Credit report errors in Illinois: what the law says

What the statute says

Small claims limit

$10,000

Illinois Supreme Court Rule 281 (amended Sept. 29, 2021, eff. Jan. 1, 2022): 'For the purpose of the application of Rules 281 through 288, a small claim is a civil action based on either tort or contract for money not in excess of $10,000, exclusive of interest and costs.' Small claims are heard in the circuit court under Rules 281-288.

Read the full rule

Limits in the same rule: the action must be 'based on either tort or contract' — whether a statutory Consumer Fraud Act or FCRA claim fits that description is not addressed in the rule text and was not verified; a consumer seeking FCRA statutory and punitive damages above $10,000, or attorney fees, may need the regular civil docket or federal court. Rule 282 (corporate representation) was not read.

Code section

815 ILCS 505/2EEEE (medical debt ban on consumer reports, eff. 1-1-2025); 815 ILCS 505/2MM (security freeze; free of charge per (n-5)); 815 ILCS 505/10a (private action: actual damages, discretionary fees, 3-year limitation); 815 ILCS 505/7 (Attorney General enforcement, civil penalty up to $50,000); 815 ILCS 505/10b (exemptions).

Read the full rule

Illinois has NO state reinvestigation deadline, NO state furnisher duty, NO state statutory or per-violation damages, and NO state free-report right for credit reports.

Statutory damages

Illinois. Section 10a of the Consumer Fraud Act — the Act's private-action provision — sets no per-violation, minimum, or fixed statutory damages payable to a consumer.

Read the full rule

Its private remedy starts at 815 ILCS 505/10a(a): a person "who suffers actual damage as a result of a violation of this Act" may bring an action, and "the court, in its discretion may award actual economic damages or any other relief which the court deems proper." Actual damage is an element of the claim, and both the award and its size are discretionary (10a(a)).

Actual damages are not the whole of the private remedy. Except as provided in subsections (f), (g), and (h) of that Section, in any action brought by a person under it, "the Court may grant injunctive relief where appropriate and may award, in addition to the relief provided in this Section, reasonable attorney's fees and costs to the prevailing party" (10a(c)).

The punitive-damages bar in 10a(a) is narrow. It forbids a punitive award only against a defendant who is a new vehicle dealer or used vehicle dealer within the meaning of Chapter 5 of the Illinois Vehicle Code, or the holder of a retail installment contract within the meaning of Section 2.12 of the Motor Vehicle Retail Installment Sales Act — and even as to those defendants the bar gives way where the conduct engaged in "was willful or intentional and done with evil motive or reckless indifference to the rights of others" (10a(a)). So as to a dealer or a holder, the bar applies where the conduct falls short of that standard and does not apply where it meets it; what the proviso does is lift a prohibition, not create an entitlement to a punitive award. The same subsection puts a further condition on claims against that same class of defendants: proof of a public injury, a pattern, or an effect on consumers and the public interest generally is required to state a cause of action against them (10a(a)). Reading the narrow punitive bar to mean punitive damages are generally available against other defendants is an inference from what the subsection restricts; the Act does not grant punitive damages in terms.

On timing, an action for damages under 10a is "forever barred unless commenced within 3 years after the cause of action accrued," subject to that subsection's own suspension of the period while an Attorney General or State's Attorney action complaining of the same matter is pending, and for one year thereafter (10a(e)).

Per-violation money does appear in the Act, but it appears in Section 7, the Act's public-enforcement section, rather than in the private-action section. Section 7 opens with an action the Attorney General or a State's Attorney may bring "in the name of the People of the State," in which the court's powers run from injunction through "restitution" (7(a)). Under 815 ILCS 505/7(b) the Attorney General or a State's Attorney "may request and the Court may impose a civil penalty in a sum not to exceed $50,000" against a person found by the court to have engaged in a practice declared unlawful under the Act, and where the court finds the practice was entered into with the intent to defraud, "the court has the authority to impose a civil penalty in a sum not to exceed $50,000 per violation" (7(b)). Section 7(c) allows the court to impose an additional civil penalty "not to exceed $10,000 for each violation" where the violation was committed against a person 65 years of age or older; by its terms 7(c) turns on the court's finding rather than on a request by the Attorney General or a State's Attorney (7(c)). Restitution and a penalty are distinct, and the Act's priority rule between them is written narrowly: "An award of restitution under subsection (a) has priority over a civil penalty imposed by the court under this subsection" — a sentence that sits in 7(c), so the penalty it outranks is that subsection's own penalty; Section 7 states no such priority as against a penalty under 7(b) (7(c)).

Where that penalty money goes is answered in the text for one subsection and not the other. "A civil penalty imposed under this subsection (c) shall be paid to the State Treasurer" for deposit in the Department on Aging State Projects Fund (7(c)). For a penalty imposed under 7(b), Section 7 names no recipient: the payment rule just quoted is written for penalties under subsection (c), and subsections (d) and (e) reach only payments made to the Attorney General for the operations of that office — whether ordered by a court or agreed to in an Assurance of Voluntary Compliance under the Act — which go to a separate fund (7(d), 7(e)). That such a penalty is not a payment of damages to the consumer follows from how Section 7 is built — a penalty the State asks for and a court imposes in a public action — and not from any words in the section saying who receives it.

