USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 1 of 34 

No. 21-1678 

IN THE UNITED STATES COURT OF APPEALS 

FOR THE FOURTH CIRCUIT 

––––––––––––––––––––––––––––––––––––––––––––– 

TYRONE HENDERSON, ET AL., 

Plaintiffs-Appellants, 

v. 

THE SOURCE FOR PUBLIC DATA, L.P., ET AL., 

Defendants-Appellees. 

––––––––––––––––––––––––––––––––––––––––––––– 

On Appeal from the United States District Court 

for the Eastern District of Virginia 

No. 3:30-cv-294 

Hon. Henry E. Hudson 

––––––––––––––––––––––––––––––––––––––––––––– 

BRIEF OF AMICI CURIAE 

FEDERAL TRADE COMMISSION, 

CONSUMER FINANCIAL PROTECTION BUREAU, 

AND NORTH CAROLINA SUPPORTING REVERSAL 

––––––––––––––––––––––––––––––––––––––––––––– 

STEPHEN VAN METER JAMES REILLY DOLAN 

Acting General Counsel Acting General Counsel 

STEVEN Y. BRESSLER JOEL MARCUS 

Acting Deputy General Counsel Deputy General Counsel 

LAURA HUSSAIN 

Assistant General Counsel 

DERICK SOHN THEODORE (JACK) METZLER 

Senior Counsel Attorney 

CONSUMER FINANCIAL PROTECTION BUREAU FEDERAL TRADE COMMISSION 

1700 G Street, N.W. 600 Pennsylvania Avenue, N.W. 

Washington, D.C. 20552 Washington, D.C. 20580 

(202) 435-7873 (202) 326-3502 

derick.sohn@cfpb.gov tmetzler@ftc.gov 

Additional counsel on inside cover. 
USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 2 of 34 

JOSHUA H. STEIN 

Attorney General 

DANIEL P. MOSTELLER 

Deputy General Counsel 

NORTH CAROLINA DEPARTMENT OF JUSTICE 

114 W. Edenton Street 

Raleigh, N.C. 27602 
USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 3 of 34 

TABLE OF CONTENTS 

Table of Authorities .................................................................................................. ii 

Question Presented .....................................................................................................1 

Interest of Amici Curiae .............................................................................................2 

Statement....................................................................................................................5 

A. The Fair Credit Reporting Act ............................................................................6 

B. Section 230 of the Communications Decency Act .............................................9 

C. The District Court’s Decision ...........................................................................12 

Argument..................................................................................................................15 

I. Introduction and Summary ...............................................................................15 

II. Section 230 Does Not Provide Immunity From the Plaintiffs’ 

FCRA Claims. ...................................................................................................17 

A. The plaintiffs’ FCRA claims do not treat Public Data as a 

publisher or speaker. .................................................................................18 

B. Even if the plaintiffs’ FCRA claims were based on the 

content of Public Data’s reports, Public Data is not immune 

because it is an “information content provider” for that 

content. .....................................................................................................23 

Conclusion ...............................................................................................................28 

i 
USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 4 of 34 

TABLE OF AUTHORITIES 

CASES 

Barnes v. Yahoo!, Inc., 570 F.3d 1096 (9th Cir. 2009) .................................... 18, 19 

Fair Hous. Council v. Roommates.com, LLC, 

521 F.3d 1157 (9th Cir. 2008) ................................................................ 23, 24, 26 

FTC v. Accusearch, Inc., 570 F.3d 1187 (10th Cir. 2009) ................................. 3, 27 

FTC v. LeadClick Media, LLC, 

838 F.3d 158 (2d Cir. 2016) .................................................... 3, 11, 17, 18, 23, 24 

Huff v. Telecheck Servs., 923 F.3d 458 (6th Cir. 2019) ...........................................20 

Jones v. Dirty World Entm’t Recordings LLC, 

755 F.3d 398 (6th Cir. 2014)............................................................. 11, 13, 17, 24 

Nemet Chevrolet, Ltd. v. Consumeraffairs.com, Inc., 

591 F.3d 250 (4th Cir. 2009)......................................................................... 23, 25 

Spokeo, Inc. v. Robins, 136 S.Ct. 1540 (2016) ..........................................................7 

Universal Commun. Sys. v. Lycos, Inc., 

478 F.3d 413 (1st Cir. 2007) ......................................................................... 11, 17 

Zeran v. Am. Online, Inc., 129 F.3d 327 (4th Cir. 1997)...................... 10, 11, 18, 21 

STATUTES, REGULATIONS, LEGISLATIVE MATERIALS 

12 U.S.C. § 5511 ........................................................................................................3 

12 U.S.C. § 5512 ........................................................................................................3 

12 U.S.C. § 5552 ........................................................................................................4 

12 U.S.C. § 5581 ........................................................................................................3 

15 U.S.C. § 1681 ......................................................................................... 1, 7, 8, 15 

15 U.S.C. § 1681a ............................................................................................... 7, 12 

15 U.S.C. § 1681b ..................................................................................... 1, 8, 12, 22 

15 U.S.C. § 1681c ....................................................................................................21 

15 U.S.C. § 1681e ..................................................................................................1, 8 

15 U.S.C. § 1681g ..................................................................................... 1, 9, 12, 20 

15 U.S.C. § 1681k........................................................................................... 1, 9, 12 

15 U.S.C. § 1681n ......................................................................................................9 

ii 
USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 5 of 34 

15 U.S.C. § 1681o ......................................................................................................9 

15 U.S.C. § 1681s ............................................................................................. 2, 3, 4 

15 U.S.C. § 45 ............................................................................................................2 

