Credit report errors in New York: what the law says

What the statute says

Small claims limit

In New York City Civil Court the figure is a ceiling, not a fixed award: $10,000. New York City Civil Court Act §1801 defines a 'small claim' as 'any cause of action for money only not in excess of ten thousand dollars exclusive of interest and costs, or any action commenced by a party aggrieved by an arbitration award rendered pursuant to part 137 of the rules of the chief administrator of the courts (22 NYCRR Part 137) in which the amount in dispute does not exceed ten thousand dollars'.

Read the full rule

The arbitration-award branch stands alongside the money branch and is not itself a cause of action for money. The definition also carries a location requirement: the defendant must either reside, or have an office for the transaction of business or a regular employment, within the City of New York — or, in the alternative, the claimant must be a tenant or lessee of real property owned by the defendant and situated within the City of New York, with a claim relating to that tenancy or lease. What the text does not settle: because the money branch is limited to a cause of action 'for money only', §1801 supplies no basis for asking a small claims court to order a credit report corrected or an item deleted, but that is an inference drawn from a definitional section, and §1801 is the only provision of the Act set out here, so the text does not settle what non-money relief, if any, a small claims part may grant. Whether the location proviso limits both branches of the definition or only the second is likewise open on the wording; it is read here as limiting the whole definition. The small claims ceilings for city courts outside New York City and for town and village justice courts rest on separate statutes that are not set out here, and no figure for them is given.

N.Y.C. Civil Court Act §1801: a small claim is 'any cause of action for money only not in excess of ten thousand dollars exclusive of interest and costs' (defendant must reside, work or do business in New York City, or the claim must be a tenant-landlord claim about NYC property).

Read the full rule

Uniform City Court Act §1801: 'any cause of action for money only not in excess of five thousand dollars exclusive of interest and costs'. Uniform Justice Court Act §1801 (town and village courts): 'any cause of action for money only not in excess of three thousand dollars exclusive of interest and costs'. GBL §380-n allows an Article 25 action 'in any court of competent jurisdiction', so state claims for actual damages within these ceilings can be filed in small claims; federal FCRA claims may also be filed in state court (15 U.S.C. §1681p). Whether a small-claims part will award punitive damages or attorney's fees is not verified here.

Code section

N.Y. Gen. Bus. Law §§ 380 through 380-v (Article 25, titled 'FAIR CREDIT REPORTING ACT'); N.Y. Pub. Health Law §§ 4925-4927 (Article 49-A, 'MEDICAL DEBT REPORTING'); 23 NYCRR Part 201 (DFS registration and prohibited practices for consumer credit reporting agencies)

Statutory damages

No New York statutory-minimum or per-violation damages. Willful noncompliance (GBL §380-l): 'any consumer reporting agency or user of information who or which willfully and knowingly fails to comply with any requirement imposed under this article with respect to any consumer is liable to that consumer in an amount…

Read the full rule

equal to the sum of: (a) Any actual damages sustained by the consumer as a result of such failure or as a result of a violation of section three hundred eighty-s of this article; (b) Such amount of punitive damages as the court may allow; and (c) In the case of any successful action to enforce any liability under this section, the costs of the action together with reasonable attorney's fees as determined by the court.' Negligent noncompliance (GBL §380-m): 'Any consumer reporting agency or user of information who or which is negligent in failing to comply with any requirement imposed under this article, other than a violation of section three hundred eighty-t of this article, with respect to any consumer is liable to that consumer in an amount equal to the sum of: (a) Any actual damages sustained by the consumer as a result of the failure; (b) In the case of any successful action to enforce any liability under this section, the costs of the action together with reasonable attorney's fees as determined by the court.' LIMITS: §380-l requires 'willfully and knowingly'; §380-m excludes security-freeze (§380-t) violations; neither section reaches furnishers; New York has no analogue to the federal $100-$1,000 statutory-damages range in §1681n(a)(1)(A), so a letter should quote federal §1681n for the dollar range and New York §380-l only for actual and punitive damages. Secondary remedy, not credit-specific: GBL §349(h) allows an injured person to recover 'such person's actual damages or fifty dollars, whichever is greater', up to treble damages 'not to exceed three times the actual damages up to one thousand dollars, if the court finds the defendant willfully or knowingly violated this section', and 'The court may award reasonable attorney's fees to a prevailing plaintiff' — but §349(d) makes it 'a complete defense that the act or practice is, or if in interstate commerce would be, subject to and complies with the rules and regulations of, and the statutes administered by, the federal trade commission or any official department, division, commission or agency of the United States.'