Whether any Illinois statute provides fixed or per-violation statutory damages payable to a consumer for credit-reporting violations is not settled by the sections cited here. Neither Section 10a nor Section 7 is a credit-reporting statute: neither one uses the words consumer report or credit report, and neither addresses whether the conduct of a credit bureau falls within the Act at all. One Consumer Fraud Act provision that does set a fixed sum — 815 ILCS 505/2QQQ(e), $100 per day for failing to correct criminal record information — expressly "does not apply to a consumer reporting agency as defined under 15 U.S.C. 1681a(f)" (2QQQ(i)).

Federal. Under 15 U.S.C. §1681n(a), a person who willfully fails to comply with any requirement imposed under the subchapter with respect to a consumer "is liable to that consumer in an amount equal to the sum of" the items that follow (§1681n(a)). The first is "any actual damages sustained by the consumer as a result of the failure or damages of not less than $100 and not more than $1,000" — an either/or, and for the second branch the text fixes only a floor and a ceiling, saying nothing about how a figure between them is arrived at; nothing in the section makes $1,000 automatic (§1681n(a)(1)(A)). A separate rule covers a natural person who obtains a consumer report under false pretenses or knowingly without a permissible purpose: actual damages or $1,000, "whichever is greater" (§1681n(a)(1)(B)). Added to that are "such amount of punitive damages as the court may allow" (§1681n(a)(2)) and, "in the case of any successful action to enforce any liability under this section, the costs of the action together with reasonable attorney's fees as determined by the court" (§1681n(a)(3)).

Fees can run the other way. On a finding that an unsuccessful pleading, motion, or other paper filed in connection with a §1681n action was filed in bad faith or for purposes of harassment, the court shall award the prevailing party attorney's fees reasonable in relation to the work expended in responding to that paper. The trigger is that the paper itself was unsuccessful, not that the party who filed it lost the case (§1681n(c)).

Section 1681n reaches willful noncompliance only — the limit sits in the section's heading and in the opening words of subsection (a), which speak of a person "who willfully fails to comply" (§1681n(a)). What a negligent failure to comply yields is a separate question, and the text of this section does not answer it.

When it can be extended

No Illinois overlay — federal 15 U.S.C. §1681i(a)(1)(B) governs (up to 15 additional days when the consumer provides additional relevant information during the 30-day period).

What the bureau must do

Illinois adds two duties on consumer reporting agencies beyond the FCRA, and nothing else: (1) 815 ILCS 505/2EEEE(b), effective January 1, 2025 — a consumer reporting agency may not furnish any consumer report 'containing, incorporating, or reflecting any adverse information that the consumer reporting agency knows or…

Read the full rule

should know relates to medical debt incurred by the consumer or a collection action against the consumer to collect medical debt', and may not 'maintain in the file on a consumer any information relating to medical debt'; (2) 815 ILCS 505/2MM(c)-(r) — security-freeze placement, lift, and removal duties, free of charge. Both are exposed to a federal preemption defense (see federal_preemption_analysis). There is no Illinois reinvestigation, accuracy, or dispute-handling duty on bureaus — federal 15 U.S.C. §1681i and §1681e(b) govern those.

815 ILCS 505/2EEEE(b), verbatim: 'It is an unlawful practice within the meaning of this Act for a consumer reporting agency: (1) to make, create, or furnish any consumer report or credit report containing, incorporating, or reflecting any adverse information that the consumer reporting agency knows or should know…

Read the full rule

relates to medical debt incurred by the consumer or a collection action against the consumer to collect medical debt; and (2) to maintain in the file on a consumer any information relating to medical debt incurred by a consumer or a collection action against the consumer to collect medical debt.' Scope limits in the same section: 'Medical debt' means 'a debt arising from the receipt of health care services, products, or devices' but 'does not include debt charged to a credit card or an open-end or close-end extension of credit made by a financial institution to a borrower unless the open-end or close-end extension of credit may be used by the borrower solely for the purpose of the purchase of health care services.' The duty binds only 'a consumer reporting agency' (defined by reference to 15 U.S.C. 1681a(f)), and paragraph (1) has a knowledge element ('knows or should know'). Source note on ilga.gov: 'P.A. 103-648, eff. 1-1-25; 104-417, eff. 8-15-25' — P.A. 104-417 is the First 2025 General Revisory Act, which states 'This Act is not intended to make any substantive change in the law' (it changed 'or' to 'and' in the definition of 'Consumer report' and 'credit report'). A full-text search of the entire Consumer Fraud Act as served by ilga.gov on 2026-09-05 found no section using the word 'reinvestigate' or 'reinvestigation' and no dispute-handling deadline for consumer reporting agencies.

