California Investigative Consumer Report: Consent, Disputes, Damages

A California investigative consumer report is a background report that goes beyond raw credit data to cover a person’s character, general reputation, personal characteristics, or mode of living, and it is regulated by the state’s Investigative Consumer Reporting Agencies Act (ICRAA). The law applies to employers, landlords, insurers, and the agencies that prepare these reports. Before one is ordered, the consumer must receive a written, standalone disclosure and give written authorization. Violations expose the requesting party and the reporting agency to a statutory damages floor of $10,000 per affected consumer, plus attorney’s fees and possible punitive damages.

What Counts as an Investigative Consumer Report

Under California Civil Code Section 1786.2, an investigative consumer report is any consumer report containing information about a person’s character, general reputation, personal characteristics, or mode of living, obtained through any means.¹ The phrase “any means” is broad on purpose. Database searches, social media reviews, public records checks, and personal interviews all qualify.

One exception matters. A report containing only factual credit-record information pulled directly from a creditor or consumer reporting agency is not an investigative consumer report.¹ The moment a background check goes further—criminal history, employment verification through interviews, personal references—the ICRAA applies.

Written Disclosure and Consent Before the Report

Before ordering an investigative consumer report for employment purposes, the requesting party must meet every element of Section 1786.16. The disclosure has to be in writing, clear and conspicuous, and presented as a standalone document devoted solely to the disclosure. It must state that an investigative consumer report may be obtained, identify the permissible purpose, explain that the report may cover character, reputation, personal characteristics, and mode of living, and provide the name, address, and telephone number of the agency conducting the investigation.²

The disclosure must also describe the nature and scope of the investigation and summarize the consumer’s rights under Section 1786.22. After receiving the disclosure, the consumer has to authorize the report in writing. The California Supreme Court has confirmed there is no workaround for this authorization requirement.³

There is one significant exception. When an employer investigates suspected wrongdoing or misconduct by a current employee, the pre-report disclosure and authorization requirements do not apply.² Outside that scenario, skipping any part of the disclosure process is one of the most common—and most expensive—compliance failures.

Information That Cannot Appear in the Report

Section 1786.18 bars reporting agencies from including certain outdated or off-limits information.⁴ The main limits are:

Bankruptcies cannot be reported more than 10 years after the order for relief.
Lawsuits and satisfied judgments cannot be reported more than seven years after filing or entry.
Unsatisfied judgments cannot be reported more than seven years after entry.
Paid tax liens cannot be reported more than seven years after payment.
Collection accounts cannot be reported more than seven years after placement for collection.
Criminal records cannot be reported more than seven years from disposition, release, or parole. Arrests that did not result in a conviction must be removed once the outcome is known, and pardoned convictions must be removed.
Any other adverse information cannot be reported after seven years.
Medical debt cannot be reported at all.
Unlawful detainer actions cannot be reported if the tenant won or the case settled.

The statute also requires the reporting agency to verify the accuracy of any public-record information about arrests, convictions, civil actions, tax liens, or outstanding judgments within the 30 days before furnishing the report.⁴ Stale or unverified public records are a fast route to liability.

Accuracy Duties on the Reporting Agency

Section 1786.20 puts the duty of accuracy on the investigative consumer reporting agency, not the employer or landlord ordering the report. The agency must follow reasonable procedures to assure the maximum possible accuracy of the information in every report it prepares.⁵ “Maximum possible accuracy” is a demanding standard that invites courts to ask whether the agency could have done more.

The user of the report still carries obligations. The requesting party must certify to the reporting agency that it made all required disclosures and will comply with adverse-action procedures.² A user who knows or should know that report data is wrong and acts on it anyway can face liability alongside the agency.

What Happens When a Report Leads to a Denial

When employment, insurance, or a rental application is denied based in whole or part on an investigative consumer report, the person who took that adverse action must notify the consumer and provide the name and address of the reporting agency that prepared the report.⁶ The same rule applies when an insurance premium is raised or a landlord increases rent based on report findings.

