Ninth Circuit Reverses $140 Million FCRA Verdict: What the Ruling Means for Companies That Pull Credit Reports
The Ninth Circuit just delivered a major victory for Fair Credit Reporting Act (FCRA) defendants in Bultemeyer v. CenturyLink, Inc. The Ninth Circuit reversed a jury verdict of approximately $140 million, comprising $500 per class member in statutory damages and $2,000 per class member in punitive damages across a 56,075-member class, entered against CenturyLink for allegedly willful violations of the FCRA.
The decision reinforces a strong defense for businesses facing FCRA claims based on online credit-pull practices, but companies may need to reassess their processes as courts continue to define when consumers “initiate” a transaction.
The case arose from CenturyLink’s practice of automatically pulling consumers’ credit reports during its online ordering process. After a customer selected services, provided personal information, chose an installation date, and agreed to terms and conditions, but before the consumer clicked “Submit Order,” CenturyLink would pull a credit report to verify identity and determine whether to charge a deposit. The plaintiff in the case never completed that last step — clicking “Submit Order” — but CenturyLink still obtained her credit report. She filed a class action alleging willful FCRA violations. After extensive hearings, multiple rounds of class certification and a four-day jury trial, the trial court awarded $140 million in damages to the class members. CenturyLink appealed.
The central question on appeal was whether CenturyLink “willfully” violated FCRA’s permissible purpose requirement under 15 U.S.C. § 1681b(a)(3)(F), which allows a person to obtain a consumer report only “in connection with a business transaction that is initiated by the consumer.” The dispute turned on whether a consumer who has completed four of five steps in an online purchase process, but has not yet clicked “Submit Order,” has “initiated” a business transaction.
The Ninth’s Circuit’s Focus on the Safeco Safe Harbor
Rather than resolve that underlying statutory interpretation question, however, the court focused on whether CenturyLink was entitled to a safe harbor under Safeco Insurance Co. of America v. Burr, which shields defendants from willfulness liability under the FCRA if their reading of the statute was “not objectively unreasonable.”
A secondary issue involved whether CenturyLink forfeited the Safeco defense by raising it only shortly before trial. The court held it had not, because Safeco merely negates the willfulness element of the plaintiff’s claim and is therefore not an affirmative defense that must be pled in the answer.
The Ninth Circuit held that CenturyLink was entitled to judgment as a matter of law on its Safeco defense, applying the three-factor test:
-
- Whether the defendant's reading had “a foundation in the statutory text”
- Whether any court of appeals had spoken on the issue
- Whether any agency’s “authoritative guidance” might have warned the defendant away from its interpretation
On the first factor, the court found that because “initiated” is undefined in the FCRA and bears multiple reasonable meanings, with dictionary definitions including “commence,” “start” and “originate,” CenturyLink’s position that the plaintiff “initiated” a transaction by completing four of five steps was textually grounded.
On the second factor, no court of appeals had addressed when a business transaction is “initiated,” even though some had interpreted other aspects of “business transaction” under § 1681b(a)(3)(F)(i).
On the third factor, the court considered a Federal Trade Commission (FTC) staff opinion letter and the FTC’s 40 Years Report. It concluded that even if the 40 Years Report qualified as “authoritative guidance,” it was not specific enough to CenturyLink’s online telecommunications context to have warned the company away from its interpretation.
When Does a Customer “Initiate” a Transaction Under the FCRA?
Notably, the panel deliberately left unresolved the underlying question of when a business transaction is actually “initiated” by a consumer in the online context, prompting two separate concurrences from:
-
- Judge Richard Clifton, who would have held that completing all but the final step does constitute initiation
- Judge Jay Bybee, who would have held that initiation does not occur until the consumer knows all material terms, including final pricing, and clicks “submit.”
The decision is a significant win for FCRA defendants, confirming that the Safeco defense remains a powerful tool, even where a jury has found a willful violation and been awarded substantial damages. Companies that pull credit reports during online transactions can take comfort that ambiguous statutory terms — particularly "initiated" in § 1681b(a)(3)(F) — may support a Safeco defense, as long as their interpretation has a textual foundation, no appellate court has ruled on point, and no sufficiently specific agency guidance existed to warn them away.
However, the decision highlights a concerning unresolved statutory question: companies operating online ordering processes that include pre-submission credit pulls remain in legal uncertainty. As Judge Bybee cautioned, the Safeco defense in this posture may function as a “license” to continue a practice that could ultimately be found to violate FCRA, and future appellate decisions addressing “initiated” could eliminate the safe harbor entirely.
FCRA defendants should consider reviewing the timing of credit pulls in their online processes, evaluating whether obtaining express consumer consent before pulling a report would mitigate litigation risk, and monitoring for future appellate or legislative developments that may clarify when a business transaction has been “initiated.”
Contact Harrison Golden, Tim Byrd, Brendan Besh, Patrick Judd or any member of Phelps’ litigation, appellate or banking and financial services teams with questions.