47 U.S.C. § 230..................................................... 1, 9, 10, 11, 14, 17, 18, 23, 25, 27 

12 C.F.R. § 1022 ........................................................................................................3 

S. Rep. No. 91-517 (1969) .............................................................................. 6, 7, 15 

OTHER AUTHORITIES 

Consumer Fin. Prot. Bureau, Consumer Reporting, larger 

participants examination procedures (Feb. 2020).................................................3 

Consumer Fin. Prot. Bureau, Consumer Response Annual 

Report (March 2021) ..............................................................................................4 

Consumer Fin. Prot. Bureau, Fair Credit Reporting Act 

(FCRA) examination procedures (Oct. 2012) ........................................................3 

FTC, Background Checks (March 2018) ...................................................................4 

FTC, Consumer Sentinel Network Databook 2020 (Feb. 2021)................................4 

FTC, Keeping Your Credit Report in Check (Jan. 2014)...........................................4 

iii 
USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 6 of 34 

QUESTION PRESENTED 

The Fair Credit Reporting Act, 15 U.S.C. § 1681 et seq., seeks to ensure 

fairness in the system for reporting and use of information about consumers by 

regulating how consumer reporting agencies create and provide reports about consumers to their customers. Among other things, it requires consumer reporting 

agencies to: 

 provide consumers with a copy of their files upon request; 

 adopt reasonable procedures to ensure maximum possible accuracy in 

preparing their reports; and 

 follow specific procedures when they furnish consumer reports for employment purposes. 

15 U.S.C. §§ 1681b(b), 1681e(b), 1681g(a), 1681k(a). 

Section 230 of the Communications Decency Act, 47 U.S.C. § 230(c)(1), 

makes providers of interactive consumer services immune from claims that seek to 

hold them liable as the publisher or speaker of content for which they are not wholly or partially responsible for creating or developing. The question presented is: 

Whether a consumer lawsuit alleging violations of the FCRA’s procedural 

and disclosure requirements seeks to hold the defendant liable as the publisher or 

speaker of information provided by a third party and is thereby preempted by Section 230? 

1 
 

USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 7 of 34 

INTEREST OF AMICI CURIAE 

As the federal government agencies with principal responsibility for enforcement of the Fair Credit Reporting Act, amici curiae the Federal Trade Commission and Consumer Financial Protection Bureau have a strong interest in ensuring that Section 230 of the Communications Decency Act is not misconstrued to 

confer immunity from provisions of the FCRA that provide important protections 

to consumers. 

The Commission has been charged by Congress with the mission to protect 

consumers from deceptive or unfair trade practices. 15 U.S.C. § 45(a). As part of 

that mission, the Commission has long played a key role in the implementation, enforcement, and interpretation of the FCRA. The statute grants the Commission 

wide jurisdiction to enforce its requirements against entities involved in the consumer reporting system.1 

A violation of the FCRA “constitute[s] an unfair or deceptive act or practice 

in commerce, in violation of section 5(a) of the Federal Trade Commission Act.” 

15 U.S.C. § 1681s(a). And the FCRA grants the Commission “such procedural, investigative, and enforcement powers . . . as though the applicable terms and conditions of the Federal Trade Commission Act were part of [the FCRA].” Id. The 

Commission has enforced the FCRA numerous times; it has also successfully op1 See 15 U.S.C. § 1681s(a). The primary exceptions to the Commission’s jurisdiction are federally regulated financial institutions. See 15 U.S.C. § 1681s(a)-(b). 

2 
 

USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 8 of 34 

posed arguments that Section 230 of the Communications Decency Act immunized 

defendants from liability for their violations of consumer protection laws. See FTC 

v. LeadClick Media, LLC, 838 F.3d 158, 172-177 (2d Cir. 2016); FTC v. Accusearch, Inc., 570 F.3d 1187, 1195-1201 (10th Cir. 2009). 

The Consumer Financial Protection Bureau implements and enforces Federal consumer financial law, including the FCRA. 12 U.S.C. § 5511(a); 12 U.S.C. 

§ 5481(12)(F); 15 U.S.C. § 1681s(b). The Bureau is responsible for promulgating 

rules implementing most provisions of the FCRA, 12 U.S.C. § 5581, which are 

codified at 12 C.F.R. § 1022 (referred to as Regulation V). Congress directed 

courts to defer to the Bureau’s determinations regarding the meaning or interpretation of Federal consumer financial law, including the FCRA, as though the Bureau 

were the only agency authorized to apply, enforce, interpret, or administer the law. 

12 U.S.C. § 5512(b)(4)(B). The Bureau is also responsible for supervising nonbanks under its jurisdiction for compliance with the FCRA, including the nationwide consumer reporting agencies.2 

2 See Consumer Fin. Prot. Bureau, Fair Credit Reporting Act (FCRA) examination procedures (Oct. 2012), https://www.consumerfinance.gov/compliance/ 

supervision-examinations/fair-credit-reporting-act-fcra-examination-procedures; 

Consumer Fin. Prot. Bureau, Consumer Reporting, larger participants examination 

procedures (Feb. 2020), https://www.consumerfinance.gov/compliance/ 

supervision-examinations/consumer-reporting-larger-participants-examinationprocedures. 

3 
 

USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 9 of 34 

Both the Commission and the Bureau publish guidance on FCRA compliance for entities involved in the consumer reporting system, including consumer 

reporting agencies, those who furnish the information in consumer reports, and 

those who use those reports to make critical decisions about consumers’ access to 

credit, insurance, employment, and housing.3

 Both agencies regularly receive complaints from consumers about credit or consumer reporting practices. In 2020, the 

agencies received over 300,000 complaints about credit or consumer reporting.4 

The North Carolina Attorney General also has authority to enforce violations 

of the FCRA in coordination with the Commission and the Bureau. 12 U.S.C. 

