What Is the California Consumer Credit Reporting Agencies Act?

The California Consumer Credit Reporting Agencies Act, found at Civil Code sections 1785.1 through 1785.36, is the state law that controls how credit reporting agencies collect, keep, and share information about you. It works alongside the federal Fair Credit Reporting Act, but it adds protections that go further: tighter limits on employer credit checks, stronger tools for identity theft victims, a free security freeze process, and the right to sue for damages when someone misuses your file. If you live in California, or a credit bureau holds a file on you here, this is the law that sets the rules.

What the Law Covers

The Act applies to every entity that assembles or evaluates consumer credit information to furnish reports to third parties, and to the businesses and individuals who request those reports. It governs the full lifecycle of your credit data: how it’s gathered, how long it stays, who can see it, and what happens when it’s wrong. Any contract clause that tries to make you waive your rights under the Act is unenforceable.

The core requirement is that agencies follow reasonable procedures that balance the needs of commerce with fairness to consumers, with specific attention to confidentiality, accuracy, and proper use.

How It Compares to Federal Law

The federal Fair Credit Reporting Act sets a nationwide floor. California builds on it. One concrete example: under federal law, a criminal conviction can appear on your credit report indefinitely, but California prohibits reporting any conviction more than seven years old, measured from the date of disposition, release, or parole.

The federal law does preempt state rules in certain subject areas, and in 2025 the Consumer Financial Protection Bureau issued an interpretive rule reasserting a broad reading of that preemption, withdrawing a 2022 interpretation that had given states more room.¹ California protections that predate the federal cutoff and provisions on topics outside the preemption list remain intact. Where the two laws overlap, agencies must follow whichever standard is more protective of the consumer.

Who Can See Your Credit Report

An agency can only release your report to someone with a permissible purpose under the law. Those purposes include:²

A court order from a court with proper jurisdiction.
Your own written instructions authorizing release.
A lender considering extending credit to you, reviewing an existing account, or collecting a debt.
An employer, but only within the narrow limits discussed below.
An insurer evaluating your application or settling a claim.
A government agency required by law to consider your financial status for licensing or benefits.
A landlord evaluating your rental application.
A business with a legitimate transaction-related need involving you.

Pulling your report without one of these purposes, or by lying about the reason, carries a damages floor of $2,500.³

Your Right to See Your File

You can inspect everything in your credit file. On request, an agency must give you a decoded written copy, your credit score with the key factors affecting it, a record of every inquiry in the past 12 months, and a list of everyone who received your report for employment purposes in the past two years or for any other purpose in the past 12 months.⁴

The fee cannot exceed eight dollars. You pay nothing if you were turned down for credit, employment, insurance, or a rental within the last 60 days because of information in your report.⁵ Identity theft victims with a valid police report get one free copy per month for up to 12 consecutive months. And separately from state law, every consumer nationwide can get one free report per year from each of the three major bureaus through AnnualCreditReport.com.

Disputing Errors

If you spot something wrong, you can dispute it directly with the credit reporting agency. The agency has 30 business days from receiving your dispute to complete its investigation.⁶ That’s business days, not calendar days, so the real window can run six weeks or longer.

Within five business days of getting your dispute, the agency has to notify the source of the information. It then reviews everything you submitted. If the item turns out to be inaccurate, incomplete, or unverifiable, the agency has to correct or delete it and send you written notice of what changed.

The agency can refuse to investigate if it decides your dispute is frivolous or irrelevant, including when you haven’t given it enough information to work with. If it makes that call, it has five business days to tell you and explain why. If an item was previously deleted, the agency cannot put it back unless the original source certifies it’s accurate, and you have to be notified in writing when that happens.

If you aren’t satisfied with the outcome, you can file a complaint with the Consumer Financial Protection Bureau, which will forward it to the agency for a response.⁷

Security Freezes

A security freeze blocks a credit reporting agency from releasing your report to new creditors without your permission. Because most lenders won’t open an account without pulling a report, a freeze is one of the strongest tools against identity thieves.