When it can be extended

No New York overlay — federal 15 U.S.C. §1681i(a)(1)(B) governs the 15-day extension when the consumer supplies additional relevant information during the reinvestigation. Article 25 has no extension rule.

What the bureau must do

On a dispute conveyed directly by the consumer, the consumer reporting agency must 'promptly re-investigate and record the current status of such information, unless it has reasonable grounds to believe that the dispute by the consumer is frivolous' (GBL §380-f(a)).

Read the full rule

No numeric deadline — New York never converted 'promptly' to a day count; the federal 30-day clock in 15 U.S.C. §1681i governs timing.

GBL §380-f(a): 'If a consumer disputes any item of information contained in his file, and such dispute is directly conveyed to the consumer reporting agency by the consumer, the consumer reporting agency shall promptly re-investigate and record the current status of such information, unless it has reasonable grounds to believe that the dispute by the consumer is frivolous, and it shall promptly notify the consumer of the result of its investigation, its decision on the status of the information and his rights pursuant to this section.

Read the full rule

The presence of contradictory information in a consumer's file shall not, in and of itself, constitute reasonable grounds for believing the dispute is frivolous.' If the item is found in error or cannot be verified, §380-f(b) requires the agency to '(1) promptly expunge the item and otherwise correct the file, (2) refrain from reporting the item in subsequent consumer reports, (3) clearly and conspicuously disclose to the consumer his rights to make a request for notification and upon request of the consumer, promptly notify any person designated by the consumer who has received information regarding the item during the previous year that an error existed, and shall furnish such person with the corrected information, and (4) where applicable forward a copy of the consumer's statement.' Under §380-f(d), after a reinvestigation that finds an error or an unverifiable item, 'the agency shall promptly mail the consumer a corrected written copy of the file, reflecting any changes, with an explanation of any code used, at no charge to the consumer.' Unresolved disputes: §380-f(c) — the consumer may file a dispute statement, which the agency may limit to 'not more than one hundred words if such agency provides the consumer with assistance in writing a clear summary of the dispute', and the agency must 'clearly note in all subsequent consumer reports that the item is disputed by the consumer.' SEPARATE ACCURACY DUTIES usable in a letter: §380-j(a)(4) — no agency shall 'report or maintain in the file on a consumer, information ... (4) which it has reason to know is inaccurate'; §380-j(e) — 'Consumer reporting agencies shall maintain reasonable procedures designed to assure maximum possible accuracy of the information concerning the individual about whom the report relates.' LIMIT: the 'frivolous' exception in §380-f(a) is an express defense; the 'previous year' notification in §380-f(b)(3) runs only 'upon request of the consumer' and only to persons 'designated by the consumer'.

What the furnisher must do

No New York overlay for ordinary furnishers — federal 15 U.S.C. §1681s-2(b) governs. GBL §380-l and §380-m impose liability only on a 'consumer reporting agency or user of information' (and, under §380-l, on any person whose 'knowing and willful violation of section three hundred eighty-s' — identity theft — 'resulted in the transmission or provision to a consumer reporting agency of information').

Read the full rule

Article 25 has no furnisher-accuracy or furnisher-reinvestigation section. The ONE New York furnisher-side rule is Public Health Law §4926 (effective December 13, 2023): a hospital licensed under PHL Article 28, a health care professional authorized under Education Law Title 8, or an ambulance service certified under PHL Article 30 '1. shall not furnish any portion of a medical debt to a consumer reporting agency; and 2. shall include a provision in any contract entered into with a collection entity for the purchase or collection of medical debt that prohibits the reporting of any portion of such medical debt to a consumer reporting agency.' PHL §4927: 'Any portion of a medical debt that is furnished to a consumer reporting agency shall be void.' No private right of action, no damages, and no deadline is stated in Article 49-A. PREEMPTION: PHL §4926 regulates 'persons who furnish information to consumer reporting agencies' — the subject matter of §1681s-2 — and 15 U.S.C. §1681t(b)(1)(F) preempts such state laws with only two saved provisions (Mass. ch. 93 §54A(a) and Cal. Civ. Code §1785.25(a)); New York is not saved and there is no 1996 grandfather for (F). A furnisher has a real preemption argument. Safest letter use: cite §1681s-2(b) as the operative duty and mention PHL §4926/§4927 as New York public policy, not as an independent cause of action.

