What the CFPB’s Recent FCRA Preemption Guidance Gets Wrong

In a head spinning 180 degree pivot, the Consumer Financial Protection Bureau (CFPB) under Acting Director Russell Vought has issued a new interpretive rule claiming that the Fair Credit Reporting Act (FCRA) preempts all state laws that regulate the contents of consumer reports and what creditors and others can report or “furnish” to consumer reporting agencies (CRAs).  See Fair Credit Reporting Act; Preemption of State Laws, 90 Fed. Reg. 48,710 (Oct. 28, 2025).  This 2025 interpretive rule is the polar opposite of the CFPB’s 2022 interpretive rule, which had stated that “FCRA’s express preemption provisions have a narrow and targeted scope.”  The Fair Credit Reporting Act’s Limited Preemption of State Laws, 87 Fed. Reg. 41,042 (July 11, 2022).

By its own terms, the 2025 interpretive rule has no direct effect on state laws. As the interpretive rule itself expressly states, the status of those laws is fundamentally a question for courts if and when those laws are challenged, not a matter to be decided by the CFPB.  90 Fed. Reg. at 48,711.  Nonetheless, the rule clearly is aimed to support any future efforts to preempt the 15 state laws that prohibit the reporting of medical debt on credit reports, which are discussed in another NCLC Digital Library article, The Latest on Keeping Medical Debt Out of Credit Reports, updated September 3, 2025.  The 2025 interpretive rule also appears to be aimed at state laws that prohibit the reporting of certain criminal records, such as Colorado’s law regarding sealed, expunged, and non-conviction records. Colo. Rev. State. § 5-18-109(1)(e.5). 

This article provides an overview of FCRA preemption, discusses why the new 2025 interpretive rule is wrong, sets out arguments as to why the 2022 CFPB interpretive rule is correct that the scope of FCRA preemption is narrow and targeted, and provides suggestions for state policy advocates on how to “preemption proof” their state laws even if courts were to hold that the 2025 interpretive rule is correct.

Overview of FCRA Preemption

FCRA preemption is a messy and complicated topic.  Under the FCRA, there are several different types of preemption, as set forth in 15 U.S.C. § 1681t.  These include:

Type One:  Subsection 1681t(a) provides the baseline for FCRA preemption, stating:

Except as provided in subsections (b) and (c), this subchapter does not annul, alter, affect, or exempt any person subject to the provisions of this subchapter from complying with the laws of any State with respect to the collection, distribution, or use of any information on consumers, or for the prevention or mitigation of identity theft, except to the extent that those laws are inconsistent with any provision of this subchapter, and then only to the extent of the inconsistency.

Type Two:  Subsection 1681t(b)(1) provides for stronger, express preemption, stating:

No requirement or prohibition may be imposed under the laws of any State—
(1) with respect to any subject matter regulated under— 
*          *          *
(E) section 1681c of this title, relating to information contained in consumer reports, except that this subparagraph shall not apply to any State law in effect on September 30, 1996;
(F) section 1681s-2 of this title, relating to the responsibilities of persons who furnish information to consumer reporting agencies, except that this paragraph shall not apply to [two specific provisions of Massachusetts and California state FCRA laws].

There are a number of other sections and subsections subject to § 1681t(b)(1)’s Type Two preemption, which include §§ 1681b(c) and (e) (prescreening use of consumer reports), 1681i (timeline for investigations), 1681m(a), (b), (d), and (h) (user-required notices), 1681g(e) (consumer access to ID theft information), 1681s-3 (affiliate sharing), and 1681c-1(i), (j), and (k) (security freezes and credit monitoring for active duty military).

Type Three:  Subsection 1681t(b)(5) provides a different type of express preemption, stating: 

“No requirement or prohibition may be imposed under the laws of any State— ….. (5) with respect to the conduct required by the specific provisions of—” 
[a list that includes §§1681c(g), 1681c-1, 1681c-2, 1681g(a)(1)(A), 1681j(a), 1681m(e) , (f), and (g), 1681s(f), 1681s-2(a)(6), and 1681w].

Thus, different sections and even subsections of the FCRA are subject to different types of preemption. 

Type One preemption is the least stringent form, basically setting a floor but not a ceiling for state law regulation.  Under this standard, the FCRA does not preempt a state law unless there is a specific inconsistency between the FCRA and the state law, which exists only where the actor would violate the FCRA by complying with the state statute. See Davenport v. Farmers Ins. Grp., 378 F.3d 839, 843 (8th Cir. 2004); Aghaeepour v. N. Leasing Sys., Inc., 378 F. Supp. 3d 254, 263 (S.D.N.Y. 2019). A state law is not inconsistent with the FCRA merely because it gives consumers more protection than does the federal act. Credit Data of Arizona, Inc. v. State of Ariz., 602 F.2d 195, 198 (9th Cir. 1979).