§ 5552; 15 U.S.C. § 1681s(c). The North Carolina Attorney General’s Office also 

regularly receives, and seeks to obtain resolution of, complaints from North Carolina consumers concerning disputes related to compliance with the FCRA. 

3 See generally guidance collected at https://www.ftc.gov/tips-advice/businesscenter/privacy-and-security/credit-reporting, and at 

https://www.consumerfinance.gov/compliance/compliance-resources/otherapplicable-requirements/fair-credit-reporting-act/. The Commission also publishes 

information to inform consumers of their rights under the FCRA. See, e.g., FTC, 

Background Checks (March 2018), https://www.consumer.ftc.gov/articles/0157-

background-checks; FTC, Keeping Your Credit Report in Check (Jan. 2014), 

http://www.consumer.ftc.gov/blog/2014/01/keeping-your-credit-report-check. 

4 See FTC, Consumer Sentinel Network Databook 2020 (Feb. 2021) at 5, 

https://www.ftc.gov/system/files/documents/reports/consumer-sentinel-networkdata-book-2020/csn_annual_data_book_2020.pdf; Consumer Fin. Prot. Bureau, 

Consumer Response Annual Report (March 2021) at 9, 

https://files.consumerfinance.gov/f/documents/cfpb_2020-consumer-responseannual-report_03-2021.pdf. 

4 
USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 10 of 34 

As the consumer reporting system evolves with the emergence of new technologies and business practices, FCRA enforcement remains a top priority for the 

Commission, the Bureau, and the North Carolina Attorney General. The agencies’ 

efforts would be significantly hindered, however, if the district court’s decision below is allowed to stand. The district court held that Section 230 of the Communications Decency Act provides immunity from an action to enforce procedural and 

disclosure obligations of the FCRA because the defendants’ consumer reports were 

compiled from records it collected from third parties. That holding misconstrues 

Section 230 by extending immunity to claims that do not seek to treat the defendant as the publisher or speaker of any third-party information. 

STATEMENT 

The two statutes at issue in this case were passed to solve problems that 

overlap little, if at all, and which do not overlap here. 

The FCRA was designed to make the consumer reporting system fair to consumers so that potentially inaccurate information is not used to deny them access to 

necessities like credit, insurance, housing, and employment. It requires consumer 

reporting agencies to furnish consumer reports only for allowed purposes and to 

follow procedures designed to ensure accuracy. The statute also gives consumers 

the right to receive and dispute the information in their files, to know when certain 

information about them has been reported, and to sue consumer reporting agencies 

5 
 

USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 11 of 34 

who negligently or willfully fail to comply with its requirements. But it does not 

make consumer reporting agencies liable simply for publishing inaccurate information. 

Section 230 is unrelated to the FCRA. It shields providers of internet services from liability based on information content that third parties provide through 

the internet. Thus, for example, Twitter cannot typically be held liable for a user’s 

defamatory tweet. The immunity that Section 230 provides was intended to foster 

the development of the internet and the free exchange of ideas by removing the 

threat that internet providers would be held liable for content posted by their users. 

It was not intended to reach—and by its terms does not reach—claims like those in 

this case, which turn on a consumer reporting agency’s failure to comply with procedural rules set forth in statutory text that does not base liability directly on the 

content of its reports. 

A. The Fair Credit Reporting Act 

Congress enacted the FCRA in 1970 to address recent (at the time) developments in computer technology which had made possible the collection and exchange of vast stores of information about consumers and created “the possibility 

of a nationwide data bank covering every citizen.” S. Rep. No. 91-517, at 2 (1969). 

Congress designed the Act “to prevent consumers from being unjustly damaged 

because of inaccurate or arbitrary information,” and “to prevent an undue invasion 

6 
USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 12 of 34 

of the individual’s right of privacy in the collection and dissemination of credit information.” Id. at 1. 

The FCRA imposes obligations on those who collect and disseminate information about consumers, which it terms “consumer reporting agencies,” and regulates the collection, assembly, and use of that information in “consumer reports.” 

See Spokeo, Inc. v. Robins, 136 S.Ct. 1540, 1545 & nn.1-2 (2016). 

As relevant here, a “consumer reporting agency” under the statute is any 

person who “regularly engages . . . in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties.” 15 U.S.C. § 1681a(f). A “consumer report,” meanwhile, is defined as a consumer reporting agency’s communication of 

information “bearing on a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living,” 

which is used (or expected to be used) or collected for specified purposes, including the consumer’s eligibility for credit, insurance, employment, or housing. 

15 U.S.C. § 1681a(d)(1). 

Congress determined that consumer reporting agencies “ha[d] assumed a vital role” in the process for evaluating consumers’ credit worthiness and general 

character by collecting information about consumers and providing it to third parties. 15 U.S.C. § 1681(a)(3). Congress found a corresponding need to ensure that 

7 
USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 13 of 34 

consumer reporting agencies “exercise their grave responsibilities with fairness, 

impartiality, and a respect for the consumer’s right to privacy.” 15 U.S.C. 

§ 1681(a)(4). The Act therefore subjects consumer reporting agencies to rules designed to ensure that the consumer reporting system “is fair and equitable to the 

consumer, with regard to the confidentiality, accuracy, relevancy, and proper utilization of [consumer-report] information.” 15 U.S.C. § 1681(b). 