For employment reports, the requesting party must also give the consumer a checkbox to request a copy of any report prepared. If the box is checked, the agency has to send the report to the consumer within three business days of delivering it to the requester.² That gives the consumer a chance to catch errors before a hiring decision becomes final.

Seeing and Disputing Your File

Under Section 1786.22, a reporting agency must make a consumer’s file available for visual inspection in person with proper identification, by certified mail on written request, or by telephone summary if the consumer writes in and covers any toll charges.⁷ The agency must provide trained personnel to explain the contents and a written key for any coded information.

If the file contains incomplete or inaccurate information, the consumer can demand a reinvestigation. The agency is then required to verify or correct the disputed items. Agencies that ignore reinvestigation requests or rubber-stamp disputed entries as accurate expose themselves to the statute’s full penalty provisions.

When Both the ICRAA and the Credit Report Law Apply

California has two overlapping statutes: the ICRAA covers investigative consumer reports, and the Consumer Credit Reporting Agencies Act (CCRAA) covers standard credit reports. Background-check companies argued for years that only one or the other could apply. The California Supreme Court rejected that view in Connor v. First Student, Inc.

When a background check contains both credit information covered by the CCRAA and character or reputation information covered by the ICRAA, the company must comply with both statutes. If only credit records are pulled, the CCRAA alone governs. But once a check touches character, reputation, or personal characteristics, the ICRAA applies and written authorization under Section 1786.16 is required even if credit data is also part of the report.³ Since most modern background checks pull from multiple sources, the safe course is to assume both statutes apply and meet the stricter requirements of each.

How the Federal FCRA Fits In

The federal Fair Credit Reporting Act sets a nationwide floor for consumer-report protections and preempts inconsistent state law, a scope reaffirmed in a 2025 Federal Register rulemaking.⁸ The FCRA permits states to add protections beyond the federal baseline, and the ICRAA does exactly that: standalone written disclosure, written consumer authorization, and a higher statutory damages floor.

Section 1786.52 prevents double recovery. A consumer cannot recover under both the ICRAA and the FCRA for the same act or omission, and a final federal judgment bars a later state claim.⁹ Because the ICRAA’s $10,000 damages floor often exceeds what the FCRA provides for a negligent violation, forum choice matters.

Damages, Attorney’s Fees, and Punitives

Section 1786.50 creates liability for any reporting agency or user of information that fails to comply with the ICRAA. The consumer can recover the greater of actual damages or $10,000 in statutory damages, plus court costs and reasonable attorney’s fees.¹⁰ The $10,000 figure is a floor, not a ceiling. In class actions, individual class members are limited to actual damages, but aggregate exposure still climbs quickly.

For grossly negligent or willful violations, the court can add punitive damages on top of everything else.¹⁰ The statute sets no cap. The one safe harbor is narrow: if the violation resulted in a report that was actually more favorable to the consumer, no liability attaches.

The largest exposure often comes from class actions. A missing checkbox on a disclosure form or a boilerplate authorization that bundles ICRAA notices with other employment paperwork can sweep in every applicant who went through the same process. Multiplied across hundreds or thousands of consumers and combined with fees and punitives, the numbers get large fast.

Deadline to Sue

A consumer has two years from the date the violation is discovered to file suit under the ICRAA.⁹ The clock runs from discovery, not from the date of the violation, which matters because consumers often do not learn about a flawed report until they are denied a job or housing and finally see the adverse-action notice. The statute also preserves separate claims for invasion of privacy or defamation, which carry their own limitations periods.

1
California Legislative Information. California Code Civil Code 1786.2
2
California Legislative Information. California Code Civil Code 1786.16
3
Justia. Connor v. First Student, Inc.
4
California Legislative Information. California Code CIV 1786.18
5
California Legislative Information. California Code CIV 1786.20
6
California Legislative Information. California Code Civil Code 1786.40
7
California Legislative Information. California Code CIV 1786.22
8
Federal Register. Fair Credit Reporting Act Preemption of State Laws
9
California Legislative Information. California Code Civil Code 1786.52
10
California Legislative Information. California Code Civil Code 1786.50