Credit Reporting

Looking Ahead to 2026

In 2025, Goodwin tracked four public enforcement actions related to credit reporting requirements or credit monitoring or repair services. The Consumer Financial Protection Bureau (CFPB) also dismissed six such matters following the change in administration. This is unsurprising when, despite receiving record-high credit reporting complaints from consumers in 2025, the CFPB largely suspended new rulemaking and enforcement in this space.

The CFPB withdrew previous guidance and proposed rulemaking regarding credit reporting that were pending at the end of the Biden administration. This included an amendment that would have classified data brokers selling sensitive consumer information as “consumer reporting agencies” under the Fair Credit Reporting Act (FCRA) and proposed rulemaking that would narrow the scope of the CFPB’s supervisory authority. In addition, the CFPB extended the comment period for an advance notice of proposed rulemaking regarding amending the definitions of “identity theft” and “identity theft report” but took no further action when the comment period expired in April 2025.

While the CFPB dismissed six enforcement actions that were initiated between January 2021 and July 2024, each asserting FCRA and Regulation V claims, it continued its litigation against Experian Information Solutions Inc., alleging that the company failed to take sufficient action concerning consumer disputes, resulting in the inclusion of incorrect information on credit reports.

Looking ahead to 2026, we do not anticipate that the CFPB will propose rulemaking or initiate enforcement actions beyond violations of data furnishing laws and regulations. We are also keeping an eye on potential legal challenges to the CFPB’s determination that FCRA preempts recently passed state laws prohibiting the inclusion of medical debt on consumer reports. 

In the News

CFPB Credit Reporting Complaints Surge

The CFPB’s complaint data revealed a nearly sevenfold increase in monthly credit reporting complaints between 2023 and 2025, rising from approximately 70,000 monthly submissions in January 2023 to a peak of more than 460,000 monthly submissions in October 2025. In its December 2025 “Annual report of credit and consumer reporting complaints,” the CFPB noted that approximately 86% of the complaints it received between January 2024 and June 2025 were about credit consumer reporting. The most common complaints involved concerns of inaccurate information appearing on credit reports concerning “credit inquiries, account and payment statuses, bankruptcies, and […] personal information.”¹ This was followed by complaints of improper usage of credit reports and concerns regarding company investigations into disputes. For example, consumers asserted that credit reporting agencies neglected to validate disputed information provided by data furnishers, while other consumers frequently asserted “it took more than 30 days to reinvestigate disputed reporting.” Consumers also filed complaints about credit monitoring, identity theft protection services, fraud alerts, security freezes, and the inability to obtain a credit report.

In its January 2022 annual report, the CFPB outlined potential factors contributing to the increase in credit or consumer reporting complaint volume. These factors included increases in third-party involvement in the complaint process, awareness of the complaint reporting process during the COVID-19 pandemic, and access to credit reports and scores as well as the follow-on effects of consumers returning to the complaint process once they were aware of the system or to follow up on unresolved complaints. Additionally, in its January 2023 annual report, the CFPB expressed concerns that automated decision-making processes used by the major credit reporting agencies increase burdens on consumers when those processes do not sufficiently respond to consumer complaints. The CFPB also acknowledged that credit reporting agencies needed to grapple with how to respond to consumers’ use of artificial intelligence like ChatGPT to draft complaints in situations when the credit reporting agencies’ software rejects batches of complaints that share common phrases and sentences. The December 2025 annual report noted “all of these factors continue to remain relevant to the dramatic growth in complaint volume” and that “the CFPB is exploring ways to institute reforms to improve the complaint process.”

CFPB Deregulation

Larger Participant Threshold 

In August 2025, the CFPB proposed raising the “larger participant” threshold in the consumer reporting market from nonbank entities with annual receipts resulting from consumer reporting activities in excess of $7 million (as reflected in the previous rule published in 2012) to nonbank entities with such annual receipts in the excess of $41 million, which matches the Small Business Administration’s revenue threshold. According to the CFPB’s notice of proposed rulemaking, the majority of consumer reporting companies examined by the CFPB have “annual receipts exceeding $50 million” and including smaller firms in the definition would divert limited CFPB resources. The CFPB estimated the new definition would “leave at least six larger participants in the market.”

Medical Debt Reporting

In 2025, the CFPB reversed course on the prior administration’s focus on medical debt. In 2022, the CFPB issued an interpretive rule stating that FCRA’s express preemption provisions are “narrow and targeted,” thereby allowing states to pass laws restricting medical debt reporting beyond what federal law provides. Sixteen states have since passed medical debt reporting bans, and legislation is pending in two others. One week before the change in administration, on January 14, 2025, the CFPB issued an interpretive rule (the Medical Debt Rule) restricting the inclusion of medical data information on consumer reports furnished to creditors, barring creditors from considering a consumer’s medical debt when making credit decisions, and prohibiting credit reporting agencies from reporting medical debt information to creditors if prohibited by state law.

Under its current administration, the CFPB undid each rule. First, in April 2025, the CFPB and trade association plaintiffs filed a joint motion for consent judgment with the U.S. District Court for the Eastern District of Texas to vacate the Medical Debt Rule, arguing that the rule exceeded the CFPB’s authority and was contrary to the FCRA. In July 2025, the District Court granted that motion. Second, in May 2025, the CFPB withdrew the 2022 interpretive rule on preemption under FCRA and followed up with a clarifying interpretive rule in October 2025, explaining that it is possible that the FCRA “generally preempts State laws that touch on broad areas of credit reporting, consistent with Congress’s intent to create national standards for the credit reporting system.”