Your right to free reports

New York's free-file right after adverse action or a collection notice (GBL §380-e(e)(1)) MIRRORS 15 U.S.C. §1681j(b) rather than adding to it, and its request window is SHORTER — 30 days versus the federal 60 — and both are limited to (i) a §380-i/§1681m adverse-action notice and (ii) a notice from a debt collection agency AFFILIATED with the consumer reporting agency, not any collection notice; cite federal §1681j(b) for the free copy (longer window).

Read the full rule

New York's genuine additions are §380-d(c) (the agency must 'specifically advise' consumers of the right) and §380-e(e)(1)'s last sentence ('A written statement by a consumer indicating that he has been denied credit in the past thirty days or has been contacted by a debt collection agency as described in this paragraph is sufficient to require the disclosure without charge'). GBL §380-d(c): 'All consumers shall be specifically advised that if they have been denied credit in the past thirty days they are entitled to receive a written copy of their complete file, at no charge whatsoever, should they choose to request such a copy.' GBL §380-e(e)(1): disclosure is 'without charge to any person who receives a notification of adverse action' or a debt collection notification 'if, within thirty days of receipt of such notification, the consumer makes a request.' Otherwise §380-e(e)(2) lets the agency 'impose a reasonable charge for such disclosure, provided that such charges are indicated to the consumer prior to making disclosure', capped by §380-e(e)(3) at 'the charge the consumer reporting agency would impose for providing such information to its regular customers.' §380-e(e)(4): 'No charge may be made for notifying any person of the deletion of information which is found to be in error or which can no longer be verified.' §380-f(d): corrected copy after a successful dispute 'at no charge to the consumer.' New York has NO state annual free report — federal 15 U.S.C. §1681j governs, and 15 U.S.C. §1681t(b)(4) preempts state rules on 'the frequency of any disclosure under section 1681j(a)' except for seven listed states (New York is not listed). §380-d(a)(3) recipient lookback is the SAME as federal for employment (two years) and NARROWER than federal for other purposes (six months versus the one year in 15 U.S.C. §1681g(a)(3)(A)) — the federal one-year lookback controls in a letter: sources and 'the recipients of any consumer report on the consumer which it has furnished; (i) for employment purposes within the two-year period preceding the request, and (ii) for any other purpose within the six month period preceding the request.'

Governing law

New York Fair Credit Reporting Act, General Business Law Article 25 (a full state consumer-reporting act, not merely a freeze or identity-theft statute), plus the Fair Medical Debt Reporting Act (L.2023 ch. 727) codified in GBL §380-a(v), §380-j(a)(3), §380-j(f)(1)(viii) and Public Health Law Article 49-A (§§4925-4927)

Attorney's fees

Yes, for a consumer who wins. General Business Law §380-m makes 'Any consumer reporting agency or user of information who or which is negligent in failing to comply with any requirement imposed under this article, other than a violation of section three hundred eighty-t of this article, with respect to any consumer'…

Read the full rule

liable to that consumer for '(a) Any actual damages sustained by the consumer as a result of the failure; (b) In the case of any successful action to enforce any liability under this section, the costs of the action together with reasonable attorney's fees as determined by the court.' Fees under this section therefore depend on a successful action and their amount is set by the court; the section does not make an award automatic on filing or fix a sum. Article 25's section list gives §380-t as 'Security freeze.', so a violation of the security-freeze section is carved out of this negligence remedy. The federal provisions are built the same way (15 U.S.C. §1681n(a)(3) for willful and §1681o(a)(2) for negligent noncompliance). What the text does not settle: §380-m does not define 'user of information', so whether a creditor, debt collector, hospital or other furnisher that also obtains or uses consumer reports falls within that term is not answered by the section's text, and such a party cannot be assumed to sit outside it. Article 25 also contains §380-l, 'Civil liability for willful noncompliance.', and §380-s, 'Theft of identity.'; what those sections provide about attorney's fees is not stated here. Falling outside §380-m is also not the same as being beyond remedy — other provisions of Article 25 and the federal Fair Credit Reporting Act are not addressed here.