Type Two and Three preemption do expressly preempt more protective state laws.  The legal issue in many cases involving these preemption provisions involves the scope of the preemption.  For example, the issue in one of the most important Circuit Court decisions on FCRA preemption, Consumer Data Indus. Ass'n (CDIA) v. Frey, 26 F.4th 1 (1st Cir. 2022), was the scope of preemption under § 1681t(b)(1)(E), which preempts State laws “(1) with respect to any subject matter regulated under— … (E) section 1681c of this title, relating to information contained in consumer reports.”  The industry contended that this paragraph preempted all state laws that regulate what information can be included in credit and other consumer reports, placing emphasis on the phrase “information contained in consumer reports.” The State of Maine, on the other hand, argued that this paragraph preempts only the specific issues addressed in § 1681c, placing the emphasis on “subject matter regulated under . . . section 1681c.” Under the State of Maine’s interpretation, preemption would be limited to the specific duties and prohibitions set forth in § 1681c, most notably the “obsolescence” or time limits on negative information.  The State of Maine’s interpretation prevailed in CDIA v. Frey.

Impact of FCRA Preemption Depends on the Type of State Law

Because of its fractured nature, one of the important issues in dealing with FCRA preemption is: “What provisions of the FCRA does a state law implicate?”  For example, state statutes that address medical debt in credit reports contain several different types of prohibitions, which regulate different sets of actors. These include:

i.  A prohibition on CRAs including medical debts in credit reports;
ii.  A prohibition on providers and debt collectors (called “furnishers”) reporting or furnishing medical debt to CRAs;
iii.  A prohibition on creditors using medical debts on credit reports in their credit decisions.

Each of these provisions implicate a different preemption provision in § 1681t(b):

i.  The prohibition against CRAs including medical debt on credit reports implicates § 1681t(b)(1)(E), which provides that state laws are preempted “with respect to any subject matter regulated under— … (E) section 1681c of this title, relating to information contained in consumer reports.”  This is Type Two preemption and the critical issue is, as discussed above, the scope of this preemption. 
ii. The prohibition against furnishing medical debt to CRAs implicates § 1681t(b)(1)(F), which provides that state laws are preempted “with respect to any subject matter regulated under— … (F) section 1681s-2 of this title, relating to the responsibilities of persons who furnish information to CRAs.  This is also Type Two preemption and the critical issue is also the scope of this preemption.
iii. Prohibitions on creditors and other users (e.g., landlords, employers, insurers) of credit reports implicates preemption under § 1681t(a), which is Type One preemption, i.e., floor-not-ceiling preemption.  That is because the permissible uses of a credit report or consumer report are governed by § 1681b(a) of the FCRA, which is not a provision in the laundry list governed by Type Two or Three preemption.

Thus, prohibitions on users (creditors, landlords, employers, insurers) using medical debt are the most likely to avoid FCRA preemption.  In fact, many state insurance laws prohibit consideration of medical debts in insurance credit scoring, given that the model law from the National Council of Insurance Legislators includes such a provision. See NCLC’s Fair Credit Reporting Appendix H for a summary of state laws.  Other state laws governing users include the laws in the 11 states and municipalities that regulate the use of credit reports by employers.  Id. at § 7.2.4.1.2.

The Vought-Era CFPB Interpretive Rule is Not Legally Binding

The 2025 CFPB interpretive rule is not legally binding, and it even states itself that “[a]s guidance, this interpretive rule does not have the force or effect of law. It has no legally binding effect, including on persons or entities outside the Federal government.” 90 Fed. Reg. at 48,715.  It was not issued pursuant to notice and comment rulemaking under the Administrative Procedures Act; even if it had been, the Supreme Court’s decision in Loper Bright Enterprises v. Raimondo, 603 U.S. 369 (2024), means that it would not be entitled to judicial deference because it is a legal interpretation of the statutory language of the FCRA. 

The CFPB had already withdrawn the CFPB’s 2022 interpretive rule on this subject in a previous document.  See NCLC’s Continued Vitality of 67 Withdrawn CFPB Guidance Documents (May 13, 2025).  Further, the 2025 CFPB interpretive rule now states that it “was unnecessary for the Bureau in 2022 to opine on the scope of preemption under the FCRA.” 90 Fed. Reg. at 48,711.  This raises the question of why the CFPB felt it necessary or appropriate to now opine on that subject, especially since it had already withdrawn the 2022 guidance. 

