What Is the California Consumer Credit Reporting Agencies Act?

The California Consumer Credit Reporting Agencies Act, codified at Civil Code sections 1785.1 through 1785.36, is the state law that governs how credit reporting agencies collect, keep, and share information about you. It works on top of the federal Fair Credit Reporting Act and adds California-specific protections: tighter limits on employer credit checks, stronger identity theft remedies, a free security freeze process, and a private right to sue when an agency or user of your report breaks the rules. Any contract clause that tries to waive your rights under the law is unenforceable.

What the Law Covers

The CCRA applies to every entity that assembles or evaluates consumer credit information to furnish reports to third parties, and to the businesses and individuals who request and use those reports. It reaches the entire lifecycle of your credit data: how agencies gather it, how long they keep it, who is allowed to see it, and what has to happen when something in your file is wrong.

The statute is built around a balance the legislature wrote into the text itself. Agencies must follow reasonable procedures that weigh the needs of commerce against fairness to consumers, with specific attention to confidentiality, accuracy, and proper use.

How It Compares to the Federal FCRA

The federal Fair Credit Reporting Act sets a national floor. California’s law goes further in several areas. Under federal law, for example, a criminal conviction can be reported indefinitely; under the CCRA, no conviction more than seven years old (measured from disposition, release, or parole) can appear on a report. California also restricts employer credit checks far more tightly than federal law does.

The relationship between the two statutes is not always simple. Section 1681t(b)(1) of the FCRA preempts certain state laws that took effect after September 30, 1996, and a 2025 interpretive rule from the Consumer Financial Protection Bureau reasserted a broad reading of that preemption. The practical result: CCRA protections predating that cutoff remain intact, provisions that address topics outside the federal preemption list also survive, and where the two laws overlap, agencies must follow whichever standard is more protective of you.

Who Is Allowed to See Your Credit Report

The CCRA limits access to parties with a recognized reason to look. A credit reporting agency can release your report only in these situations:1California Legislative Information. California Code CIV 1785.11 – Consumer Credit Reporting Agencies Act

  • A court with proper jurisdiction orders disclosure.
  • You give written instructions authorizing release.
  • A lender is considering extending credit, reviewing your existing account, or collecting a debt.
  • An employer requests it for a position that qualifies under Labor Code 1024.5.
  • An insurer is underwriting a policy or settling a claim.
  • A government agency is required by law to consider your financial status for a license or benefit.
  • A landlord is evaluating a rental application.
  • A business has a legitimate transaction-related need involving you.

Anyone who obtains your report outside these purposes, or who lies to get it, faces a minimum damages floor of $2,500 under the CCRA’s penalty provisions.2California Legislative Information. California Civil Code 1785.31

Your Right to See Your File

On request, an agency must give you a decoded written copy of your file (or a copy with an explanation of the codes used), your credit score with the key factors affecting it, a record of every inquiry from the past 12 months, and a list of everyone who received your report for employment purposes in the past two years or for any other purpose in the past 12 months.3California Legislative Information. California Civil Code 1785.15

The fee for a CCRA disclosure cannot exceed eight dollars. You pay nothing if you were turned down for credit, employment, insurance, or a rental in the last 60 days because of information in the report.4California Legislative Information. California Code CIV 1785.15 – Consumer Credit Reporting Agencies Act Identity theft victims get one free copy per month for up to 12 consecutive months.3California Legislative Information. California Civil Code 1785.15 Separately, federal law entitles every consumer nationwide to one free report per year from each of the three major bureaus through AnnualCreditReport.com.

Disputing Errors in Your File

When you spot something wrong, you can dispute it directly with the credit reporting agency. The agency has 30 business days from receipt of your dispute to complete its investigation, not 30 calendar days, so the actual window can run six weeks or longer.5California Legislative Information. California Civil Code 1785.16

During the investigation, the agency must notify the source of the information within five business days and consider everything you submitted. If the disputed item is inaccurate, incomplete, or unverifiable, it has to be corrected or deleted. You get written notice of the outcome, including what changed.