Time limit to sue

2 years

GBL §380-n: 'An action to enforce any liability, created under this article may be brought in any court of competent jurisdiction, within two years from the date on which the liability arises, except that where a defendant has materially and willfully misrepresented any information required under this article to be…

Read the full rule

disclosed to an individual and the information so misrepresented is material to the establishment of the defendant's liability to that individual under this article, the action may be brought at any time within two years after the discovery by the individual of the misrepresentation.' This is the pre-2003 federal formulation: two years from when liability ARISES (not from discovery), with a discovery rule ONLY for material, willful misrepresentation of information the act required to be disclosed. It is therefore SHORTER in practice than federal 15 U.S.C. §1681p (2 years from discovery / 5 years from violation). A letter should treat 2 years from the violation as the safe New York clock for state-law claims and cite §1681p separately for the federal claim.

Who handles complaints

Two agencies, neither named in Article 25 itself. (1) New York State Attorney General, Consumer Frauds and Protection Bureau — enforces through Executive Law §63(12) ('repeated fraudulent or illegal acts') and GBL §349; Article 25 contains no attorney-general enforcement section (§380-o and §380-p are criminal penalties).

Read the full rule

(2) New York State Department of Financial Services (DFS) — supervises consumer credit reporting agencies that report on 1,000 or more New York consumers under 23 NYCRR Part 201 (registration §201.02, examination §201.02(f), prohibited practices §201.06, revocation §201.05). Attorney General consumer complaint form: (portal: https://ag.ny.gov/file-complaint; OAG Help Line 1-800-771-7755). DFS consumer complaint: https://myportal.dfs.ny.gov/web/guest-applications/consumer-complaint?hn=1&forward=new (portal: https://www.dfs.ny.gov/complaint

Scope limits

(1) MEDICAL DEBT — definition limits the ban: GBL §380-a(v) 'medical debt' means 'any obligation or alleged obligation of a consumer to pay any amount whatsoever related to the receipt of health care services, products, or devices provided to a person by a hospital licensed under article twenty-eight of the public health law, a health care professional authorized under title eight of the education law, or an ambulance service certified under article thirty of the public health law.

Read the full rule

Medical debt does not include debt charged to a credit card unless the credit card is issued under an open-ended or closed-ended plan offered specifically for the payment of health care services, products, or devices provided to a person.' So general-purpose credit-card balances used to pay a doctor are NOT covered; out-of-state or unlicensed providers are outside the literal definition. Effective December 13, 2023 (Ch. 727 of 2023, '§ 6. This act shall take effect immediately'); no sunset. (2) §380-j(f)(2) carves the WHOLE of subdivision (f) — the obsolescence list including (viii) medical debt — out of '(i) a credit transaction involving, or which may reasonably be expected to involve, a principal amount of fifty thousand dollars or more; (ii) the underwriting of life insurance involving, or which may reasonably be expected to involve, a face amount of fifty thousand dollars or more; or (iii) the employment of any individual at an annual salary which equals, or which may reasonably be expected to equal twenty-five thousand dollars, or more.' The separate flat ban in §380-j(a)(3) is NOT subject to (f)(2). (3) §380-j numbering churn: nysenate.gov displays three time-boxed versions of (f)(1) ('NB Effective until May 26, 2027', 'NB Effective May 26, 2027 until July 1, 2032', 'NB Effective July 1, 2032') caused by a temporary clause on intelligent-speed-assistance device fees; the medical-debt clause appears in every version but may be renumbered (viii)/(ix) — cite '§380-j(f)(1)' plus the words rather than a Roman numeral. (4) §380-f 'frivolous' exception. (5) §380-f(b)(3) prior-recipient notice only 'upon request of the consumer' and only for the 'previous year'. (6) Free file copy: only if the request is made 'within thirty days of receipt' of the adverse-action or debt-collection notification (§380-e(e)(1)); otherwise a reasonable, pre-disclosed charge is allowed (§380-e(e)(2)-(3)). (7) Limitations: 2 years from when liability ARISES; discovery rule only for material willful misrepresentation (§380-n). (8) Freeze: §380-t exempts resellers, check-services/fraud-prevention companies and deposit-account information services (§380-t(p)); protected-consumer freeze is for a person 'under the age of eighteen years' (§380-a(o)) and permits a fee 'not exceeding fifteen dollars' (§380-u(h)(1)) unless an identity-theft report is supplied or the agency already has a file (§380-u(h)(2)) — all of which is displaced by federal §1681c-1(i)/(j) via §1681t(b)(1)(J). (9) Employment credit checks restricted by §380-b(d) with exceptions (law enforcement, bonded positions, security clearances, trade secrets, fiduciary authority over $10,000, digital security roles) — out of scope for a credit-report dispute letter. (10) Arrest/charge ban §380-j(a)(1) has a retail-detention exception in §380-j(b).