Those requirements generally involve procedures that consumer reporting 

agencies must follow; they do not mandate that consumer reports always be accurate. The four requirements at issue in this case are typical. Section 1681e, for example, requires consumer reporting agencies to “follow reasonable procedures to 

assure maximum possible accuracy of the information concerning the individual 

about whom the report relates.” 15 U.S.C. § 1681e(b) (emphasis added). While inaccuracies may be evidence that an agency lacked reasonable procedures, it is the 

lack of procedures that is the basis for liability imposed by the statutory text. Two 

other sections at issue here similarly involve procedures that a consumer reporting 

agency must follow when providing employment background checks. One section 

requires a consumer reporting agency to obtain a certification from the person requesting the report that they have complied and will comply with certain FCRA 

requirements and that they will not use the report in violation of state or federal 

employment laws. 15 U.S.C. § 1681b(b)(1). In addition, if such a report contains 

8 
USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 14 of 34 

adverse public record information, the consumer reporting agency must either notify the consumer that it is reporting such information and give the name and address 

of the person who requested the report, or “maintain strict procedures” to ensure 

that any information that is likely to have an adverse effect on employment is 

“complete and up to date.” 15 U.S.C. § 1681k(a)(2). The fourth FCRA requirement 

at issue in this case involves consumers’ right to know the contents of their files. It 

requires a consumer reporting agency to disclose to the consumer “[a]ll information in the consumer’s file” at the consumer’s request. 15 U.S.C. § 1681g(a)(1). 

The FCRA gives consumers the right to sue consumer reporting agencies for 

negligently or willfully violating its requirements. 15 U.S.C. §§ 1681o, 1681n. 

Because the statute does not directly require consumer reports to be accurate, however, liability in such as case generally depends on the defendant’s compliance 

with FCRA’s procedural requirements. 

B. Section 230 of the Communications Decency Act 

Section 230 of the Communications Decency Act addresses a very different 

and unrelated issue—exposure of the providers of internet services to liability for 

content posted by their users. In Section 230, Congress recognized that the internet 

had created “a forum for a true diversity of political discourse, unique opportunities for cultural development, and myriad avenues for intellectual activity.” 

47 U.S.C. § 230(a)(3). Congress was concerned, however, that the specter of tort 

9 
USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 15 of 34 

liability based on user-posted content would lead providers of internet services to 

restrict the content they allow to be posted and ultimately stunt the development of 

the burgeoning internet medium. Zeran v. Am. Online, Inc., 129 F.3d 327, 330-331 

(4th Cir. 1997). At the same time, Congress did not want to discourage companies 

from filtering or blocking offensive content from their services. Id. at 331. 

Section 230 was Congress’s answer. To promote the robust exchange of ideas 

over the internet, avoid the potential chilling effect of liability for user content, and 

encourage intermediaries to police offensive content on their platforms, Section 

230 immunizes the providers of internet services from liability for the content 

posted by their users. See id. In pertinent part, it states: 

“No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another 

information content provider.” 

47 U.S.C. § 230(c)(1). 

Section 230(c)(1) contains three requirements for immunity. First, the defendant must be a provider or user of an “interactive computer service.” That term 

is defined broadly to include “any information service, system, or access software 

provider that provides or enables computer access by multiple users to a computer 

server.” 47 U.S.C. § 230(f)(2). Second, the claim at issue must seek to treat the defendant “as the publisher or speaker” of specified content. 47 U.S.C. § 230(c)(1). 

10 
USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 16 of 34 

And third, the content that forms the basis of the claim must be “provided by another information content provider.” Id. An “information content provider” means 

“any person or entity that is responsible, in whole or in part, for the creation or development of information provided through the Internet or any other interactive 

computer service.” 47 U.S.C. § 230(f)(3). Because Section 230 limits immunity to 

disputes involving content provided by “another” information content provider, 

immunity is not available if the defendant is partly or wholly responsible for the 

content. See, e.g., FTC v. LeadClick Media, LLC, 838 F.3d 158, 174 (2d Cir. 2016); 

Zeran, 129 F.3d at 330. 

Courts have boiled the requirements down to a three-part test, requiring that 

“(1) the defendant asserting immunity is an interactive computer service provider, 

(2) the particular information at issue was provided by another information content 

provider, and (3) the claim seeks to treat the defendant as a publisher or speaker of 

that information.” Jones v. Dirty World Entm’t Recordings LLC, 755 F.3d 398, 409 

(6th Cir. 2014); see also, e.g., LeadClick Media, 838 F.3d at 173; Universal Commun. Sys. v. Lycos, Inc., 478 F.3d 413, 418 (1st Cir. 2007). 

11 
 

USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 17 of 34 

C. The District Court’s Decision 

The plaintiffs in this case allege that Public Data1

 collects, sorts, summarizes, and assembles public record information into reports that it makes available to 

third parties for purchase, and that Public Data therefore qualifies as a “consumer 

reporting agency” under the FCRA. See 15 U.S.C. § 1681a(f); D.Ct. Docket No. 56 

at 16-18. They allege that Public Data: 

 failed to establish or follow reasonable procedures to assure maximum 

possible accuracy in the preparation of its reports, in violation of 15 

U.S.C. § 1681e(b); 

 failed to disclose to the plaintiffs the contents of their files upon request, 

in violation of 15 U.S.C. § 1681g(a)(1); 

 failed to obtain the certifications required by FCRA prior to furnishing 

employment background reports, in violation of 15 U.S.C. § 1681b; and 

 failed to inform plaintiffs that it was furnishing criminal information 

about them for background purposes or provide them with the name and 

address of the persons to whom the information was reported, as required 

by 15 U.S.C. § 1681k(a)(1). 