Perhaps more importantly, as the 2025 CFPB interpretive rule correctly states, “The Supreme Court has recently reaffirmed that courts are the ultimate arbiters of statutory meaning, and ‘in particular agencies have no special authority to pronounce on pre-emption absent delegation by Congress.’”  Id. (citing Loper Bright and Wyeth v. Levine, 555 U.S. 555, 577 (2009)).  Thus, the rule expressly acknowledges that the status of the 15 state laws on medical debt credit reporting will depend on judicial decisions if and when those laws are challenged.

The 2025 Interpretive Rule Should Have Negligible Persuasive Value

  —The 2025 Interpretive Rule was Not Based on Reasoned Decision-Making and Contrary to the Consumer Protection Purposes of the FCRA

At best, the 2025 interpretive rule is only entitled to persuasive value.  The persuasive value of the 2025 interpretive rule should be negligible for several reasons.

The radical shift from the 2022 interpretive rule makes clear that it is politically motivated and results oriented, not based on reasoned decision-making. This type of drastic change in position was recently criticized by the Supreme Court and was one of the factors that led the Court to eliminate the deference that it had previously accorded to administrative agencies in Chevron v. Natural Resources Defense Council, Inc., 467 U.S. 837 (1984). Loper Bright Enters. v. Raimondo, 603 U.S. at 410–411 (“Under Chevron, a statutory ambiguity, no matter why it is there, becomes a license authorizing an agency to change positions as much as it likes, … Chevron thus allows agencies to change course even when Congress has given them no power to do so. By its sheer breadth, Chevron fosters unwarranted instability in the law, leaving those attempting to plan around agency action in an eternal fog of uncertainty.”).

Furthermore, the rationale behind this sudden shift is contrary to the very purpose of the FCRA as a consumer protection statute.  Some of the reasons cited in the 2025 interpretive rule are to “reduce compliance burdens” and the desire for “uniform national standards.” 90 Fed. Reg. at 48,711, 48,714.  However, reducing compliance burdens is not a stated purpose of the FCRA, which is a consumer protection statute with the purpose of requiring CRA to “adopt reasonable procedures for meeting the needs of commerce for consumer credit, personnel, insurance, and other information in a manner which is fair and equitable to the consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization of such information.”  15 U.S.C. § 1681(b). See Moran v. Screening Pros, L.L.C., 943 F.3d 1175, 1186 (9th Cir. 2019) (“the purpose of the FCRA warrants an interpretation that favors the consumer” because that Act’s “consumer oriented objectives support a liberal construction”). See generally NCLC’s Fair Credit Reporting § 1.3.1. 

With respect to national uniformity, if Congress had wanted that sweeping of a scope of federal preemption, it would have said so.  As the First Circuit stated in one of the leading cases on FCRA preemption, “if as CDIA claims, Congress intended to preempt all state laws relating to information contained in consumer reports, it could have easily so stated. Congress knows how to preempt states from regulating entire subject areas.”  CDIA v. Frey, 26 F.4th 1, 8 (1st Cir. 2022).

  —The 2025 Interpretive Rule Barely Mentions Three of the Most Important Recent Cases on FCRA Preemption

Second, the 2025 interpretive rule fails to substantively address the most recent and important Circuit Court decisions on the topic of FCRA preemption, instead relegating discussion of them to a footnote.  This includes the First Circuit in CDIA v. Frey, 26 F.4th 1 (1st Cir. 2022), which is perhaps the most thoroughly reasoned and deeply analytical of the preemption decisions, where the issue was squarely before the court.  The First Circuit in that case narrowly construed the scope of FCRA preemption with respect to the contents of consumer reports, noting that CDIA’s argument would render the statutory cites in § 1681t(b)(1)(A) through (K) as statutory surplusage which it declined to do because “[w]e cannot treat those words ‘as stray marks on a page—notations that Congress regrettably made but did not really intend.’” Id. at 8 (citations omitted).

The 2025 interpretive rule similarly gives short shrift to the Ninth Circuit in Aargon Agency Inc. v. O’Laughlin, 70 F.4th 1224 (9th Cir. 2023), which rejected the industry’s argument that § 1681t(b)(1)(F) “broadly preempts any state law ‘relating to’ a furnisher's duties.” Id. at 1235.  Instead, the Ninth Circuit expressed agreement with the First Circuit in CDIA v. Frey and held that the preemptive effect of § 1681t(b)(1)(F), like § 1681t(b)(1)(E), is limited to the specific requirements imposed by the underlying statutory section, in this case § 1681s-2.  Id. 

