What Happened
RentGrow, a Massachusetts-based consumer reporting agency, will pay $2.25 million to settle FTC allegations that it violated the Fair Credit Reporting Act (FCRA) and FTC Act. The complaint, filed by the Department of Justice, alleged that RentGrow failed to maintain reasonable procedures to ensure report accuracy, withheld source information from consumers, mishandled dispute resolutions, and misled consumers about dispute outcomes.
The core issue: RentGrow's systems allowed duplicate records and multiple entries for the same criminal or eviction action to appear in tenant screening reports. A single eviction filing might appear three times, or a criminal case could display as multiple convictions. These duplications falsely suggested applicants had more adverse records than they actually did. The FTC alleged RentGrow knew about these problems but failed to address them until the investigation began.
Timeline
While the documents don't specify exact dates for the violations or investigation, the enforcement action follows a familiar pattern: the company became aware of systemic accuracy issues but didn't act until regulatory scrutiny forced the issue. The stipulated order was filed in U.S. District Court for the District of Columbia after a 2-0 Commission vote authorizing staff to refer the complaint to DOJ.
Key sequence for your risk assessment:
- RentGrow's vendor provided accurate data.
- RentGrow's display logic introduced duplications.
- The company became aware of the accuracy problems.
- The company failed to implement corrective procedures.
- The FTC began investigating.
- The company implemented fixes, suggesting reactive compliance.
Which Controls Failed or Were Missing
Accuracy Assurance Procedures: RentGrow lacked controls to prevent duplicate records in consumer reports. Even with clean data from the vendor, RentGrow's systems displayed information that created false duplications. This failure occurred in data transformation and presentation logic.
Source Disclosure Controls: RentGrow didn't disclose all sources when consumers requested their reports. Specifically, it failed to inform consumers that LexisNexis Accurint provided historical addresses and middle names, which RentGrow used to match records. This omission hindered consumers' ability to dispute inaccurate matches.
Dispute Resolution Process: RentGrow labeled certain disputes as "invalid" and took no further action, particularly for disputes about duplicate records and post-report changes. This shortcut violated procedural requirements meant to give consumers meaningful recourse.
Dispute Outcome Communication: After consumers successfully disputed information, RentGrow falsely told them it had notified property managers of the changes. In reality, RentGrow told property owners there was no change. This was a deliberate misrepresentation.
What the Relevant Standard Requires
The FCRA establishes three core obligations that map directly to these failures:
15 U.S.C. § 1681e(b) requires consumer reporting agencies to "follow reasonable procedures to assure maximum possible accuracy of the information." This demands systematic controls. If you're aggregating data from multiple sources, you need deduplication logic. If your display formatting introduces errors, quality checks are necessary before reports reach end users.
15 U.S.C. § 1681g requires CRAs to disclose "the sources of the information" upon consumer request. This means all sources that contributed to matching records, not just the obvious ones. Partial disclosure defeats the purpose: consumers can't effectively dispute records if they don't know the matching criteria.
15 U.S.C. § 1681i establishes dispute investigation procedures. When a consumer disputes information, you must conduct a reasonable reinvestigation, review all relevant information, and report the results. You can't reject disputes as "invalid" because they fall into inconvenient categories. Each dispute deserves individual assessment.
The FTC Act violation (15 U.S.C. § 45) addresses the misrepresentation about dispute outcomes. Telling consumers you've updated property managers when you haven't is straightforward deception.
Lessons and Action Items for Your Team
Map your data transformation points: Document every point where data changes format, gets merged, or is displayed differently. RentGrow's problem wasn't bad source data but bad transformation logic. Your engineering team needs to understand that reformatting for readability can introduce compliance risk.
Test for duplications systematically: Don't wait for consumer complaints to reveal duplication problems. Run quarterly audits comparing raw source data to final reports for a sample of records. Look for cases where one source event appears multiple times in the output.
Disclose all matching sources: When a consumer requests source information under FCRA § 1681g, your disclosure checklist should include every database queried to match records, not just where adverse information was found. Build this into your consumer request workflow as a mandatory field.
Eliminate "invalid dispute" as a category: Review your dispute handling procedures. If your team has a workflow step labeled "reject as invalid," remove it. Replace it with specific, documented reasons tied to the evidence provided.
Verify dispute outcome communications: If you tell consumers you've notified third parties about report changes, implement a technical control that makes this automatic. Don't rely on manual follow-up. Close the gap between what the dispute resolution team records and what the customer communication team sends.
Don't wait for enforcement to fix known issues: The complaint alleged RentGrow was aware of accuracy problems but didn't implement fixes until the FTC investigation began. That timing pattern weakens your defense. If your audits, consumer complaints, or quality reviews reveal systemic issues, document your remediation plan immediately and execute it on a defined timeline.
For compliance officers overseeing consumer reporting operations, the RentGrow settlement clarifies that "reasonable procedures" under FCRA means more than collecting accurate source data. You're responsible for what your systems do to that data before it reaches the end user. If your presentation layer introduces errors, you own those errors. If your dispute process categorically rejects certain claim types, you're violating the statute. And if you tell consumers one thing while telling their landlords another, you've crossed from technical non-compliance into misrepresentation.
The $2.25 million penalty reflects the cumulative impact of multiple control failures. Your job is to identify which of these failure modes exist in your own systems before a regulator does.