What the furnisher must do

No Illinois overlay — federal 15 U.S.C. §1681s-2(b) governs furnisher duties after a dispute. 815 ILCS 505/2EEEE(b) is addressed only to 'a consumer reporting agency'; it does not prohibit a hospital, medical provider, debt buyer, or collection agency from furnishing medical debt to a bureau (the section defines 'collection agency' but imposes no duty on one).

Read the full rule

Any attempt to apply the Illinois Consumer Fraud Act to a furnisher's reporting conduct also faces 15 U.S.C. §1681t(b)(1)(F), which preempts state law 'with respect to any subject matter regulated under section 1681s-2 of this title, relating to the responsibilities of persons who furnish information to consumer reporting agencies' and saves only Mass. Gen. Laws ch. 93 §54A(a) and Cal. Civ. Code §1785.25(a). A demand letter to a furnisher in Illinois should rely on §1681s-2(b) only.

Your right to free reports

No Illinois overlay — federal 15 U.S.C. §1681j governs (one free disclosure per 12 months from each nationwide consumer reporting agency, plus free reports after adverse action, on fraud-alert or unemployment/public-assistance grounds, and free reports and scores as otherwise provided federally).

Read the full rule

Illinois's only related text is 815 ILCS 505/2B.2, which requires sellers of paid record-access services to print the statement 'CREDIT REPORTING AGENCIES ARE REQUIRED BY LAW TO GIVE YOU A COPY OF YOUR CREDIT RECORD UPON REQUEST, AT NO CHARGE OR FOR A NOMINAL FEE' — a disclosure duty on sellers, not a consumer right to a free report from a bureau.

Governing law

No standalone Illinois consumer credit reporting act exists (nothing comparable to California's CCRAA, New York GBL Art. 25, Texas Bus. & Com. Code ch. 20, or Washington RCW 19.182).

Read the full rule

Illinois regulates credit reporting only through specific sections of the Consumer Fraud and Deceptive Business Practices Act: 815 ILCS 505/2MM (identity-theft verification and security freeze on credit reports) and 815 ILCS 505/2EEEE (credit reporting; medical debt, effective January 1, 2025), each enforced through the Act's general private remedy in 815 ILCS 505/10a and the Attorney General's powers in 815 ILCS 505/7.

Attorney's fees

Discretionary, and two-way. 815 ILCS 505/10a(c): 'in any action brought by a person under this Section, the Court may grant injunctive relief where appropriate and may award, in addition to the relief provided in this Section, reasonable attorney's fees and costs to the prevailing party.' 'May' (not 'shall') and 'prevailing party' (which can be the defendant) — weaker than the mandatory fee-shifting to a successful consumer in FCRA §1681n(a)(3) and §1681o(a)(2).

Read the full rule

The offer-of-judgment fee-forfeiture rules in 10a(f)-(h) apply only to vehicle-dealer / retail-installment-contract defendants.

Time limit to sue

3 years

Two clocks run here, and they are not interchangeable.

Read the full rule

State-law claim. For a private claim under the Illinois Consumer Fraud Act (the only vehicle for a state-law claim under 2EEEE or 2MM), 815 ILCS 505/10a(e) provides that any action for damages under that Section "shall be forever barred unless commenced within 3 years after the cause of action accrued." Those 3 years are not absolute. Under the proviso in the same subsection, whenever the Attorney General or a State's Attorney brings an action for a violation of the Act, the running of that limitation period is suspended — as to every private right of action for damages based in whole or in part on any matter complained of in that action — "during the pendency thereof, and for one year thereafter" (10a(e)). A date calculated from accrual alone can therefore understate how long a claim survives.

Federal claim. A federal FCRA claim keeps its own period and does not borrow 10a(e). Under 15 U.S.C. §1681p, an action to enforce any liability created under that subchapter must be brought "not later than the earlier of" 2 years after the date of discovery by the plaintiff of the violation that is the basis for such liability, or 5 years after the date on which that violation occurs (§1681p). Because the two dates run to whichever comes first, the 5-year date is an outside cap that late discovery does not push back: a violation first discovered in its fourth year leaves only what remains of the 5 years, not a fresh 2 years from discovery (§1681p). Section 1681p does not define when discovery occurs, and it does not say whether the 2-year period can be tolled on equitable grounds; the text settles neither question.

The general Illinois limitation statutes read as backups — 735 ILCS 5/13-202 (2 years for "a statutory penalty") and 735 ILCS 5/13-205 (5 years for "all civil actions not otherwise provided for") — are displaced for Consumer Fraud Act damages claims by the Act's own specific 3-year period in 10a(e).

Who handles complaints

Illinois Attorney General, Consumer Protection Division (Consumer Fraud Helplines: 1-800-386-5438 Chicago; 1-800-243-0618 Springfield; 1-800-243-0607 Carbondale).