Defeasible rules

Reinvestigation duty (§380-f(a)) — defeated if the agency 'has reasonable grounds to believe that the dispute by the consumer is frivolous'; contradictory file information alone is not such grounds.

Read the full rule

Willful damages and punitive damages (§380-l) — require proof the agency 'willfully and knowingly' failed to comply; no bona-fide-error defense is written into Article 25, but negligence liability (§380-m) requires proof of negligence and excludes freeze violations. Medical-debt ban — defeated (a) if the debt is outside the §380-a(v) definition (non-licensed provider; general credit-card debt), (b) for the (f)(1) obsolescence version only, if the transaction is a $50,000+ credit or life-insurance transaction or $25,000+ salary employment (§380-j(f)(2)), and (c) potentially by federal preemption under §1681t(b)(1)(E) — unresolved for New York; CFPB's Oct. 28, 2025 interpretive rule (non-binding) supports preemption, the First Circuit's Frey decision supports survival. PHL §4926 provider furnishing ban — defeated by the §1681t(b)(1)(F) furnisher preemption argument; no remedy stated. Free file copy — defeated if the request comes more than 'thirty days' after the adverse-action or collection notice. State claims — time-barred 2 years after liability arises (§380-n) even if undiscovered, unless the willful-misrepresentation exception applies. GBL §349 claim — 'complete defense' under §349(d) if the practice complies with federal statutes administered by a federal agency. 23 NYCRR §201.06 prohibited practices are conditioned on conduct 'prohibited by any federal law, or by any New York State law that is not preempted by federal law' and give no private remedy.

Enforcement agency

New York State Attorney General (Executive Law §63(12): 'Whenever any person shall engage in repeated fraudulent or illegal acts or otherwise demonstrate persistent fraud or illegality in the carrying on, conducting or transaction of business, the attorney general may apply ...

Read the full rule

for an order enjoining the continuance of such business activity or of any fraudulent or illegal acts, directing restitution and damages'; GBL §349 deceptive practices). New York State Department of Financial Services for registered consumer credit reporting agencies (23 NYCRR §201.02 registration of any agency reporting on 1,000 or more New York consumers; §201.06(e) prohibits a registrant from failing 'to comply with the provisions of federal law relating to the accuracy of the information in any consumer report relating to a New York consumer'; §201.05 refusal/revocation/suspension after notice and hearing). Article 25 itself names no administrative enforcer; §380-o and §380-p are criminal provisions (fine 'not more than five thousand dollars or imprisoned not more than one year, or both'). Complaint URLs: AG https://formsnym.ag.ny.gov/OAGOnlineSubmissionForm/faces/OAGCFCHome ; DFS https://myportal.dfs.ny.gov/web/guest-applications/consumer-complaint?hn=1&forward=new . The federal CFPB and FTC retain concurrent authority.

Medical debt rules

New York bans medical debt from consumer reports outright, regardless of amount, age or payment status — but only for debt to New York-licensed hospitals, Education Law Title 8 health care professionals and certified ambulance services, and not for general-purpose credit-card debt.

