How much leeway does each state have in regulating consumer reporting? Would too much flexibility create conflict between state and federal regulations? Well, now we have a clearer interpretation of these questions.
The Consumer Financial Protection Bureau (CFPB) aligns with Congress’s desire to uphold a comprehensive regulatory scheme, affecting how the FCRA preempts state laws.
What Is It?
On October 28, 2025, the CFPB published an interpretive rule clarifying that the FCRA generally preempts state laws that touch on broad areas of credit reporting. This replaces a July 2022 rule that the bureau withdrew in May 2025.
This rule makes clear that the FCRA’s provisions apply broadly and that the federal government should create national standards for the credit reporting system.
How Does It Work?
We find key language in Section 1681t(b)(1) of the FCRA. This provision sets forth a preemption of state laws “with respect to any subject matter regulated under” specific sections of the FCRA.
The 2022 interpretive rule determined that this provision has a narrow scope, allowing states to impose significant regulation on consumer reporting agencies. As long as the exact requirements set forth in the FCRA text weren’t specifically addressed or influenced, there was leeway.
The CFPB has now changed its position, stating that Congress chose deliberately general and expansive language and that preemption should apply broadly. In other words, the state’s power of interpretation and regulation on matters generally addressed by the FCRA will be limited.
Such matters include:
- Information contained in consumer reports
- Pre-screening
- Data furnisher responsibilities
- Adverse action notices
- Dispute protocols
If a state regulation does not explicitly address or challenge word-for-word provisions within the FCRA but generally touches them, the FCRA will now preempt such regulation.
Who Is Impacted?
All parties involved in consumer reporting will be impacted by this new interpretive rule:
- Consumer reporting agencies conducting background screening across state lines
- Employers and businesses that use consumer reports for hiring or other decisions
- Furnishers of information to consumer reporting agencies
- Consumers whose credit and background information are being reported
- State legislatures
Perhaps the most impacted are CRAs and employers operating in multiple states. The 2022 rule opened such parties up to numerous regulatory schemes and tremendous state-by-state nuance. Now, the FCRA will continue to act as a nationwide framework that preempts related state regulation.
You can find more information on FCRA compliance here.
What Does This Mean for Employers and CRAs?
Less state-by-state regulatory nuance.
The 2022 rule threatened to create what the CFPB now acknowledges would have been “a patchwork system of conflicting regulations”—exactly what Congress wanted to avoid when it strengthened FCRA preemption in 1996 and made it permanent in 2003.
From 2003 to 2022, clarity slowly eroded, leading to a state-favored interpretive ruling. Now, this 2022 ruling has been reversed, resulting in a standardized FCRA framework that will apply to all states and will discourage and limit significant additional regulation on a state-by-state basis.
Why Did the CFPB Change Course?
The CFPB wanted to avoid significant variation and patchwork schemes nationwide. In the long term, such things were thought to create additional confusion and complications regarding consumer reporting.
The CFPB also acknowledged that courts, not federal agencies, are the ultimate arbiters of statutory meaning. Many courts had already been interpreting FCRA preemption broadly, consistent with this new guidance. It seemed that the 2022 rule contradicted the plain language of many FCRA statutes, disregarded legislative history, and could have led to policy that ultimately undermined the credit reporting system.
What About State Consumer Protection Laws?
States certainly still have a role. The FCRA preempts state laws on specific enumerated subject matters, but states can still:
- Regulate in areas not covered by the FCRA’s preemption provisions
- Enforce certain state laws that were in effect before September 30, 1996 (depending on the specific provision)
- Provide greater consumer protections in non-preempted areas
The key is that states can’t create conflicting requirements on matters Congress specifically chose to regulate through the FCRA.
Takeaways
This interpretive rule both reverses the 2022 rule and provides further clarity into what regulatory influence states can have over matters already addressed in the FCRA.
A few things to keep in mind:
- This is interpretive guidance, not a binding regulation. However, it reflects the Bureau’s current position and aligns with how many courts have been reading the statute.
- While the FCRA broadly preempts state laws on covered subjects, staying current with state regulations in non-preempted areas is as vital as ever.
- As always, strong federal compliance is a great foundation. The CFPB is confirming that foundation should be enough for the preempted subject matters.
The federal and state regulatory landscape continues to evolve, but this guidance removes a significant source of uncertainty that emerged from the 2022 rule.
This blog post is for informational purposes only and does not constitute legal advice. Employers and all associated parties should consult with legal counsel regarding specific compliance questions.