If a data broker is showing information that isn't yours, is incomplete, or is out of date, save the record before you report it. Then find out how the information was used, request the broker's disclosure or file, and send a field-by-field correction request with only the evidence needed to support it.
The Fair Credit Reporting Act (FCRA) may provide the formal dispute process when a company prepares a consumer report for a qualifying purpose, such as credit, employment, insurance, or housing. A people-search page or marketing profile may instead be handled under state privacy law and the company's own procedures.
An opt-out isn't an accuracy dispute. It may limit future sale or display of information, but it doesn't necessarily correct the source record, remove copies held by other companies, or fix a consumer report that has already been used.
First, identify how the information was used
The company's marketing label doesn't decide whether the FCRA applies. A business may operate as a marketing data broker in one context and as a consumer reporting agency in another.
| Situation | Likely route | What to do first |
|---|---|---|
| A lender, employer, insurer, landlord, or similar business used a report about you | The FCRA may apply | Check the adverse action notice for the consumer reporting agency's name and contact information, then dispute the specific item |
| A credit report contains an incorrect account, balance, address, or identity detail | FCRA | Dispute the item with the credit reporting company and, when appropriate, with the company that supplied the information |
| A people-search page or marketing profile is wrong | State privacy law and company policy may apply | Request access and correction, then ask about any deletion or opt-out rights |
| The information may be tied to identity theft or a breach | FCRA, state law, and fraud-response rules may overlap | Preserve the evidence, secure affected accounts, and dispute each inaccurate field separately |
The Federal Trade Commission's guidance on credit-report errors is a useful starting point when the information affected borrowing, insurance, employment, or housing.
Save the record before it changes
A profile can be edited or removed after you contact the company. Capture what is visible now:
- A screenshot or PDF of the full page, including its URL and the date.
- The exact name, address, phone number, account, employer, court record, or other field that is wrong.
- Any profile, reference, or report number.
- When you found the information and, if known, when it was used.
- An adverse action notice, denial, higher-price notice, or other message referring to a consumer report.
- Bills, letters, account statements, or other documents showing how the error affected you.
Leave the original file unchanged. A simple timeline can help later: "March 3: report downloaded; March 5: apartment application denied; March 6: dispute submitted; March 28: broker verified the record."
A negative item isn't automatically inaccurate because it is damaging. Your request should identify what is false, incomplete, misleading, outdated, or connected to the wrong person.
Request the broker's disclosure or file
Begin with the business that displayed or supplied the information. If another company denied an application or took a similar adverse action based on a consumer report, the notice should identify the consumer reporting agency and explain how to contact it.
Ask for the disclosure or file the company maintains about you. It may show that the problem is a mixed file, an incorrect source record, an old entry, or a mistaken link between two people with similar names.
For example, the LexisNexis Risk Solutions consumer disclosure portal allows consumers to request information maintained in its system under the FCRA. The portal says California residents receive both an FCRA consumer disclosure and a California privacy report.
One correction won't necessarily travel through the data-broker ecosystem. List the companies that published, sold, or used the information and handle each relevant record separately.
Describe the error field by field
A precise request is easier to investigate than a general objection. Common problems include:
- Wrong person: An account, address, debt, criminal record, or employer belongs to somebody else.
- Wrong detail: A name, balance, date, employer, address, or account status is incorrect.
- Missing context: The record leaves out a payment, dismissal, satisfaction, identity-theft block, or other fact that changes its meaning.
- Outdated information: The entry no longer reflects the current status or is being reported beyond a legally permitted period.
- Unsupported inference: The broker presents an unverified conclusion as though it were a fact.
- Wrong linkage: An accurate record has been connected to your identity by mistake.
Put the disputed information next to the correction. "This entire profile is wrong" gives the company little to investigate; a numbered list tells it exactly what to check.