Any consumer can place a freeze by written request. The agency has three business days to put it in place and 10 business days to send written confirmation along with a PIN or password you’ll use to lift the freeze later.⁸ The freeze stays until you remove it. When you need to apply for credit, you can request a temporary lift for a specific lender or time period, which the agency must process within three business days.

Under federal law, placing and lifting a freeze is free for every consumer.⁹ You’ll need to freeze your file separately with Equifax, Experian, and TransUnion, because they maintain independent databases. A freeze doesn’t affect your credit score and won’t interfere with existing credit cards or loans.

Identity Theft Protections

If you give a credit reporting agency a valid police report or a DMV investigator’s report documenting the theft, you can have the fraudulent information permanently blocked from your file. Once blocked, that information cannot reappear unless the agency shows by a preponderance of the evidence that you misrepresented the facts, agreed the block was an error, or knowingly benefited from the fraudulent transactions.¹⁰

Identity theft victims with a valid police report also get a free report each month for up to 12 months, and agencies cannot charge them to place or remove a security freeze. Consumers 65 and older get a free initial freeze, though later lifts and removals may cost up to five dollars.

Federal law adds another option: an extended fraud alert that lasts seven years. An alert doesn’t lock your file. It tells lenders to verify your identity before opening new accounts. You only contact one of the three bureaus, and that bureau has to notify the other two.⁹

Limits on Employer Credit Checks

This is where California diverges most sharply from federal law. Under federal law, any employer can check your credit for any job with your written consent. California flipped that: Labor Code 1024.5 bans employer credit checks unless the position falls into one of these categories:¹¹

Managerial roles meeting the executive exemption under California wage orders.
Sworn peace officers and Department of Justice positions.
Positions where a statute requires credit disclosure.
Jobs with regular access to other people’s bank account numbers, Social Security numbers, and dates of birth.
Roles authorized to sign on bank accounts, transfer money, or enter contracts on the employer’s behalf.
Positions involving access to confidential trade secret information with independent economic value.
Jobs with regular access to $10,000 or more in cash during the workday.

Even when the job qualifies, the employer has to give you written notice before pulling the report. That notice must identify which category justifies the check, name the source of the report, and include a checkbox for you to request a free copy.¹² If you’re denied the job based on the report, the employer has to tell you and give you the agency’s name and address.

What You Can Recover for a Violation

You don’t have to wait for a regulator to act. The Act lets you sue any person or entity that violates it, and prevailing plaintiffs recover court costs and reasonable attorney’s fees, which makes smaller cases viable.³ Damages depend on whether the violation was negligent or willful:

For negligent violations, you can recover actual damages, including court costs, lost wages, attorney’s fees, and pain and suffering.
For willful violations, a court can award punitive damages between $100 and $5,000 per violation on top of actual damages, plus any other relief the court finds appropriate.
For obtaining a report under false pretenses or without a permissible purpose, there is a minimum damages floor of $2,500.

Courts can also issue injunctive relief, meaning they can order the offending party to stop the conduct even if you aren’t seeking money. On the regulator side, the California Department of Financial Protection and Innovation can investigate violations of the laws it administers, issue administrative orders, bring civil actions, freeze assets, and refer criminal violations for prosecution.¹³

1
Federal Register. Fair Credit Reporting Act Preemption of State Laws
2
California Legislative Information. California Code CIV 1785.11 – Consumer Credit Reporting Agencies Act
3
California Legislative Information. California Civil Code 1785.31
4
California Legislative Information. California Civil Code 1785.15
5
California Legislative Information. California Code CIV 1785.15 – Consumer Credit Reporting Agencies Act
6
California Legislative Information. California Civil Code 1785.16
7
Consumer Financial Protection Bureau. How Do I Dispute an Error on My Credit Report?
8
California Legislative Information. California Civil Code 1785.11.2
9
Federal Trade Commission. Credit Freezes and Fraud Alerts
10
California Legislative Information. California Code CIV 1785.16 – Consumer Credit Reporting Agencies Act
11
California Legislative Information. California Labor Code 1024.5
12
California Legislative Information. California Code CIV 1785.20.5 – Consumer Credit Reporting Agencies Act
13
Department of Financial Protection and Innovation. Enforcement Division