Read the full rule

The AG's own page states the office 'is prohibited from representing citizens privately' — it takes public-enforcement action and offers informal dispute resolution, not individual representation. online form: https://forms.illinoisattorneygeneral.gov/Forms/ConsumerComplaints_ComplaintForm

Scope limits

(1) 2EEEE is effective January 1, 2025 (ILCS source note 'P.A. 103-648, eff. 1-1-25'); it does not by its terms reach reports furnished before that date.

Read the full rule

(2) 2EEEE covers only 'medical debt' as defined — 'a debt arising from the receipt of health care services, products, or devices' — and excludes debt 'charged to a credit card or an open-end or close-end extension of credit made by a financial institution' unless that credit 'may be used by the borrower solely for the purpose of the purchase of health care services' (so a medical bill paid with a general-purpose card, or a general medical financing loan usable elsewhere, is NOT protected). (3) 2EEEE(b)(1) requires that the agency 'knows or should know' the item relates to medical debt. (4) 2EEEE binds consumer reporting agencies only. (5) 2MM freeze duties do not apply to the ten user categories in 2MM(n) or the entities in 2MM(p); a minor's freeze 'may not be temporarily lifted' (2MM(f)); the agency may remove a freeze without request 'if the consumer's credit report was frozen due to a material misrepresentation of fact by the consumer' (2MM(i)(2)); requests require 'proper identification' and, for minors/persons with a disability, 'proper authority' (2MM(m)). (6) The private remedy requires 'actual damage' (10a(a)); fees are discretionary (10a(c)); the plaintiff 'shall mail a copy of the complaint or other initial pleading to the Attorney General' on filing and a copy of any judgment on entry (10a(d)). (7) The Consumer Fraud Act does not apply to 'Actions or transactions specifically authorized by laws administered by any regulatory body or officer acting under statutory authority of this State or the United States' (10b(1)). (8) Small claims: Illinois Supreme Court Rule 281 caps small claims at $10,000 'exclusive of interest and costs' and limits them to actions 'based on either tort or contract'. (9) No Illinois statutory damages, no Illinois reinvestigation deadline, no Illinois furnisher duty, no Illinois free-report right.

Defeasible rules

(1) Medical-debt ban (2EEEE): defeated or narrowed by (a) federal preemption under 15 U.S.C. §1681t(b)(1)(E), a live argument endorsed by the CFPB's October 28, 2025 interpretive rule and dicta in a July 2025 E.D. Tex.

Read the full rule

decision, unresolved for Illinois by any court found; (b) the credit-card / general-purpose-credit carve-out in the 'medical debt' definition; (c) the 'knows or should know' element; (d) the January 1, 2025 effective date; (e) 10b(1) if the reporting is held 'specifically authorized' by federal law. (2) Security freeze (2MM): defeated by §1681t(b)(1)(J) to the extent it conflicts with 15 U.S.C. §1681c-1(i)-(j); by the 2MM(n) and 2MM(p) exemptions; by failure to supply 'proper identification' / PIN (2MM(f), (l), (m)); and freezes obtained by 'material misrepresentation of fact' may be removed (2MM(i)(2)). (3) Private remedy (10a): requires 'actual damage'; damages and fees are 'in its discretion' / 'may'; fees can go to a prevailing defendant; 3-year limitation from accrual (10a(e)); must mail the complaint to the Attorney General (10a(d)). (4) No bona fide error defense appears in 815 ILCS 505 for these sections (the federal FCRA has none either), but the 'knows or should know' element in 2EEEE(b)(1) performs a similar function for the furnishing prohibition; the 'maintain in the file' prohibition in 2EEEE(b)(2) has no knowledge element on its face. (5) No exhaustion or pre-suit notice requirement applies to claims against consumer reporting agencies (the 30-day pre-suit demand in 10a(h) applies only to vehicle-dealer / retail-installment defendants).

Enforcement agency

The Illinois Attorney General (Consumer Protection Division) and county State's Attorneys enforce the Consumer Fraud Act.

Read the full rule

Under 815 ILCS 505/7(a), whenever the Attorney General or a State's Attorney has reason to believe that a person is using, has used, or is about to use a practice declared unlawful by the Act, and that proceedings would be in the public interest, he or she may bring an action in the name of the People of the State to restrain that practice by preliminary or permanent injunction (7(a)). In such an action "the Court, in its discretion, may exercise all powers necessary, including but not limited to" injunction; revocation, forfeiture or suspension of a license, charter, franchise or certificate; appointment of a receiver; dissolution or suspension of corporate authority to do business in the State; and restitution (7(a)).

Civil penalties sit on top of that. In addition to the remedies provided in the Section, the Attorney General or State's Attorney "may request and the Court may impose a civil penalty in a sum not to exceed $50,000" against a person found by the court to have engaged in a practice declared unlawful under the Act; and where the court finds the practice was entered into with the intent to defraud, "the court has the authority to impose a civil penalty in a sum not to exceed $50,000 per violation" (7(b)).