Agencies can decline to investigate a dispute they deem frivolous or irrelevant, such as one submitted without enough information to work with. If they refuse, they have five business days to tell you and explain why.5California Legislative Information. California Civil Code 1785.16

Deleted information cannot be reinserted unless the source certifies it is accurate, and the agency has to notify you in writing if that happens.5California Legislative Information. California Civil Code 1785.16 If you finish the dispute process unhappy with the result, you can also file a complaint with the Consumer Financial Protection Bureau, which forwards it to the agency for a response.6Consumer Financial Protection Bureau. How Do I Dispute an Error on My Credit Report?

Security Freezes

A security freeze stops a credit reporting agency from releasing your report to new creditors without your express permission. It is one of the more effective tools against someone opening accounts in your name, because most lenders will not extend credit without pulling a report first.

Any California consumer can place a freeze with a written request. The agency has three business days to activate it and 10 business days to send written confirmation with a unique PIN or password you will use to lift the freeze later. The freeze stays in place until you ask to remove it. When you apply for credit, you can request a temporary lift for a specific lender or period, which the agency must process within three business days.7California Legislative Information. California Civil Code 1785.11.2

Under federal law, placing and lifting a freeze is free for all consumers.8Federal Trade Commission. Credit Freezes and Fraud Alerts You need to freeze your file separately at Equifax, Experian, and TransUnion, since each bureau keeps its own database. A freeze does not affect your credit score, and it does not stop you from using existing credit cards or loans.

Identity Theft Protections

If you give a credit reporting agency a copy of a valid police report or a DMV investigator’s report documenting identity theft, you can have fraudulent information permanently blocked from your file. The agency must act promptly, and blocked data cannot come back unless the agency shows by a preponderance of the evidence that you misrepresented the facts, agreed the block was a mistake, or knowingly benefited from the fraudulent transactions.9California Legislative Information. California Code CIV 1785.16 – Consumer Credit Reporting Agencies Act

Identity theft victims with a valid police report also get one free credit report per month for up to 12 consecutive months, and no fees for placing or lifting a security freeze.3California Legislative Information. California Civil Code 1785.15 Consumers 65 and older receive a free initial security freeze, though subsequent lifts and removals may cost up to five dollars.

Limits on Employer Credit Checks

This is the area where California diverges most sharply from federal law. Under federal law, any employer can pull your credit with your written consent. Under California Labor Code 1024.5, most employers cannot pull it at all. Credit checks are only allowed for specific categories of positions:10California Legislative Information. California Labor Code 1024.5

  • Managerial positions that meet the executive exemption under California wage orders.
  • Sworn peace officer roles and Department of Justice positions.
  • Positions where a statute specifically requires credit disclosure.
  • Positions with regular access to other people’s bank account numbers, Social Security numbers, and dates of birth.
  • Roles authorized to sign on bank accounts, transfer money, or enter contracts on the employer’s behalf.
  • Positions with access to confidential proprietary information having independent economic value.
  • Positions with regular access to $10,000 or more in cash during the workday.

Even when a job qualifies, the employer has to give you written notice before requesting the report. The notice must identify which category justifies the check, name the source of the report, and include a checkbox letting you request a free copy.11California Legislative Information. California Code CIV 1785.20.5 – Consumer Credit Reporting Agencies Act If you are denied a job based on the report, the employer has to tell you and provide the agency’s name and address.

What You Can Recover for a Violation

The CCRA lets you sue any person or entity that violates it, and it does not require you to wait for a regulator to act. Damages depend on whether the violation was negligent or willful:2California Legislative Information. California Civil Code 1785.31

  • For negligent violations, actual damages including court costs, lost wages, attorney’s fees, and pain and suffering.
  • For willful violations, actual damages plus punitive damages between $100 and $5,000 per violation, along with any other relief the court finds appropriate.
  • For obtaining a report under false pretenses or without a permissible purpose, a minimum damages floor of $2,500.

Prevailing plaintiffs recover court costs and reasonable attorney’s fees, which lowers the barrier to bringing smaller claims. Courts can also issue injunctions ordering the offending party to stop the violating conduct, even where you are not seeking money damages. In class actions, courts have wide discretion on punitive amounts, weighing how often the violations occurred, the defendant’s resources, and how many people were affected.