J.A. 85-86 & nn.1-4; D.Ct. Docket No. 56 at 22-24, 29-30. Although the plaintiffs 

allege that Public Data’s practices had led it to provide numerous reports containing inaccurate criminal history information, id., they do not seek to hold Public 

Data liable on the basis of the inaccurate data. Instead, each claim rests on Public 

1

 For convenience, we refer to the individual and corporate defendants collectively as “Public Data.” 

12 
 

USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 18 of 34 

Data’s failure to follow the process-oriented requirements that the FCRA imposes 

on consumer reporting agencies. 

Public Data sought judgment on the pleadings, arguing that Section 230 provides it with immunity from claims that it violated the FCRA. J.A. 83. 

Without considering the elements of the claims or whether any alleged violation hinged on the content or accuracy of Public Data’s reports or its website, the 

district court began its analysis by declaring that Section 230 “can apply to Plaintiffs’ FCRA claims” because the plaintiffs “seek to hold Defendants liable for the 

content of their website.” J.A. 92. 

The court then addressed whether “all the elements” necessary for Section 

230 immunity were met.2 Id. The court first found that Public Data qualifies for 

immunity as both an “access software provider[]” and an “interactive computer 

service” because it “uploads the information onto [its] servers for [its] clients to 

access on the internet.” J.A. 94. The court did not specify whether or how the information that Public Data uploads forms the basis for any of the FCRA violations 

alleged by the plaintiffs. 

2

 The district court described the elements of Section 230 immunity as: “(1) a defendant is an interactive computer service; (2) the content is created by an information content provider; and (3) the defendant is alleged to be the creator of the 

content.” J.A. 92-93; cf. supra p. 11 (listing the elements as described in Jones, 

755 F.3d at 409 and other cases). 

13 
USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 19 of 34 

The court next found that Public Data is not an “information content provider” because it “[does] not produce the content of the reports at issue in this litigation.” J.A. 95. The court did not, however, explain how “the content of the reports” 

is “at issue in this litigation” or in any of the plaintiffs’ claims. See id. Nor did the 

court consider whether—even assuming the content of the reports were at issue— 

the plaintiffs plausibly alleged that Public Data was “responsible, in whole or in 

part, for the creation or development” of its reports, thereby meeting Section 230’s 

definition of an information content provider to whom the statutory immunity does 

not apply. 47 U.S.C. § 230(f)(3). Instead, the court appears to have believed that a 

defendant who qualifies as an “access software provider” under Section 230 cannot 

also be an “information content provider” under the statute. J.A. 94-95. After reciting the complaint’s allegations—that Public Data gathers information from third 

parties; that it sorts, manipulates, and draws inferences from the data; that it creates 

its own summaries of the information; and that it collects the information into the 

reports it provides to customers—the court concluded that the defendants “fall 

within the statute’s definition of an access software provider.” J.A. 95. 

Finally, the district court held that the plaintiffs’ claims treat Public Data as 

the “publisher and distributor of third-party content.” Id. Once again, the court did 

not consider how or whether any of the claims alleged by the plaintiffs would treat 

Public Data as the “speaker” of the information in its reports or impose liability for 

14 
USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 20 of 34 

exercising the traditional functions of a publisher. Instead, the court based its finding on a line in the complaint stating “that Defendants have been ‘publishing inaccurate and/or incomplete public records and criminal information.’” Id. (quoting 

D.Ct. Docket No. 56 at 18). 

ARGUMENT 

I. INTRODUCTION AND SUMMARY 

The vast expansion of companies offering to sell background reports and 

other information about consumers on the internet has shown the wisdom in Congress’s concern about “the possibility of a nationwide data bank covering every 

citizen.” S. Rep. No. 91-517, at 2 (1969). It is easier than ever for such companies 

to collect information about virtually everyone and make it available for sale on the 

internet. The “possibility of a nationwide data bank”—and its use to grant or deny 

consumers access to vital services—that motivated Congress to enact the FCRA 

has become a reality, not just in the hands of the three nationwide credit reporting 

agencies, but also on the servers of many other consumer reporting agencies who 

provide background reports over the internet. Thus, the need to ensure that such 

companies “exercise their grave responsibilities with fairness, impartiality, and a 

respect for the consumer’s right to privacy”—by enforcing the procedures and limitations that Congress mandated in the FCRA—is greater than ever. 15 U.S.C. 

§ 1681(a)(4). 

15 
USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 21 of 34 

Enforcing the FCRA’s requirements—whether through government enforcement or private litigation—does not implicate the concerns that Congress 

sought to address in Section 230 of the Communications Decency Act. Although 

the information that forms the basis of a consumer reporting agency’s reports may 

originate from other sources, claims that a person has violated the FCRA generally 

do not seek to hold the defendant liable as the publisher or speaker of third-party 

content. Instead, those claims seek to hold consumer reporting agencies liable for 

their actions or omissions—not their speech—when they fail to follow the FCRA’s 

mandates. 

The claims in this case demonstrate how the FCRA regulates the actions of 

consumer reporting agencies rather than treating them as speakers or publishers of 

third party data. None of the alleged violations seeks to impose liability for the 

content of Public Data’s website or its reports. Instead, liability turns on Public 

Data’s failure to comply with its obligations to use reasonable procedures when it 

prepares reports, to provide consumers with a copy of their files, and to obtain certifications and notify the consumer when it furnishes reports to be used for employment purposes. Those claims do not treat Public Data as the publisher or 

speaker of any content that originated with a third party and Section 230 does not 

therefore provide immunity from them. 

16 
 

USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 22 of 34 

II. SECTION 230 DOES NOT PROVIDE IMMUNITY FROM THE 

PLAINTIFFS’ FCRA CLAIMS. 

