Provisions of the Fair Credit Reporting Act (FCRA) (15 U.S.C. § 1681 et seq.), which is the federal law governing consumer information, have been amended by the Consumer Credit Reporting Reform Act of 1996 (Pub. L. No. 104-208, the Omnibus Consolidated Appropriations Act for Fiscal year 1997, Title II, Subtitle D, Chapter 1), Section 311 of the Intelligence Authorization for Fiscal Year 1998 (Pub. L. No 105-107), the Consumer Reporting Employment Clarification Act (CRECA) of 1998 (Pub. L. No. 105-347), Section 506 of the Gramm-Leach-Bliley Act (Pub. L. 106-120), Section 358(g) and 505(c) of the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (USA PATRIOT Act)(Pub. L. 107-156), and the Fair and Accurate Credit Transaction Act (FACTA) of 2003 (Pub. L. No. 108-159). Section 719 of the Financial Services Regulatory Relief Act of 2006 (Public Law 109-351), Section 743 (Div. D, Title VII) of the Consolidated Appropriations Act of 2008 (Public Law 110-161), the Credit and Debit Card Receipt Clarification Act of 2007 (Public Law 110-241), and Sections 205 and 302 of the Credit Card Accountability Responsibility and Disclosure (CARD) Act of 2009 (Public Law 111-24), the Consumer Financial Protection Act of 2010 (CFPA) (Title X of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010, Public Law 111-203) and the Red Flag Program Clarification Act of 2010 (Public Law 111-203).

The Consumer Financial Protection Bureau (CFPB), created in 2010, has assumed responsibility for enforcement of the Fair Credit Reporting Act, the role previously provided by the Federal Trade Commission. The change was implemented by a transfer of FCRA rule making authority from the FTC to CFPB. Specifically, the FCRA requires employers who use outside agencies to perform credit or other background checks (including criminal, reference, or driving record checks), as defined by CRECA, to comply with comprehensive notice, consent, and disclosure obligations both prior to doing the checks and after the results are reported. The provisions of FCRA, CRECA and FACTA directly affect those cities that use outside agencies to secure information about applicants and employees.

The rules apply to anyone over whom the Federal Trade Commission (FTC) has jurisdiction and who maintains or possesses consumer information for business purposes. It applies to individuals and to both large and small organizations that use consumer reports. This includes consumer reporting companies, lenders, insurers, employers, landlords, government agencies, mortgage brokers, car dealers, attorneys, private investigators, debt collectors, individuals who pull consumer reports on prospective at-home employees, and entities that maintain information in consumer reports as part of their role as a service provider to other organizations covered by the rule.