that the decision was based in whole or in part on credit report information.
Notice of your right to a free copy of your report within 60 days from that bureau and from any other nationwide bureau.
Notice of your right to dispute the accuracy or completeness of any information in the report.

Adverse action is defined broadly. It covers denied or revoked credit, unfavorable changes to existing credit terms, denied insurance or higher premiums, denied or negative employment decisions, and denied rental applications.¹⁴ If the negative decision was based on information from a source other than a credit bureau, the business still has to tell you about your right to ask for the nature and substance of that information within 60 days.¹³

Employer Credit Checks

Under Labor Code 1024.5, an employer in California cannot use a credit report for hiring, promotion, reassignment, or retention unless the position falls into one of these categories:¹

Managerial positions covered by the executive exemption under California wage orders.
Law enforcement and Department of Justice positions.
Positions where the law requires disclosure of credit-related information.
Jobs involving regular access to sensitive personal data such as bank account numbers, Social Security numbers, and dates of birth. Routine processing of credit card applications at retail stores doesn’t count.
Jobs with financial authority, including being an authorized signatory on the employer’s bank account, transferring money, or entering into financial contracts on the employer’s behalf.
Jobs with access to trade secrets or confidential proprietary information that derives economic value from being kept secret.
Jobs involving regular access to $10,000 or more in cash during a workday.

For any other position, an employer cannot factor your credit history into its decision. The restriction does not apply to financial institutions subject to federal regulatory oversight. A report used only to verify income or employment, with no credit history or credit score, is not a “consumer credit report” for purposes of this rule.

Suing for Violations

The CFCRA gives you a private right of action against any credit bureau, furnisher, or business that breaks the rules. Remedies scale with the conduct:⁶

Negligent violations: actual damages, defined to include court costs, lost wages, attorney’s fees, and pain and suffering where applicable.
Willful violations: actual damages plus punitive damages ranging from $100 to $5,000 per violation.
Obtaining a report under false pretenses or without a permissible purpose: a minimum of $2,500 in actual damages.
Class actions: punitive damages to the class as a whole, weighing the frequency of violations, the violator’s resources, and the number of people affected.

Prevailing plaintiffs get court costs and reasonable attorney’s fees, which makes it realistic to bring a claim even when individual damages are modest. You can also seek an injunction forcing the violator to comply, whether or not you also seek money damages.

Filing Deadlines

You have to file suit within two years of the date you knew or should have known about the violation, and no more than seven years from the date liability first arose. The “should have known” language matters. The clock can start when you pull your credit report and see an error, even if you didn’t realize its legal significance at the time. One exception: if the violator willfully and materially misrepresented information it was required to disclose, you get two years from the date you discover the misrepresentation, with no outer time limit.⁴

1
California Legislative Information. California Labor Code 1024.5
2
California Legislative Information. California Code Civil Code CIV 1785.13
3
California Legislative Information. California Code CIV 1785.15.3
4
California Legislative Information. California Code CIV 1785.33
5
California Legislative Information. California Code CIV 1785.11
6
California Legislative Information. California Civil Code 1785.31
7
California Legislative Information. California Code Civil Code CIV 1785.15
8
State of California – Department of Justice – Office of the Attorney General. How to Order Your Free Credit Reports
9
California Legislative Information. California Civil Code 1785.16
10
California Legislative Information. California Code CIV 1785.25
11
California Legislative Information. California Code CIV 1785.16
12
California Legislative Information. California Civil Code 1785.11.2
13
California Legislative Information. California Civil Code 1785.20
14
California Legislative Information. California Civil Code 1785.3