For older victims there is a further penalty. In addition to any other civil penalty provided in the Section, where a person is found by the court to have engaged in an unlawful practice and the violation was committed against a person 65 years of age or older, "the court may impose an additional civil penalty not to exceed $10,000 for each violation" (7(c)). By its terms 7(c) turns on the court's finding rather than on a request by the Attorney General or a State's Attorney. In deciding whether to impose that penalty and in what amount, the court "shall consider" whether the defendant's conduct was in willful disregard of the older person's rights; whether the defendant knew or should have known the conduct was directed to a person 65 or older; whether that person was substantially more vulnerable because of age, poor health, infirmity, impaired understanding, restricted mobility, or disability; and any other factors the court deems appropriate (7(c)).

Where this money ends up is only partly answered by the statute. A civil penalty imposed under 7(c) "shall be paid to the State Treasurer" for deposit in the Department on Aging State Projects Fund (7(c)). But this track can also produce money for the consumer: restitution is one of the powers 7(a) lists for the court, and "an award of restitution under subsection (a) has priority over a civil penalty imposed by the court under this subsection" (7(c)). Whether restitution is ordered at all, and in what amount, remains discretionary, and Section 7 does not say where a penalty imposed under 7(b) goes.

Complaint channels: Illinois Attorney General consumer complaint, https://illinoisattorneygeneral.gov/File-A-Complaint/ (online form https://forms.illinoisattorneygeneral.gov/Forms/ConsumerComplaints_ComplaintForm; helplines 1-800-386-5438 Chicago, 1-800-243-0618 Springfield, 1-800-243-0607 Carbondale). The federal channel (CFPB, consumerfinance.gov/complaint) is separate and is unaffected by Illinois law.

Medical debt rules

815 ILCS 505/2EEEE (P.A. 103-0648, effective January 1, 2025; technical revision by P.A. 104-0417, eff. 8-15-2025, 'not intended to make any substantive change in the law'): it is an unlawful practice for a consumer reporting agency '(1) to make, create, or furnish any consumer report or credit report containing,…

Read the full rule

incorporating, or reflecting any adverse information that the consumer reporting agency knows or should know relates to medical debt incurred by the consumer or a collection action against the consumer to collect medical debt; and (2) to maintain in the file on a consumer any information relating to medical debt incurred by a consumer or a collection action against the consumer to collect medical debt.' 'Medical debt' means 'a debt arising from the receipt of health care services, products, or devices' and 'does not include debt charged to a credit card or an open-end or close-end extension of credit made by a financial institution to a borrower unless the open-end or close-end extension of credit may be used by the borrower solely for the purpose of the purchase of health care services.' 'Collection action' means 'any referral of a bill to a collection agency or law firm to collect payment for services from a consumer for health care services.' There is NO dollar threshold, NO paid-debt limitation, and NO waiting period — all medical debt as defined is covered — but the duty binds consumer reporting agencies only, not providers or collectors, and has no state statutory damages (remedy is 10a actual damages, discretionary fees). ENFORCEABILITY CAVEAT (must travel with this rule): 2EEEE post-dates September 30, 1996 and so is exposed to preemption under 15 U.S.C. §1681t(b)(1)(E); the CFPB's interpretive rule of October 28, 2025 (90 FR 48710) asserts that 'All State laws on that subject are preempted' while conceding the rule is 'non-binding'; no court ruling on 2EEEE was found as of 2026-09-05. A letter may cite 2EEEE only as a contested Illinois rule alongside the federal §1681i dispute right; it must not assert that Illinois law guarantees removal of medical debt.

Relationship to fcra

Supplement, not substitute. Illinois adds (a) a content ban on medical debt in consumer reports (2EEEE, eff. 1-1-2025, contested under §1681t(b)(1)(E)) and (b) a free security freeze (2MM, superseded in practice by the faster federal freeze in §1681c-1(i) and preempted to the extent it conflicts, §1681t(b)(1)(J)).

Read the full rule

Illinois changes nothing about reinvestigation deadlines, furnisher duties, damages, or free reports — those remain purely federal (§1681i, §1681s-2(b), §1681n/§1681o, §1681j, §1681p). An Illinois demand letter should be built on the federal rights and may add a one-sentence reference to 2EEEE where the disputed item is medical debt, with the preemption caveat stated.

Security freeze rules

815 ILCS 505/2MM: a consumer may request a freeze 'in writing by certified mail or by at least one of telephone or electronic means' (2MM(c)); guardians/agents may request for a person with a disability, and a guardian or parent for a minor (2MM(c)).

