If you've ever pulled a credit report on a rental applicant — even once — federal law applies to you. The Fair Credit Reporting Act (FCRA) regulates how consumer reports are obtained, used, and disclosed. Most landlords think compliance ends with "get the applicant's signature." It doesn't. This is the rest of what FCRA requires, in plain English.
For the platform-side picture of how FCRA roles divide between resellers, originating CRAs, and landlord end-users, see our reference page on the FCRA reseller framework.
The five FCRA obligations every landlord has
- Get written, informed consent before pulling. The applicant must know the report is being pulled, by whom, and for what purpose. Verbal consent is not enough.
- Have a "permissible purpose." A rental decision qualifies. Curiosity does not. Pulling reports on applicants you have no genuine intent to rent to is a federal violation.
- Use the report only for the stated purpose. You can't share it with another landlord, your accountant, or post screenshots in a landlord forum. The report must be destroyed or securely retained per your data-retention policy.
- Send an adverse-action notice if you decline based on the report. This is the step everyone forgets. More on it below.
- Comply with state-specific add-ons. California, New York, Washington, Colorado, and several other states layer their own consumer-report rules on top of FCRA. The federal floor is the minimum, not the ceiling.
The adverse-action notice — what landlords miss
The mechanics of the notice — what must be in it, when it must be sent, and the statutory penalty — are covered in detail in our adverse-action notice reference.
Whenever you reject an applicant, raise a deposit, require a co-signer, or otherwise take "adverse action" based even partially on a screening report, FCRA requires you to send a written notice within a reasonable time (most attorneys recommend 5 business days). The notice must include:
- The name, address, and phone number of the consumer reporting agency that supplied the report
- A statement that the agency did not make the decision and cannot explain why
- Notice of the applicant's right to obtain a free copy of the report within 60 days
- Notice of their right to dispute the accuracy or completeness of the information
- If a credit score was used: the score, the range, key factors that affected it, and the date
Failure to send this notice is one of the most common bases for FCRA lawsuits against landlords. Statutory damages can reach $1,000 per violation plus attorney's fees.
Soft pulls vs. hard pulls — which one are you doing?
Reputable tenant screening services use a "soft pull" — it doesn't impact the applicant's credit score, and the applicant authorizes it during application. RentalApplication.ai uses soft pulls only. If you're using a different service and aren't sure, ask the provider directly: hard pulls will erode applicant trust and reduce your application volume.
Data retention and disposal
FCRA's Disposal Rule requires that consumer report information be disposed of in a way that prevents reconstruction (shredding, secure deletion). Storing PDFs of past applicants' credit reports in a Dropbox folder forever is not compliant.
How RentalApplication.ai handles this for you
Our tenant screening platform is FCRA-compliant by default: written e-signed consent, soft pulls only, automatic adverse-action notices on every decline, dispute portal for applicants, and built-in data retention controls. You don't have to remember any of the above — it's enforced in the workflow.
Compliance is not a competitive advantage. It's a baseline. But it's a baseline most cheap screening tools cut to keep their price point. Don't trade $20 of savings for $1,000-per-violation exposure.