The 2025 interpretive rule also failed to substantively address the Second Circuit’s decision in Galper v. JP Morgan Chase Bank, 802 F.3d 437 (2d Cir. 2015).  Like Aargon Agency v. O’Lauhglin, Galper held that § 1681t(b)(1)(F) preempts only those claims against furnishers that are “with respect to” the subject matter regulated under § 1681s-2, such as accuracy and dispute handling requirements. In so holding, the Second Circuit noted that § 1681t(b)(1)(F) should be construed “fairly but narrowly, mindful in the appropriate case that ‘each phrase within [the provision] limits the universe of [state action] pre-empted by the statute.’”  Id. at 445 (quoting Lorillard Tobacco Co. v. Reilly, 533 U.S. 525, 551 (2001) (alterations in original; emphasis added)).

Both the First Circuit in CDIA v. Frey and the Ninth Circuit in Galper v. JP Morgan Chase believed that the text of these FCRA preemption provisions were unambiguous in being limited to the scope of the specific duties enumerated in § 1681c and § 168s-2.  But the Ninth Circuit also noted that to the extent the preemption provisions were ambiguous, “when the text of a pre-emption clause is susceptible of more than one plausible reading, courts ordinarily accept the reading that disfavors pre-emption.” (quoting CTS Corp. v. Waldburger, 573 U.S. 1, 19 (2014) and Altria Grp., Inc. v. Good, 555 U.S. 70, 77 (2008)).  Galper v. JP Morgan Chase Bank, N.A., 802 F.3d 437 at 448.

Not only does the 2025 interpretive rule fail to substantively analyze CDIA v. Frey, Aargon Agency v. O’Laughlin, and Galper v. JP Morgan Chase, it does not even mention them in the text of the guidance, instead relegating them to a footnote.  Its sole argument—that these cases are incorrect—is to merely state “those decisions are flawed for the same reasons as the 2022 interpretive rule, incorrectly relying on Dan’s City for the proposition that the ‘with respect to’ clause limits the scope of preemption.”  90 Fed. Reg. 48,715. 

But it is not true that the courts in CDIA v. Frey, Aargon Agency v. O’Laughlin, and Galper v. JP Morgan Chase simply relied on Dan's City Used Cars, Inc. v. Pelkey, 569 U.S. 251 (2013) (holding that the language “with respect to” limits preemption clause of Federal Aviation Administration Authorization Act, and finding no preemption).  Instead, these courts engaged in thorough statutory analysis and each came to the same conclusion—that the industry’s (and 2025 interpretive rule’s) overreaching preemption argument was contrary to the plain language of the statute, was not a natural reading of the language, and most importantly, rendered the statutory citation as mere surplusage which these Courts believed that Congress did not intend.  Although the courts in CDIA v. Frey, Aargon Agency v. O’Laughlin, and Galper v. JP Morgan Chase cited Dan’s City, their statutory analysis and decisions did not hinge upon the case.

Instead of discussing (and barely mentioning) the three most significant recent cases on FCRA preemption, the 2025 interpretive rule cites Premium Mortgage Corp. v. Equifax, Inc., 583 F.3d 103 (2d Cir. 2009), a case involving use of “prescreened” consumer reports.  It also cited Ross v. FDIC, 625 F.3d 808, 813 (4th Cir. 2010) and several other decisions that involve the issue of whether state claims under unfair or deceptive acts or practices (UDAP) statutes or for common law claims such as defamation and libel were preempted.  These cases are inapposite because they involve claims against users and furnishers that directly overlap with the statutory sections that were the subject of the preemption provision. For example, in Ross v. FDIC, the Fourth Circuit noted that the consumer’s UDAP claim “concerns WaMu’s reporting of inaccurate credit information to CRAs, an area regulated in great detail under § 1681s-2(a)–(b).” 625 F.3d at 813 (emphasis added).

The cases cited by the 2025 interpretive rule did not involve the issue of whether states can regulate the contents of consumer reports beyond specific duties enumerated under § 1681c or the furnishing of information to CRAs beyond accuracy issues regulated by § 1681s-2, such as laws that prohibit furnishing information to protect a consumer’s privacy. Thus, the 2025 interpretive rule fails to even mention the California Supreme Court in Brown v. Mortensen, 51 Cal. 4th 1052 (Cal. 2011), which held that FCRA did not preempt claims under the California’s Confidentiality of Medical Information Act because those claims had “as their gravamen issues neither of accuracy nor of credit dispute resolution,” and thus involved subject matter different from that of § 1681s-2.  Id. at 1072.