Read the full rule

Placement: 'A consumer reporting agency shall place a security freeze on a consumer's credit report no later than 5 business days after receiving a written request from the consumer' with proper identification (2MM(d)); written confirmation and a PIN/password 'within 10 business days' (2MM(e)). Temporary lift: 'shall comply with the request no later than 3 business days after receiving the request' (2MM(h)); 'A security freeze for a minor may not be temporarily lifted' (2MM(f)). Removal: 'within 3 business days of receiving a request for removal' (2MM(l)). Fees: 'A consumer reporting agency may not impose a charge on a consumer for placing a freeze, removing a freeze, or temporarily lifting a freeze' (2MM(n-5)). While frozen, the agency must confirm in writing within 30 days any change to name, date of birth, Social Security number, or address (2MM(o)). Exemptions: 2MM(n) (ten user categories) and 2MM(p) (check-services, deposit-account services, non-database resellers). Violation is 'an unlawful practice within the meaning of this Act' (2MM(r)), remediable only through 10a (actual damages). FEDERAL COMPARISON AND PREEMPTION: 15 U.S.C. §1681c-1(i) requires a free freeze within 1 business day (phone/electronic) or 3 business days (mail) and removal/temporary lift within 1 hour (phone/electronic) or 3 business days (mail); §1681t(b)(1)(J) preempts state law 'relating to security freezes' with respect to §1681c-1(i)-(j). Illinois's deadlines are slower than federal, so a letter should cite the federal freeze timelines; 2MM adds nothing a letter can use except the identical no-fee rule.

Identity theft related

815 ILCS 505/2MM(a)-(b): a credit card issuer receiving an application listing an address 'not substantially the same as the address on the offer or solicitation may not issue a credit card ...

Read the full rule

until reasonable steps have been taken to verify the applicant's change of address'; a lender that 'has received notification of a police report filed with a consumer reporting agency that the applicant has been a victim of financial identity theft' may not extend credit 'without taking reasonable steps to verify the consumer's identity'. 815 ILCS 505/2VV: it is an unlawful practice 'to deny credit or public utility service to or reduce the credit limit of a consumer solely because the consumer has been a victim of identity theft' where the consumer has provided an FCRA identity theft report or the specified affidavit. These bind creditors, not bureaus, and are not dispute-handling rights.

Reinvestigation days note

Federal 15 U.S.C. §1681i sets a reinvestigation clock. Subject to subsection (f) and except as provided in subsection (g), where a consumer disputes the completeness or accuracy of an item of information in the consumer's file and notifies the agency directly, or indirectly through a reseller, the agency shall, free of charge, conduct a reasonable reinvestigation to determine whether the disputed information is inaccurate, before the end of the 30-day period beginning on the date the agency receives the notice of the dispute (§1681i(a)(1)(A)).

Read the full rule

The same sentence also requires the agency to record the current status of the disputed information, or to delete the item from the file in accordance with paragraph (5) (§1681i(a)(1)(A)).

The 30 days can stretch. Except as provided in subparagraph (C), the 30-day period "may be extended for not more than 15 additional days" if the agency receives information from the consumer during that 30-day period that is relevant to the reinvestigation (§1681i(a)(1)(B)). That extension does not apply where, during the 30-day period, the information under reinvestigation is found to be inaccurate or incomplete, or the agency determines that the information cannot be verified (§1681i(a)(1)(C)).

The reinvestigation can also be cut short. Notwithstanding paragraph (1), an agency "may terminate a reinvestigation" if it reasonably determines that the dispute is frivolous or irrelevant, including by reason of a failure by the consumer to provide sufficient information to investigate the disputed information (§1681i(a)(3)(A)). Having made that determination, the agency shall notify the consumer of it "not later than 5 business days after making such determination," by mail or, if the consumer authorized it for that purpose, by any other means available to the agency (§1681i(a)(3)(B)).

Two points the text does not settle. Nothing in §1681i ties the reinvestigation period to a free annual file disclosure, so whether a dispute that follows one carries a deadline different from the periods above is not settled by its text. And whether Illinois imposes a reinvestigation deadline of its own is not settled by the Illinois statutes cited on this page.

Who is liable scope limit

2EEEE(b): only 'a consumer reporting agency' (defined by 15 U.S.C. 1681a(f)) — not medical providers, collection agencies, debt buyers, or other furnishers.

Read the full rule

2MM(c)-(r): consumer reporting agencies (2MM(r): 'Any person who violates this Section commits an unlawful practice within the meaning of this Act'); 2MM(a)-(b) separately bind credit card issuers and lenders to verify identity after an address discrepancy or a police report of identity theft. Excluded from the freeze duties: 2MM(n) lists ten categories of users (existing creditors and assignees reviewing or collecting an account, court-ordered access, child support agencies, State fraud investigators, Department of Revenue, FCRA prescreening, credit-monitoring subscriptions, providing the consumer's own report, insurance underwriting), and 2MM(p) exempts check-services/fraud-prevention companies, deposit-account information services, and resellers that keep no permanent database (resellers must still honor another agency's freeze). 10b(1) exempts from the whole Act 'Actions or transactions specifically authorized by laws administered by any regulatory body or officer acting under statutory authority of this State or the United States' — a defendant will argue reporting permitted by the FCRA is 'specifically authorized'. Private plaintiffs must be a 'person who suffers actual damage' (10a(a)).

Federal preemption analysis

Framework (15 U.S.C. §1681t, uscode.house.gov): §1681t(a) saves state law 'except to the extent that those laws are inconsistent with any provision of this subchapter, and then only to the extent of the inconsistency'; §1681t(b)(1) then lists subject-matter preemption clauses.

