There is no new Fair Credit Reporting Act. The FCRA passed in 1970 is still the governing federal law, and its consumer protections are unchanged. What has shifted in 2025 is the regulatory activity around it: the Consumer Financial Protection Bureau finalized a rule to strip medical debt from credit reports in January, a federal court vacated that rule in July, and free weekly credit reports from all three bureaus became permanent. If you came here expecting a rewrite of the statute, there isn’t one. If you came here to find out what actually changed for your credit report, the answers are below.
The Medical Debt Rule Was Struck Down
In January 2025, the CFPB finalized a rule that would have barred creditors from using medical debt information in lending decisions and stopped credit bureaus from including medical debt on reports sent to lenders.1Consumer Financial Protection Bureau. Executive Summary of the FCRA Medical Information Rule It never took effect. On July 11, 2025, the U.S. District Court for the Eastern District of Texas vacated the rule in Cornerstone Credit Union League v. CFPB, finding that it exceeded the Bureau’s authority under the FCRA.2Consumer Financial Protection Bureau. CFPB Finalizes Rule to Remove Medical Bills from Credit Reports The CFPB’s own page for the rule now describes the materials as “for reference only.”
The practical effect: medical debt can still appear on your credit report and can still factor into lending decisions the same way any other unpaid account does. If you have medical collections, expect them to show up and to affect your score.
Free Weekly Credit Reports Are Now Permanent
This is the change you can actually use. The FCRA originally entitled you to one free report per year from each of the three bureaus, Equifax, Experian, and TransUnion, through AnnualCreditReport.com.3GovInfo. Fair and Accurate Credit Transactions Act of 2003 The weekly access the bureaus rolled out during the pandemic is now permanent.4Federal Trade Commission. Free Credit Reports
You can check your report from each bureau once a week at no cost through AnnualCreditReport.com. Equifax is offering six extra free reports per year through 2026 on top of the weekly access.4Federal Trade Commission. Free Credit Reports Pulling your own report does not affect your score.
Enforcement Has Slowed at the CFPB
Your FCRA rights are still fully enforceable, but the agency that historically handled consumer complaints about credit reporting has reduced capacity. Since early 2025, staffing and budget reductions at the CFPB have significantly diminished its complaint resolution operation. If you file a complaint there, expect longer response times than in previous years. This matters when you are trying to escalate a dispute a bureau will not resolve.
What Your Rights Still Are
The following protections come from the FCRA itself and did not change in 2025. They are the tools you actually have.
Disputing Errors
If your report contains inaccurate or incomplete information, you can dispute it with the credit bureau. The bureau generally has 30 days to investigate. That extends to 45 days if you filed the dispute after receiving your free annual report, or if you submit additional information during the initial 30-day window. After finishing, the bureau has five business days to notify you of the results.5Consumer Financial Protection Bureau. How Long Does It Take to Repair an Error on a Credit Report Information that cannot be verified or is confirmed inaccurate must be corrected or removed.6Consumer Financial Protection Bureau. A Summary of Your Rights Under the Fair Credit Reporting Act
Send disputes in writing with supporting documentation: a copy of the report with the error circled, plus records proving the correct information. Also dispute directly with the company that reported the wrong data. If that furnisher confirms it made an error, it must send corrections to every bureau it reported to.5Consumer Financial Protection Bureau. How Long Does It Take to Repair an Error on a Credit Report
If the bureau will not resolve the dispute satisfactorily, you can file a complaint with the CFPB. The Bureau requires that your original dispute be either resolved or more than 45 days old before you file.7Consumer Financial Protection Bureau. Credit and Consumer Reporting Complaint Notice
Adverse Action Notices
When a lender, insurer, or employer takes negative action against you based on your credit report, denying you, offering worse terms, or revoking existing credit, they must notify you.8Federal Trade Commission. Using Consumer Reports for Credit Decisions: What to Know About Adverse Action and Risk-Based Pricing Notices The notice must name the bureau that supplied the report, state that the bureau did not make the decision, and tell you that you can get a free copy of the report within 60 days.
If a credit score was used, the notice must also include your actual score, the date it was generated, the range of possible scores, and the key factors that hurt your score.9Consumer Financial Protection Bureau. Appendix C to Part 1002 – Sample Notification Forms This is one of the most underused protections in the FCRA. If you were denied credit and the notice does not include your score and the factors behind it, the lender may not be complying with the law.
Security Freezes and Fraud Alerts
A security freeze blocks access to your credit file, which prevents anyone, including identity thieves, from opening new accounts in your name. Federal law requires all three bureaus to place and lift freezes for free. Online or phone requests to place a freeze must be honored within one business day. Requests to lift a freeze must be processed within one hour. Mail requests get a three-business-day window.10Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
A fraud alert is different. It tells lenders to verify your identity before opening new accounts but does not block access to your file. An initial fraud alert lasts at least one year, and you only need to contact one bureau, which is required to notify the other two.10Office of the Law Revision Counsel. 15 USC 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts If you are an identity theft victim and file an identity theft report, you can get an extended fraud alert lasting seven years. Both types are free.
Be careful with credit bureau “lock” products marketed as premium alternatives to a freeze. Some charge monthly fees for functionality federal law already gives you for free. A lock may have a slightly friendlier interface, but a freeze has stronger legal protections behind it.
Opting Out of Prescreened Offers
Credit bureaus sell lists of consumers who meet certain criteria to lenders and insurers, who then send unsolicited pre-approved offers. You can stop these at OptOutPrescreen.com or by calling 1-888-567-8688.11Federal Trade Commission. What To Know About Prescreened Offers for Credit and Insurance The online or phone option stops offers for five years. A permanent opt-out requires signing and returning a form from the same website.12OptOutPrescreen.com. OptOutPrescreen.com: Opt-In or Opt-Out of Firm Offers
What You Can Recover If a Company Breaks the Rules
The FCRA lets you sue a credit bureau, furnisher, or report user that violates your rights. What you can recover depends on whether the violation was negligent or willful.
For negligent violations, you can recover actual damages plus court costs and reasonable attorney’s fees.13Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance Actual damages include real financial harm such as credit denials, higher interest rates, or a lost job. Courts have also recognized emotional distress as compensable.
For willful violations, you can recover either actual damages or statutory damages between $100 and $1,000 per violation, whichever is more favorable. The court can also award punitive damages, and it must award attorney’s fees if you prevail.14Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance Punitive damages have no statutory cap, and courts have sometimes counted each inaccurate item or unauthorized disclosure as a separate violation.
You have to file within two years of discovering the violation or five years from when it occurred, whichever comes first.15Office of the Law Revision Counsel. 15 USC 1681p – Jurisdiction of Courts; Limitation of Actions The discovery clock matters because errors often surface only when you apply for credit and get denied.