Gather evidence without oversharing
Use copies rather than originals. Send enough to establish your identity and the correction, but not a complete file of unrelated personal information. A secure broker portal is preferable when one is available.
| Disputed field | What the evidence should establish | Examples |
|---|---|---|
| Account or debt | It belongs to someone else or has the wrong status | Creditor letter, account statement, identity-theft documentation, or payment record |
| Address or phone number | The broker linked you to another person | Government record, lease, utility record, or dated account statement |
| Employment history | The employer or dates are wrong | Pay statement, employer letter, or personnel record |
| Court or public record | The case, disposition, date, or person is wrong | Certified court document or record from the relevant court |
| Profile page | The page displays inaccurate or sensitive information | Dated screenshot, page URL, and the correct source document |
| Adverse decision | The information affected a real application or transaction | Adverse action notice, denial letter, pricing notice, or dated communication |
You don't have to prove financial damages simply to ask for a correction. Evidence of harm matters more when you want a decision-maker to reconsider an application, report a pattern to a regulator, or assess a possible legal claim.
Redact unnecessary account numbers, Social Security numbers, medical details, and information about other people. Before uploading an identity document, verify that you're on the broker's official domain and that the request is part of a legitimate verification process.
Send an itemized dispute
Use the company's official dispute or privacy-request channel. If the record may be a consumer report, say that you dispute inaccurate information and include the report date, page, and identifier.
You can use a format like this:
I dispute the following information in my consumer file or profile:
- Information shown: [quote or describe the field]
- Why it is inaccurate: [explain the error]
- Correct information: [state the correction]
- Supporting documents: [list the attached documents]
Please investigate, correct the information, or delete information that cannot be verified. Please send me the written result and an updated disclosure or report.
Stick to facts. A short explanation that identifies the error is more useful than accusations, threats, or a long narrative that hides the disputed fields.
If a creditor, debt collector, employer, or another source supplied the information, consider sending a separate dispute to that source using the address in the report or its official dispute instructions. Correcting the source and correcting the broker are separate tasks.
Record the deadline and the response
For a qualifying FCRA dispute, a consumer reporting agency generally has 30 days to investigate. In limited situations, the period can extend to 45 days, including when you provide additional information during the investigation. The company must send the investigation results in writing after it finishes.
Those FCRA deadlines don't automatically apply to every people-search site or marketing database. A non-FCRA privacy request may have a different response period based on the state, the type of business, the request, and applicable exceptions.
Save the following as the dispute moves forward:
- Submission confirmation and dispute number.
- A copy of the request and every attachment.
- Delivery or upload records.
- Follow-up messages and responses.
- The updated report or profile.
- Any explanation for refusing to correct the information.
If the company says the item is accurate, ask what information it relied on. When the FCRA applies, you can also request a description of the procedure used to determine the item's accuracy and completeness. Focused new evidence is more useful than repeating the same general objection.
Check the correction and any downstream harm
Don't stop at the message saying that a change was made. Request a new disclosure or report, or revisit the profile, and check whether:
- The original error is gone.
- The corrected value appears consistently.
- A duplicate entry remains.
- Another address or identifier still links you to the wrong person.
- Another company is displaying the same information.
- The business that made the decision received the correction.
If an application was denied or became more expensive, send the corrected report to the decision-maker and ask how to request reconsideration. A broker's correction may not automatically reopen an application, so keep the adverse action notice and corrected report together.
California: DROP handles deletion and opt-out requests
California residents can use the California Privacy Protection Agency's Delete Request and Opt-out Platform, or DROP for covered deletion and opt-out requests. The platform requires verification of California residency.
DROP is not an FCRA reinvestigation. It doesn't replace an itemized dispute when a lender, employer, insurer, landlord, or another decision-maker relied on a consumer report. If the problem is inaccurate information, use the broker's privacy or dispute channel and say that you want the information corrected, not merely excluded from future use.
The platform states that data brokers must process deletion requests at least once every 45 days beginning August 1, 2026. That timing applies to the covered DROP process, not automatically to every correction request or every broker outside the applicable California rules.