Read the full rule

Applied to each Illinois provision: (1) MEDICAL DEBT BAN, 815 ILCS 505/2EEEE — REAL preemption argument under §1681t(b)(1)(E), which bars state requirements 'with respect to any subject matter regulated under ... section 1681c of this title, relating to information contained in consumer reports, except that this subparagraph shall not apply to any State law in effect on September 30, 1996'. 2EEEE took effect January 1, 2025, so the 1996 grandfather does not help it, and §1681c(a)(7)-(8) already regulates 'veteran's medical debt' content, which a defendant will cite as proof that medical debt is 'subject matter regulated under section 1681c'. Status as of 2026-09-05: the CFPB's interpretive rule 'Fair Credit Reporting Act; Preemption of State Laws', 90 FR 48710, applicable October 28, 2025, states of §1681t(b)(1)(E): 'that subject matter is broad--it covers the inclusion of information in consumer reports. All State laws on that subject are preempted', and uses medical debt as its example ('if a State were to prohibit medical debt from appearing on a report in the first place, such a law would not be preempted under the prior rule. It would make no sense to forbid the former but allow the latter'). The same document concedes interpretive rules are 'non-binding' and that 'Parties interested in the application of FCRA preemption to particular State laws can litigate such questions in court.' The July 11, 2025 E.D. Tex. decision vacating the CFPB's federal medical-debt rule (Cornerstone Credit Union League v. CFPB) contained preemption language about state laws, which consumer advocates (NCLC, secondary source) characterize as dicta; the only appellate decision on point, Consumer Data Industry Ass'n v. Frey, No. 20-2064 (1st Cir. Feb. 10, 2022), did NOT uphold the Maine law outright: it vacated and reversed the district court's judgment that the Maine amendments were preempted in their entirety, held that 'Sections 1681c(a)(7) and 1681c(a)(8) do not preempt the Medical Debt Reporting Act insofar as it regulates non-veterans' medical debt', took no position on partial preemption, and remanded; on remand (D. Me. Jan. 11, 2024) the Maine act was held preempted only as to veterans' medical debt. Under that reading §1681t(b)(1)(E) would reach 2EEEE at most as to veterans' medical debt (§1681c(a)(7)-(8)); the CFPB's Oct. 28, 2025 interpretive rule takes the broader view but is non-binding; no Seventh Circuit or Illinois decision exists. No court decision on 2EEEE itself was found. SAFEST LETTER USE: cite 2EEEE as Illinois law that the bureau 'may be' violating, state that the CFPB's October 2025 position and a pending national dispute make its enforceability contested, and rest the demand on the federal §1681i reinvestigation right and §1681e(b) accuracy duty, which are not in doubt. Do not promise that medical debt 'cannot legally appear' on an Illinois report. (2) SECURITY FREEZE, 815 ILCS 505/2MM(c)-(r) — largely superseded: §1681t(b)(1)(J) preempts state requirements 'with respect to ... subsections (i) and (j) of section 1681c-1 of this title relating to security freezes'. The federal freeze (15 U.S.C. §1681c-1(i)) is 'free of charge' and faster than Illinois's (federal: place within 1 business day by phone/electronic or 3 business days by mail; remove within 1 hour by phone/electronic or 3 business days by mail; Illinois 2MM(d): 'no later than 5 business days'; 2MM(h),(l): 3 business days). Because Illinois's timelines are looser than federal, a letter should cite the federal freeze deadlines, not 2MM's. Illinois's 'protected consumer' rules for minors and persons with a disability in 2MM(c) overlap federal §1681c-1(j) and are likewise exposed to (b)(1)(J). (3) FURNISHER CONDUCT — §1681t(b)(1)(F) preempts state law on 'the responsibilities of persons who furnish information to consumer reporting agencies' except Mass. ch. 93 §54A(a) and Cal. Civ. Code §1785.25(a); Illinois has no saved provision, and 2EEEE does not reach furnishers anyway. (4) DISPUTE TIMING — §1681t(b)(1)(B) preempts any post-September 30, 1996 state deadline; Illinois has none. (5) GENERAL CONSUMER FRAUD ACT CLAIM (Sec. 2 deception/unfairness) against a bureau for inaccurate reporting: not squarely within a §1681t(b)(1) clause, but §1681t(a) inconsistency preemption and §1681h(e) qualified immunity (defamation-type claims require 'malice or willful intent to injure') apply; treat as a supplement to, never a substitute for, the FCRA claim.

Reinvestigation days detail

Illinois has no reinvestigation deadline of its own. The full text of the Consumer Fraud and Deceptive Business Practices Act (815 ILCS 505, all sections, as served by ilga.gov on 2026-09-05) contains no reinvestigation, dispute-response, or correction deadline directed at consumer reporting agencies; the only correction deadline in the Act, 815 ILCS 505/2QQQ(c) (5 business days to correct criminal record information), excludes consumer reporting agencies by 2QQQ(i).