Section 230’s immunity provision states: “No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.” 47 U.S.C. § 230(c)(1). 

The statute thus grants immunity if “(1) the defendant asserting immunity is an interactive computer service provider, (2) the particular information at issue was 

provided by another information content provider, and (3) the claim seeks to treat 

the defendant as a publisher or speaker of that information.” Jones, 755 F.3d at 

409; LeadClick Media, 838 F.3d at 173; Universal Commun. Sys., 478 F.3d at 418. 

The district court’s fundamental error stems from its finding that the plaintiffs in this case “seek to hold Defendants liable for the content of their website.” 

J.A. 92. That error led the court to analyze the application of Section 230 as if the 

claims in this case sought to impose liability for the content of Public Data’s reports rather than Public Data’s failure to comply with specific requirements of the 

FCRA. J.A. 93-96. The district court thus viewed the pertinent questions to be 

whether Public Data qualified as an “information content provider” by providing 

its reports over the internet, and whether it “created the content” of its reports or 

the information had instead been provided by third parties. Id. 

The district court should instead have analyzed whether each of the four 

claims in this case seek to impose liability on Public Data as a “publisher or speak17 
 

 

USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 23 of 34 

er” of information, and if so, whether the information that formed the basis of the 

claim was “provided by another information content provider.” 47 U.S.C. 

§ 230(c)(1). The claims against Public Data do not qualify because none of them 

seeks to treat Public Data as a “publisher or speaker” of information provided by 

another content provider.3 

A. The plaintiffs’ FCRA claims do not treat Public Data as a 

publisher or speaker. 

By its terms, Section 230 applies only to claims that seek to treat the defendant as “the publisher or speaker” of third-party content. 47 U.S.C. § 230(c)(1). To 

determine whether a cause of action does so, “courts must ask whether the duty 

that the plaintiff alleges the defendant violated derives from the defendant’s status 

or conduct as a ‘publisher or speaker.’” LeadClick Media, 838 F.3d at 175 (quoting 

Barnes v. Yahoo!, Inc., 570 F.3d 1096, 1102 (9th Cir. 2009)). This Court has 

commented that “a publisher’s traditional editorial functions” include “deciding 

whether to publish, withdraw, postpone or alter content.” Zeran, 129 F.3d at 330. 

The Ninth Circuit has similarly stated that “publication involves reviewing, editing, and deciding whether to publish or to withdraw from publication third-party 

content.” Barnes, 570 F.3d at 1102. “Thus, a publisher reviews material submitted 

3

 The agencies take no position on whether Public Data meets the statutory definition of “interactive computer service.” 47 U.S.C. § 230(f)(2). 

18 
USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 24 of 34 

for publication, perhaps edits it for style or technical fluency, and then decides 

whether to publish it.” Id. 

The claims in this case do not derive from that sort of conduct. To begin 

with, nobody submits information about consumers to Public Data for publication. 

Quite the opposite, Public Data is alleged to seek out and purchase consumer 

information from numerous sources, to curate the records to match specific individuals, and then to compile and summarize that information in the reports it sells 

online. D.Ct. Docket No. 56 at 16-18. More importantly, however, none of the 

claims in this case involves a duty that “derives from [Public Data’s] status or conduct as a ‘publisher or speaker.’” Barnes, 570 F.3d at 1102. Instead, the claims 

involve duties that FCRA imposes on consumer reporting agencies which are specific to the function of a consumer reporting agency. 

For example, the duties at issue in the plaintiffs’ employment-backgroundreport claims are the FCRA’s requirements that consumer reporting agencies 

(1) obtain certain certifications from customers before furnishing such a report, and 

(2) notify consumers when they furnish a report containing negative information. 

See 15 U.S.C. §§ 1681b(1), 1681k(a)(1). Neither of those requirements derives 

from a purported status as a publisher or editorial functions like those described in 

Zeran and Barnes. Publishers do not have to obtain certifications from their readers 

before publishing information, nor do they have any legal duty to inform the sub19 
USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 25 of 34 

ject of a story before publication. Those duties exist only by virtue of the FCRA 

and apply only to consumer reporting agencies. 

The claim that Public Data failed to disclose the information in its files on 

consumers at their request is even further removed from alleging the violation of a 

duty that derives from status as a publisher. The duty at issue in such a claim is that 

“a consumer agency must disclose ‘[a]ll information in the consumer’s file’ upon 

request.” Huff v. Telecheck Servs., 923 F.3d 458, 462 (6th Cir. 2019) (quoting 

15 U.S.C. § 1681g(a)(1)). That duty is wholly unrelated to the defendant’s status or 

conduct as the “publisher or speaker” of any content. And far from imposing liability for publishing third-party information, the violation stems from a consumer reporting agency’s failure to disclose the information in its file. See 15 U.S.C. 

§ 1681g(a)(1). 

The claim that Public Data failed to follow reasonable procedures to ensure 

the accuracy of its reports likewise does not derive from Public Data’s status or 

conduct as a “publisher or speaker.” The duty at issue in that claim is the FCRA 

requirement that “[w]henever a consumer reporting agency prepares a consumer 

report, it shall follow reasonable procedures to assure maximum possible accuracy 

of the information concerning the individual about whom the report relates.” 