Read the full rule

GBL §380-j(a): 'No consumer reporting agency shall report or maintain in the file on a consumer, information: ... (3) relative to a medical debt as defined in this statute'. GBL §380-j(f)(1)(viii): no consumer report may contain 'information relating to a medical debt regardless of the date it was incurred' (this clause, unlike (a)(3), is subject to the §380-j(f)(2) carve-out for $50,000+ credit or life insurance and $25,000+ employment). Definition: GBL §380-a(v) (quoted in scope_limits). Provider side: PHL §4926 (no furnishing; collection contracts must forbid reporting) and PHL §4927 ('Any portion of a medical debt that is furnished to a consumer reporting agency shall be void.'); PHL §4925 defines 'collection entity' as 'any individual, partnership, corporation, trust, estate, co-operative, association, government or government subdivision, agency or other entity that either purchases medical debt or collects medical debt on behalf of another entity.' Enacted by S4907-A, signed as Chapter 727 of 2023 on December 13, 2023, effective immediately; no sunset; no stated remedy beyond Article 25's general §380-l/§380-m liability against the CRA. Federal status: the CFPB's January 2025 federal medical-debt rule was vacated in 2025 (per news reports — not read from a court document), so there is no federal ban; the federal fallback for a letter is the §1681i reinvestigation and §1681e(b) accuracy duty. Preemption risk is real and unresolved for New York (see federal_preemption_analysis): safest letter language is 'New York law prohibits reporting this medical debt (GBL §380-j(a)(3)); independently, the item is inaccurate/unverifiable and must be reinvestigated under 15 U.S.C. §1681i.' Preemption exposure is real — see federal_preemption_analysis (Cornerstone, E.D. Tex. 2025: dicta that a state ban on coded medical debt is preempted under §1681t(a); the CFPB's Oct. 2025 interpretive rule; Galper (2d Cir. 2015) reading §1681t(b)(1) narrowly). Do not promise deletion as a certainty.

Relationship to fcra

GBL Article 25 is a 1970s-style state copy of the original FCRA, narrower than today's federal act: it covers consumer reporting agencies and users, not furnishers; it has no day-count for reinvestigation; its damages provisions track pre-1996 federal law (actual + punitive + fees for willful; actual + fees for negligent, no statutory minimum); and its limitations period tracks pre-2003 federal law (2 years from when liability arises).

Read the full rule

Where New York is MORE protective than federal law: medical debt is banned outright from reports (§380-j(a)(3)); arrests/charges may not be reported without a conviction or pending charge (§380-j(a)(1)); satisfied judgments and paid collection accounts drop off after 5 years rather than 7 (§380-j(f)(1)(ii), (iv)); a duty to 'specifically advise' consumers of the free-copy right (§380-d(c)) — the free copy itself mirrors federal §1681j(b) on a shorter, 30-day window and is not an addition; punitive damages are available without a statutory cap (§380-l(b)); and the consumer may direct notice of a correction to anyone who received the item within the 'previous year' (§380-f(b)(3)). Where New York is LESS protective or silent: no numeric reinvestigation deadline; no statutory-minimum damages; shorter effective limitations period; no furnisher liability; bankruptcy obsolescence 14 years (federal 10 controls in practice); no state annual free report. Federal law remains the primary source for every deadline in a demand letter.

Security freeze rules

New York has its own freeze statute (GBL §380-t, plus §380-u for protected consumers under 18), but for a demand letter the FEDERAL rules control because 15 U.S.C. §1681t(b)(1)(J) preempts state law on the subject matter of §1681c-1(i) and (j) with no grandfather.

Read the full rule

New York text, for reference only: §380-t(a) — a consumer may request a freeze 'by sending a request in writing with confirmation of delivery requested or via telephone, secure electronic means, or other methods developed by the consumer credit reporting agency'; §380-t(b) — for requests received on or after January 1, 2010 the agency 'shall place a security freeze on the consumer credit report of or relating to such consumer no later than one business day after receiving such request' (no mail/electronic distinction); §380-t(e)(1) — temporary lift 'no later than three business days after receiving such request', and for electronic/telephone requests after September 1, 2009 'within fifteen minutes after the request is received'; §380-t(n) — 'No consumer credit reporting agency shall charge a fee to any consumer for the placement of any security freeze, the removal of any security freeze, the temporary lift of any security freeze for a specific party or period of time, or the issuance of any replacement personal identification number or password.'; §380-t(b) also bars the agency from telling a third party 'that the consumer requesting the freeze is alleging to be the victim of domestic violence or identity theft, without the written authorization of the consumer'; §380-t(p) exempts resellers, check-services/fraud-prevention companies and deposit-account information services. §380-u (protected consumer under 18): placement 'Within thirty days after receiving a request', fee 'not exceeding fifteen dollars' per placement/removal except where an identity-theft report is provided or the agency already has a file. Federal (15 U.S.C. §1681c-1(i), uscode.house.gov): placement free of charge within '1 business day after receiving the request directly from the consumer' by phone/electronic means or '3 business days' by mail; removal within '1 hour' (phone/electronic) or '3 business days' (mail); protected consumer = under 16 or an incapacitated/protected person with a guardian, free of charge. A letter should cite §1681c-1 and may note New York's parallel no-fee rule; it should NOT claim a one-business-day mail deadline or a $15 fee on New York authority.