Federal Legislation

With strong bipartisan support, Congress passed the Homebuyers Privacy Protection Act (HPPA), which President Trump signed into law in September 2025. The legislation amends the FCRA by limiting the extent to which consumer reporting agencies can furnish “trigger leads” — leads generated when consumers apply for mortgages and credit inquiries alert credit bureaus, which then sell consumers’ information to other mortgage lenders.

According to a letter signed by 42 attorneys general from across the states and territories urging passage of the HPPA and addressed to the leadership of the House Committee on Financial Services and the Senate Banking, Housing, and Urban Affairs Committee, the HPPA seeks to correct the problem of consumers “receiving dozens, sometimes hundreds, of unwanted calls and text messages from unknown (and often irrelevant) companies following a single credit inquiry.” The letter also states that “although trigger leads may theoretically increase competition among credit lenders, a significant number of trigger leads are used outside of this context and disguised as a firm offer of credit,” which can be “extraordinarily confusing to consumers.”

After passage of the HPPA, consumer reporting agencies may only furnish consumer reports to third parties if the transaction (i) involves “a firm offer of credit or insurance” and (ii) the third party is (a) the originator or servicer of the consumer’s “current residential mortgage loan,” (b) “an insured depository institution or credit union” that “holds a current account for the consumer,” or (c) consumer-authorized. The HPPA went into effect on March 4, 2026.

Notable 2025 Enforcement Highlights

Biden-Era CFPB Administrative Proceedings

In January 2025, the CFPB entered into two consent orders: one with American Honda Finance Corporation (Honda) and the other with Equifax Inc. and Equifax Information Services LLC (collectively, Equifax).

The first consent order settled claims that, during the COVID-19 pandemic, Honda violated the FCRA when it “allowed consumers to defer payments and promised to continue reporting” their accounts to consumer reporting agencies as current but instead reported the accounts “as delinquent when they did not make payments during the deferral period.” In the consent order, Honda agreed to pay $10.3 million in consumer redress and a $2.5 million civil money penalty.

The second consent order settled claims that Equifax violated the FCRA by failing to (i) properly conduct reinvestigations of disputed information in consumer files, (ii) “prevent the improper reinsertion of previously” deleted information from consumer files, (iii) “provide adequate written notice” of its reinvestigation results to consumers, (iv) follow “reasonable procedures to assure maximum possible accuracy of the information” Equifax reports on consumers, and (v) block reporting of information that consumers identified as resulting from identity theft as well as provide appropriate notice when such blocks were declined or rescinded. The CFPB also found that Equifax engaged in “unfair acts and practices by using ineffective systems and flawed processes with […] excessive deference to furnishers” to resolve consumer disputes by failing to “adequately inform consumers of the results of reinvestigations” and selling inaccurate consumer credit scores and credit attributes after “it introduced ‘test code’ in a production environment in a scoring model server.” Equifax agreed to pay a $15 million civil money penalty.

Trump Administration CFPB Voluntary Dismissals

Within the first five months following the change in its administration, the Russell Vought–led CFPB voluntarily dismissed with prejudice six pending litigation enforcement actions asserting, among others, alleged violations of FCRA/Regulation V: CFPB v. 1st Alliance Lending, LLC; CFPB v. TransUnion et al; CFPB v. Snap Finance et al; CFPB v. SoLo Funds, Inc.; CFPB v. Pennsylvania Higher Education Assistance Agency; and CFPB v. Acima Holdings et al. 

CFPB v. Experian

Despite voluntarily dismissing the six actions previously discussed, the current administration is pressing forward with CFPB v. Experian Information Solutions, Inc., pending in the U.S. District Court for the Central District of California. The action was initiated at the tail end of the Biden administration, with the CFPB asserting that Experian violated the FCRA and the Consumer Financial Protection Act (CFPA) by not taking “sufficient steps to intake, process, investigate, and notify consumers about consumer disputes, resulting in the inclusion of incorrect information on credit reports.”

After multiple rounds of motion to dismiss briefing, in which portions of the FCRA claims were dismissed without prejudice on timeliness grounds and two of the CFPA claims were dismissed without prejudice for failure to sufficiently plead to substantial injury, the CFPB’s second amended complaint cured the timeliness defects and abandoned one of the CFPA claims, leaving the operative complaint with nine FCRA claims and three related CFPA claims, including allegations that Experian failed to notify data furnishers of disputed information in more than 2 million cases and conduct timely reinvestigations on more than 100,000 occasions; unreasonably relied on furnishers’ Automated Credit Dispute Verification responses when it was on notice that the information “from the furnisher may be suspect”; and provided consumers with notices of the results of their reinvestigations that stated contradictory results or were either incomplete or unintelligible. In November 2025, Experian answered the complaint. The action’s litigation will continue into 2026.

State-Level Activity

New York

In January 2025, New York reached a $725,000 settlement with Equifax Information Services for allegedly causing a “negative score shift” for more than 75,000 New Yorkers due to a coding change that affected the company’s scoring models in March and April 2022. As we reported at the time, in addition to paying “$725,000 to the state of New York to be used as consumer redress and penalties,” Equifax Information Services agreed to “ensure that its marketing materials accurately represented the manner in which it calculated credit scores, review and update its policies and procedures for making technological changes which may impact credit score calculations, and to implement reasonable procedures to ensure maximum accuracy in credit reporting.” In turn, the New York attorney general agreed to discontinue its investigation into Equifax Information Services’ practices.

California

In response to the CFPB’s interpretive rule setting forth its position that the FCRA preempts state medical debt laws, the California attorney general issued a consumer alert in November 2025 to remind “consumers, healthcare providers, and credit reporting agencies that in California it remains illegal for medical debt to appear on credit reports” pursuant to a state law that went into effect on January 1, 2025.

* * *

Read the next chapter, “Student Lending.”