California residents may also have privacy-law access or correction rights, subject to coverage and exceptions. Other states use different definitions, exemptions, deadlines, and request procedures, so a California deadline shouldn't be applied automatically elsewhere.
If the broker ignores or rejects the request
Match the escalation to the problem:
- Follow up with the broker. Include the original confirmation, the disputed fields, and any new evidence.
- Contact the source or decision-maker. Ask the creditor, employer, landlord, insurer, or other business to review the record and explain the decision.
- Complain to the appropriate regulator. FCRA concerns may be reported to the Consumer Financial Protection Bureau or a state attorney general. A privacy complaint may belong with a state privacy regulator, attorney general, or the California Privacy Protection Agency when California law applies.
- Get legal advice if the harm is serious or repeated. A consumer-law or privacy lawyer can assess whether the FCRA or another law covers the company, whether the dispute was sent correctly, and what remedies may be available.
A regulator complaint may reveal a broader pattern, but it doesn't guarantee an individual correction or compensation. Continue with the written dispute and preserve the supporting records.
Don't treat a proposed rule as a current universal right
An enforcement action against one data broker doesn't prove that every broker violated the same law. Your own evidence still needs to show what was reported, how it was used, why it was inaccurate, and what happened after you gave the company a reasonable opportunity to investigate.
The Federal Register notice on Protecting Americans From Harmful Data Broker Practices discussed a proposed approach involving brokers that sell information such as credit history, credit scores, debt payments, or income and financial tiers. It was a proposal, not an active universal correction rule. Check its current status before relying on it.
Likewise, a breach doesn't by itself prove that a particular profile field is inaccurate. It may help show exposure or explain how information spread, but the dispute should still identify the specific false or mismatched data.
Mistakes that can weaken a dispute
- Filing an opt-out when the actual problem is an inaccurate record.
- Disputing "everything" without identifying individual fields.
- Sending the request only to a marketing website when another company supplied the consumer report.
- Leaving out the report date, profile URL, or record identifier.
- Sending original documents or more personal information than necessary.
- Assuming a corrected source record will update every downstream database.
- Calling an unfavorable but accurate record an inaccuracy.
- Relying on a proposed rule, news report, or enforcement settlement as though it were a personal court ruling.
- Expecting a regulator complaint to function as a private lawsuit or guarantee compensation.
FAQ
Can I dispute a record that is accurate but harmful?
Usually, an FCRA accuracy dispute is for information that is false, incomplete, misleading, outdated, or assigned to the wrong person. If the information is accurate, look for a separate deletion, opt-out, or privacy right, or ask the decision-maker to consider additional context.
Does opting out remove inaccurate information?
Not necessarily. An opt-out can limit certain future uses or displays, but it doesn't automatically correct the source record, remove data held by another broker, or change a consumer report that was already used in a decision.
How long does a data broker have to respond?
For a qualifying FCRA dispute, the usual investigation period is 30 days, with limited circumstances allowing 45 days. Non-FCRA requests have different rules. DROP states that covered brokers must process deletion requests at least once every 45 days beginning August 1, 2026.
Can I sue a data broker for an inaccurate profile?
Possibly, but a bad profile alone doesn't guarantee a lawsuit or recovery. The company must be covered by a law that provides a claim, and the facts may involve the report's purpose, the investigation, notice, harm, standing, contract terms, or arbitration. Preserve the report, dispute history, adverse action notice, and harm documents before seeking legal advice.
What if the broker says it can't verify the error?
Ask for the written result and, when the FCRA applies, a description of the procedure used to determine accuracy. Submit focused new evidence, dispute the information with the source, and escalate if the same unsupported item continues to affect decisions.
If you haven't submitted anything yet, start by downloading the record and writing a two-column list: what the broker shows and what the correct information should be. That list becomes the core of the dispute and keeps the next step specific.