  —The Legislative History Indicates that Congress Did Not Intend to Preempt All State Regulation of CRAs and Furnishers

Third, contrary to the 2025 interpretive rule, the legislative history of the FCRA provides clear evidence that Congress did not intend § 1681t(b)(1) in general to have a broad, sweeping scope of preemption, and in particular did not intend to preempt all state regulation of what can and cannot be included in a consumer report.  For example, in April 1995, Senator Christopher (“Kit”) Bond (R-MO) introduced the Consumer Reporting Reform Act of 1995, S. 709, 104th Cong. (1995), which was the bill that would be later become the 1996 Reform Act Amendments to the FCRA that added the language in § 1681t(b)(1)(E). In introducing the bill, Senator Bond explained:

This bill also contains limited Federal preemption to ensure that there are uniform Federal standards to govern a number of procedural issues which are part of credit reporting and which will reduce the burdens on the credit industry from having to comply with a variety of different State requirements. For example, the bill preempts requirements regarding prescreening, information shared among affiliates, reinvestigation timetables, obsolescence time periods and certain disclosure forms.

141 Cong. Rec. S5450 (daily ed. Apr. 5, 1995) (statement of Sen. Bond) (emphasis added). 

The preemption provision that Senator Bond included in S. 709 in 1995 contains language nearly identical to what became the preemption provision at current § 1681t(b)(1)(E).  Senator Bond’s statement makes clear that he believed the preemption provision would be limited in scope, and that with respect to § 1681c, such preemption only involved the obsolescence time limits for negative information.

Statements by the other co-sponsor of S. 709, Senator Richard Bryan (D-NV), similarly indicate that the preemption provisions were intended to be limited in scope. Senator Bryan noted:

This legislation tries to craft a delicate balance on the issue of State preemption. Senator BOND and I are both former Governors so we take States’ rights very seriously. We have tried to only preempt those areas of this law which affect the operational efficiencies of businesses but do not harm consumers. Setting a national uniform standard for disclosure forms or time-tables, does not set the consumer movement back, yet should help the business community operate more efficiently.

I would like to put everyone on notice that I feel very strongly that we should not preempt States’ rights in the area of liability—particularly if we set a low-liability standard as we do in this bill. Certain members of the business community have and will continue to push to preempt this area of State law, but I will fight such efforts and will have to reconsider the merits of this bill, should I lose on this issue.

141 Cong. Rec. S5450 (daily ed. Apr. 5, 1995) (statement of Sen. Bryan).

Senator Bryan’s remarks are hardly the words of a man who thought he was prohibiting states from being able to adopt greater protections for consumers with respect to any of the information that is permitted to be included in a consumer report.

Advice for State Policy Advocates to Preemption-Proof State Medical Debt Credit Reporting Statutes

For state advocates that are currently working on bills to ban medical debt from credit reports, or want to modify their existing state law to better withstand a preemption challenge, NCLC recommends adding the following provisions:

• A provision prohibiting users, including creditors, landlords, and employers, from considering medical debt on credit reports. As discussed above, state laws regulating usage of consumer reports are less vulnerable to preemption.
• A provision requiring health care providers to include in their contracts with debt collectors a clause prohibiting the debt collector from furnishing the debt to CRAs.  Such a provision only indirectly implicates the FCRA, since it governs the relationship between a health care provider and a debt collector which is not something addressed in the federal Act.

For more on these recommendations, see NCLC’s Prevent Medical Debt from Ruining Credit Reports: Recommendations in the Face of Potential Federal Preemption Threat (updated August 2025).

Additional material is available in NCLC’s The Latest on Keeping Medical Debt Out of Credit Reports, including a discussion of the voluntary measures taken by the nationwide CRAs to limit medical debt on credit reports; a list of the states that currently have laws which prohibit or restrict medical debt on credit reports; the vacatur of the CFPB medical debt credit reporting ban in Cornerstone v. CFPB, 2025 WL 1920148, at *12 (E.D. Tex. July 11, 2025) and a rebuttal to the dicta on FCRA preemption in that decision.

Acknowledgments

Thanks for contributions to this article by Brad Lipton of the Roosevelt Institute and NCLC Senior Attorney Jon Sheldon.