15 U.S.C. § 1681e(b). Although preparing a consumer report might superficially 

resemble a publisher’s function of “deciding whether to publish, withdraw, post20 
 

 

USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 26 of 34 

pone or alter content,” Zeran, 129 F.3d at 330, publishers are held liable only for 

the ultimate inaccuracy of the content (as in the case of libel) and not, as here, for 

failing to follow reasonable procedures to ensure accuracy, where having such reasonable procedures constitutes a defense to liability. Again, the duty at issue—and 

the basis for liability—derives from the procedural requirements that the FCRA 

imposes on the consumer reporting agencies themselves, not from the agencies’ 

dissemination of inaccurate third-party content.4 

The district court therefore erred when it concluded that “Plaintiffs treat Defendants as if they are the publisher and distributor of third-party content,” J.A. 96, 

without considering whether the claims at issue in this case sought to impose liability on that basis. The court reached its contrary conclusion by relying on a single 

quotation from the complaint, to the effect that Public Data had been “publishing 

inaccurate and/or incomplete public records and criminal information.” J.A. 95-96 

(quoting D.Ct. Docket No. 56 at 18-19). But the accuracy or completeness of information provided in a consumer report is wholly irrelevant to three of the plaintiffs’ four claims, which allege that Public Data: (1) failed to obtain from its cus4

 Indeed, it is unclear that consumers even need to establish their reports were actually disseminated to prove a violation of this provision of the FCRA. Several 

provisions of the FCRA apply only when a consumer reporting agency disseminates, that is, “furnishes” a consumer report. See, e.g., 15 U.S.C. § 1681c(d). In 

contrast, the statutory text applies the reasonable procedures requirement whenever 

a consumer reporting agency “prepares” a consumer report. 15 U.S.C. § 1681e(b) 

(emphasis added). 

21 
USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 27 of 34 

tomers the certifications required by 15 U.S.C. § 1681b(b)(1), (2) failed to provide 

consumers with the notifications required by 15 U.S.C. § 1681k(a), and (3) failed 

to provide consumers with their own information as required by 15 U.S.C. 

§ 1681g. D.Ct. Docket No. 56 at 29-32. And even the plaintiffs’ fourth claim, 

which alleges Public Data violated the reasonable procedures requirement of 

15 U.S.C. § 1681e(b), see id. at 32-33, turns on the adequacy of Public Data’s procedures rather than on the accuracy or completeness of content that Public Data 

published or spoke. 

The sentence relied upon by the district court therefore did not form the basis for any alleged liability in the complaint. Indeed, the quoted language appears 

in a section of the complaint arguing that Public Data’s violations of FCRA were 

willful, in a sentence that states in full: “For example, there have recently been 

several cases brought against Defendants for publishing inaccurate and/or incomplete public records and criminal information about consumers who suffered adverse employment actions.” See D.Ct. Docket No. 56 at 18-22 (emphasis added). 

The allegation thus was not a part of any asserted violation, but instead was intended to show that Public Data “knew or should have known about [its] legal obligations under the FCRA.” Id. at 19. The statement thus does not support the conclusion that the claims in this case seek to impose liability on Public Data for actions 

it took as a publisher or speaker. 

22 
USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 28 of 34 

B. Even if the plaintiffs’ FCRA claims were based on the content 

of Public Data’s reports, Public Data is not immune because it 

is an “information content provider” for that content. 

Section 230 provides immunity only when the claim at issue is “based on 

content provided by another information content provider.” LeadClick Media, 838 

F.3d at 174. Accordingly, a defendant will not be granted immunity if it is “also an 

‘information content provider’ of the content which gives rise to the underlying 

claim.” Id.; Nemet Chevrolet, Ltd. v. Consumeraffairs.com, Inc., 591 F.3d 250, 254 

(4th Cir. 2009) (“[T]he scope of § 230 immunity turns on whether [the defendant’s] actions also make it an ‘information content provider.’”). The allegations of 

the complaint show that Public Data is an information content provider with respect to its reports and therefore does not enjoy Section 230 immunity from claims 

based on furnishing those reports. 

A defendant is an “information content provider” if it is “responsible, in 

whole or in part, for the creation or development” of content. 47 U.S.C. § 230(f)(3); 

Jones, 755 F.3d at 408. The definition “covers even those who are responsible for 

the development of content only in part.” LeadClick, 838 F.3d at 174 (cleaned up). 

Further, a defendant is sufficiently responsible for the development of challenged 

content “if it contributes materially to the alleged illegality of the content.” Fair 

Hous. Council v. Roommates.com, LLC, 521 F.3d 1157, 1167-1168 (9th Cir. 

2008). And “[a] material contribution . . . means being responsible for what makes 

23 
USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 29 of 34 

the displayed content allegedly unlawful.” Jones, 755 F.3d at 410; see also LeadClick Media, 838 F.3d at 174. Moreover, when liability would arise from posting 

material that was not “tendered to [the defendant] for posting online,” a defendant 

who “mak[es] the affirmative decision to publish . . . contributes materially to its 

allegedly unlawful dissemination.” Roomates.com, 521 F.3d at 1171. 

As explained above, the district court erred when it held that the plaintiffs 

“seek to hold Defendants liable for the content of their website” without analyzing 

whether any of the plaintiffs’ claims seek to impose liability based on that content. 

J.A. 92. As shown, none of the claims do. But even if the plaintiffs had sought to 

impose liability for the content of Public Data’s reports, the district court was incorrect to find Public Data is not an “information content provider” for that content. 

In its decision, the district court recited the complaint’s extensive allegations 

about how Public Data creates its reports. It noted that Public Data gathers information from third parties; that it sorts, manipulates, and draws inferences from the 

data; that it creates its own summaries of the information; and that it collects the 

information into the reports it provides to customers. J.A. 83-84. “In sum,” the district court stated, “Plaintiffs maintain that Defendants rewrite the court records into 

their own original entries into the report.” J.A. 84 (internal quotation marks omitted). Nevertheless, the court concluded that those allegations “fall within the stat24 
USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 30 of 34 

ute’s definition of an access software provider” and held that Public Data is not an 

“information content provider.” J.A. 95. 