Reinvestigation days note

The day counts are federal. Under 15 U.S.C. §1681i(a)(1)(A), which applies 'Subject to subsection (f) and except as provided in subsection (g)', a consumer reporting agency that is notified of a dispute by the consumer, directly or through a reseller, must, free of charge, conduct a reasonable reinvestigation and either record the current status of the disputed information or delete the item from the file, before the end of the 30-day period beginning on the date it receives the notice of the dispute.

Read the full rule

Under (a)(1)(B), that 30-day period 'may be extended for not more than 15 additional days if the consumer reporting agency receives information from the consumer during that 30-day period that is relevant to the reinvestigation'. Forty-five days is therefore a ceiling rather than a separate deadline, and within this section the extension is triggered by the consumer supplying relevant information inside the first 30 days — not by the dispute following a free annual report. Under (a)(1)(C) the extension is unavailable where, during the 30-day period, the disputed information is found to be inaccurate or incomplete or the agency determines that it cannot be verified. Under (a)(3)(A) the agency may terminate the reinvestigation altogether if it reasonably determines the dispute is frivolous or irrelevant, including where the consumer has failed to provide sufficient information to investigate. The two carve-outs in the opening words matter in an individual case: subsection (f)(1) exempts a reseller from the requirements of the section except as provided in (f)(2), and subsection (g) sets a separate dispute process for a veteran's medical debt, so which period governs a given dispute turns on whether one of those applies. What the text does not settle: §1681i itself sets no period triggered by a dispute that follows a free annual report, but §1681i alone does not speak to deadlines that other Fair Credit Reporting Act sections or federal regulations may impose, so the text does not establish that no such deadline exists elsewhere in federal law. New York's General Business Law Article 25 contains a dispute provision of its own, '380-f. Procedure for resolving disputes.', and no New York day count is stated here.

Who is liable scope limit

GBL §380-l and §380-m: only a 'consumer reporting agency or user of information' (definitions: §380-a(e) consumer reporting agency = 'any person who, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit…

Read the full rule

information or other information on consumers for the purpose of furnishing consumer reports or investigative consumer reports to third parties'; §380-a(i) user = 'any person receiving or requesting a consumer report or an investigative consumer report other than the subject thereof'). Plus, under §380-l only, 'Any person, firm, partnership, corporation, or association whose knowing and willful violation of section three hundred eighty-s of this article resulted in the transmission or provision to a consumer reporting agency of information that would otherwise not have been transmitted or provided' (identity thieves). EXCLUDED: ordinary furnishers (creditors, collectors) — no Article 25 liability; hospitals/professionals/ambulance services under PHL §4926 face no stated damages remedy. §380-m (negligence) excludes 'a violation of section three hundred eighty-t' (security freeze). 23 NYCRR Part 201 applies only to a consumer credit reporting agency that 'within the previous 12-month period, has assembled, evaluated, or maintained a consumer credit report on one thousand or more New York consumers' (§201.02(a)) and creates no private right of action.

Federal preemption analysis

Governing text (uscode.house.gov, 15 U.S.C. §1681t): subsection (a) saves state law 'except to the extent that those laws are inconsistent with any provision of this subchapter, and then only to the extent of the inconsistency'; subsection (b)(1) bars any state 'requirement or prohibition ...