Read the full rule

Even if Illinois enacted one now, 15 U.S.C. §1681t(b)(1)(B) would preempt it: no state requirement may be imposed 'relating to the time by which a consumer reporting agency must take any action, including the provision of notification to a consumer or other person, in any procedure related to the disputed accuracy of information in a consumer's file, except that this subparagraph shall not apply to any State law in effect on September 30, 1996' — Illinois had no such law in effect on that date. A letter must cite only the federal 30/45-day clock.

Read it yourself

Official sources. If a number below matters to your case, open the statute and read it — laws get amended, and cities often stack stricter local rules on top.

• 815 ILCS 505/2EEEE (Credit reporting; medical debt), subsection (b)
• 815 ILCS 505/2EEEE, subsection (a) definitions
• Public Act 103-0648 (SB2933), adding 815 ILCS 505/2EEEE
• Public Act 104-0417 (First 2025 General Revisory Act), Section 1(b) and Section 9999
• 815 ILCS 505/2MM(d) (security freeze placement)
• 815 ILCS 505/2MM(h), (l), (n-5), (r) (lift, removal, no fee, violation)
• 815 ILCS 505/2MM(n) and (p) (freeze exemptions)
• 815 ILCS 505/10a(a), (c) (private action; discretionary damages and fees)
• 815 ILCS 505/10a(d), (e) (AG mailing requirement; 3-year limitation)
• 815 ILCS 505/7(b), (c) (Attorney General civil penalties)
• 815 ILCS 505/10b(1) (exemption for regulator-authorized transactions)
• 815 ILCS 505/2QQQ(e), (i) (criminal record information; $100/day excludes consumer reporting agencies)
• 815 ILCS 505/2B.2 (Solicitations regarding records) — read from the full-Act page, ActID=2356
• 815 ILCS 505/2VV (Credit and public utility service; identity theft)
• 735 ILCS 5/13-202 (two-year limitation incl. statutory penalty) — backup only; displaced by 815 ILCS 505/10a(e)
• 735 ILCS 5/13-205 (five-year limitation) — backup only; displaced by 815 ILCS 505/10a(e)
• Illinois Supreme Court Rule 281 (Definition of Small Claim), amended Sept. 29, 2021, eff. Jan. 1, 2022
• 15 U.S.C. §1681t(a), (b)(1)(B), (b)(1)(E), (b)(1)(F), (b)(1)(J) (relation to State laws)
• 15 U.S.C. §1681c-1(i) (national security freeze: free of charge; 1 business day / 3 business days placement; 1 hour / 3 business days removal)
• 15 U.S.C. §1681c(a)(7) (veteran's medical debt — shows medical debt is subject matter regulated under §1681c)
• CFPB, Fair Credit Reporting Act; Preemption of State Laws (interpretive rule), 90 FR 48710 (Oct. 28, 2025), read from govinfo.gov
• Illinois Attorney General, File A Complaint (Consumer Fraud Helplines; online complaint form)
• Illinois Attorney General online Consumer Complaint Form (status probe only)
• SECONDARY — NCLC Digital Library, 'The Latest on Keeping Medical Debt Out of Credit Reports' (July 30, 2025, updated Sept. 3, 2025) — advocacy source, not a primary text
• Consumer Data Indus. Ass'n v. Frey, No. 20-2064 (1st Cir. Feb. 10, 2022) — §1681c(a)(7)-(8) do not preempt state regulation of non-veterans' medical debt; remanded on partial preemption
• 15 U.S.C. §1681p
• 815 ILCS 505/10a(e)
• 15 U.S.C. §1681i(a)(1)(A)
• 15 U.S.C. §1681i(a)(1)(B)
• 15 U.S.C. §1681i(a)(1)(C)
• 15 U.S.C. §1681i(a)(3)(A)
• 15 U.S.C. §1681i(a)(3)(B)
• 815 ILCS 505/10a(a) (private action; discretionary award)
• 815 ILCS 505/10a(a) (punitive damages proviso)
• 815 ILCS 505/10a(c)
• 15 U.S.C. §1681n(a)
• 15 U.S.C. §1681n(a)(1)(A)
• 15 U.S.C. §1681n(a)(1)(B)
• 15 U.S.C. §1681n(a)(2)
• 15 U.S.C. §1681n(a)(3)
• 15 U.S.C. §1681n(c)
• 15 U.S.C. §1681n (section heading)
• 815 ILCS 505/7(a) (authority to sue)
• 815 ILCS 505/7(a) (powers of the court, including restitution)
• 815 ILCS 505/7(b)
• 815 ILCS 505/7(c) (additional penalty for victims 65 or older)
• 815 ILCS 505/7(c) (Department on Aging State Projects Fund)
• 815 ILCS 505/7(c) (restitution has priority)
• 815 ILCS 505/7(c) (factors the court shall consider, first factor)
• 815 ILCS 505/7(c) (remaining factors)

Last checked: 2026-09-07