To the extent the court believed that a defendant cannot be both an “access 

software provider” and also an “information content provider,” see id. (contrasting 

the definitions of the two terms), that is incorrect. The term “access software provider” is only relevant to the application of Section 230 immunity because the statute defines “interactive computer service” to include “any . . . access software provider.” 47 U.S.C. § 230(f)(2). Accordingly, finding that a defendant is an access 

software provider simply means that the defendant qualifies as an interactive computer service. But as this Court has held, when a defendant qualifies as an interactive computer service, “the scope of § 230 immunity turns on whether that person’s 

actions also make it an ‘information content provider.’” Nemet, 591 F.3d at 254 

(emphasis added). Finding the defendant is an access software provider does not 

answer that question. 

Here, the allegations show that Public Data is an information content provider for its reports because it is “responsible, in whole or in part, for the creation 

or development” of the reports. 47 U.S.C. § 230(f)(3). First, Public Data is wholly 

responsible “for the creation” of its reports—they would not exist if Public Data 

did not affirmatively undertake to gather information from public sources and 

compile that information into reports. Public Data is also responsible in whole or in 

25 
USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 31 of 34 

part for the development of the reports. As alleged in the complaint and described 

by the district court, Public Data manipulates the data it collects, curates it to 

match specific individual consumers, puts it into a different format for reporting to 

customers, draws inferences from the data, and creates original summaries of the 

data. J.A. 83-84; D.Ct. Docket No. 56 at 17. Public Data therefore qualifies as an 

“information content provider” by virtue of its responsibility for the creation and 

development of its reports and is not entitled to immunity from claims based on 

their content. 

Because the claims here are not based on the content of Public Data’s reports, the nuance adopted by several courts—that responsibility for developing 

content depends on “contribut[ing] materially” to its “alleged illegality”—does not 

obviously apply. Roommates.com, 521 F.3d at 1167-1168. The claims do not allege that anything about the content of the reports is illegal. To the extent the 

claims depend on Public Data’s practice of furnishing those reports (without complying with the FCRA’s requirements) however, Public Data contributes materially 

to that alleged illegality; indeed, no FCRA liability existed for the underlying content until Public Data gathered it and compiled it into a report. The sources from 

which Public Data collects consumers’ information do not seek Public Data out, 

and the information in Public Data’s reports was not “tendered to [Public Data] for 

posting online.” Id. at 1171. Instead, Public Data makes the “affirmative decision” 

26 
 

USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 32 of 34 

to furnish its reports (without complying with the FCRA), and therefore it “contributes materially to its allegedly unlawful dissemination.” Id. 

In a similar case, the Tenth Circuit held that Section 230 did not protect a 

defendant who had improperly obtained and then disseminated confidential telephone records. FTC v. Accusearch, Inc., 570 F.3d 1187, 1197-1201 (10th Cir. 

2009). That defendant was found “responsible” for the “development” of that 

“content”—and therefore an “information content provider” within the meaning of 

Section 230—because it unlawfully “convert[ed] . . . legally protected records 

from confidential material to publicly exposed information.” Id. at 1199. Here, to 

the extent the plaintiffs’ claims depend on the furnishing of consumer reports 

(without complying with the FCRA’s requirements), Public Data is alleged to have 

illegally converted lawful information possessed by third parties into consumer reports; thus, it too is an “information content provider” with respect to such reports. 

The district court erroneously focused on whether the complaint alleged that 

Public Data had “created the content” of its reports, concluding it had not because 

the information was “derived from other information content providers.” J.A. 96. 

But Section 230’s definition of information content provider does not turn on 

whether the defendant “created the content” but on whether it is responsible, in 

whole or in part, for the creation or development of the content. 47 U.S.C. § 230(f). 

27 
 

USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 33 of 34 

The allegations here show that Public Data met that standard and the district court 

was incorrect to hold otherwise. 

CONCLUSION 

The district court’s decision should be reversed. 

STEPHEN VAN METER 

Acting General Counsel 

STEVEN Y. BRESSLER 

Acting Deputy General Counsel 

LAURA HUSSAIN 

Assistant General Counsel 

DERICK SOHN 

Senior Counsel 

CONSUMER FINANCIAL PROTECTION BUREAU 

1700 G Street, N.W. 

Washington, D.C. 20552 

JOSHUA H. STEIN 

Attorney General 

DANIEL P. MOSTELLER 

Deputy General Counsel 

NORTH CAROLINA DEPARTMENT 

OF JUSTICE 

114 W. Edenton Street 

Raleigh, N.C. 27602 

 Respectfully submitted, 

JAMES REILLY DOLAN 

Acting General Counsel 

JOEL MARCUS 

Deputy General Counsel 

/s/ Theodore (Jack) Metzler 

THEODORE (JACK) METZLER 

Attorney 

FEDERAL TRADE COMMISSION 

600 Pennsylvania Avenue, N.W. 

Washington, D.C. 20580 

28 
USCA4 Appeal: 21-1678 Doc: 29-1 Filed: 10/14/2021 Pg: 34 of 34 

CERTIFICATE OF COMPLIANCE 

I certify that the foregoing brief complies with Federal Rule of Appellate Procedure 29(a)(5) in that it contains 6090 words. 

October 14, 2021 /s/ Theodore (Jack) Metzler 

Theodore (Jack) Metzler 

Attorney 

Federal Trade Commission 

600 Pennsylvania Avenue, N.W. 

Washington, D.C. 20580