Read the full rule

with respect to any subject matter regulated under' the listed sections. Provision by provision for New York: (1) §380-f dispute procedure — (b)(1)(B) preempts state dispute-timing rules unless they were 'in effect on September 30, 1996'. No New York day count is set out on this page, so which state timing rule, if any, that clause would reach is not settled here; the periods stated on this page are the federal ones in §1681i (30 days, extendable by not more than 15 additional days where the consumer supplies relevant information within that period). The non-timing parts of §380-f (expunge, free corrected copy, notify designated recipients) fall within no (b)(1) category and survive unless 'inconsistent' under §1681t(a). (2) §380-j(a)(4) and §380-j(e) accuracy duties — §1681e(b) is not in the §1681t(b)(1) list, so these are not expressly preempted; a defendant is left with the weaker 'inconsistency' argument under §1681t(a). A New York accuracy claim accordingly stands alongside a federal §1681e(b) claim rather than in place of it. (3) §380-j(a)(3) and (f)(1)(viii) CRA-side medical debt ban (effective Dec 13, 2023) — squarely post-1996, so the (b)(1)(E) grandfather is unavailable. The First Circuit held that '(b)(1)(E) narrowly preempts state laws that impose requirements or prohibitions with respect to the specific subject matters regulated under Section 1681c' and that 'Sections 1681c(a)(7) and 1681c(a)(8) do not preempt the Medical Debt Reporting Act insofar as it regulates non-veterans' medical debt' (Consumer Data Industry Ass'n v. Frey, No. 20-2064, 1st Cir. Feb. 10, 2022). On remand the District of Maine (Jan. 2024) held that the FCRA preempts Maine's rule as to the timing of veterans' medical debt but not as to non-veterans' medical debt; that holding is reported in secondary accounts rather than quoted from the decision itself. Against that reading: the CFPB's interpretive rule 'Fair Credit Reporting Act; Preemption of State Laws', 90 FR 48710 (Oct. 28, 2025), withdrew the 2022 interpretive rule and reads (b)(1)(E) broadly ('Congress plainly meant to sweep away most State regulation in the area'), specifically naming state bans on 'medical debt' — but the rule states 'As guidance, this interpretive rule does not have the force or effect of law', and it relegates Frey to footnote 35. No decision addressing the New York ban is cited on this page. A defendant consumer reporting agency has a real and currently strengthened preemption argument; the consumer has First Circuit authority that binds only in that circuit and is persuasive, not binding, in the Second. Because the ban's survival is unsettled, the same item is reachable on two independent footings: New York law prohibits it under §380-j(a)(3), and the federal accuracy and reinvestigation duties of §1681e(b) and §1681i apply whether or not the state ban is preempted, so a demand resting on those duties does not depend on the state ban surviving. (4) PHL §4926 provider-side furnishing ban — its subject matter is that of §1681s-2; (b)(1)(F) has no grandfather and saves only Massachusetts and California, so a furnisher has a strong preemption argument and the section carries weight as a statement of New York policy rather than as a duty enforceable against the furnisher through that section. (5) §380-j(f)(1) adverse-information time limits (14-year bankruptcy, 5-year satisfied judgment, 5-year paid collection, arrests only with conviction under (a)(1)) — same subject matter as §1681c(a), and preempted by (b)(1)(E) unless the particular subdivision was 'in effect on September 30, 1996'. Article 25 dates from 1977, but the published text of §380-j carries no enactment date for each subdivision, so the text does not settle which parts of §380-j(f)(1) predate that cutoff; whether the five-year paid-collection rule survives is unsettled for the same reason. The federal seven-year rule in §1681c(a) applies independently of that question. (6) §380-t and §380-u security freezes — (b)(1)(J) preempts state law on the subject matter of §1681c-1(i) and (j) with no grandfather, so the federal freeze rules are the operative ones: no charge; a freeze placed within 1 business day of an electronic or telephone request and 3 business days of a mailed request; removal within 1 hour of an electronic or telephone request. New York's own freeze timing and the $15 fee its protected-consumer freeze allows fall inside that preempted subject matter and are displaced by the federal rules. (7) §380-i user adverse-action duties — subject matter of §1681m(a) and (b); (b)(1)(C) preempts with no grandfather, so §1681m supplies the duties that bind a user of a consumer report. (8) §380-s identity theft — New York has no consumer-reporting-agency blocking procedure; §1681c-2 governs and (b)(5)(C) preempts state law on that conduct. (9) §380-d/§380-e free disclosure after adverse action — (b)(4) preempts only the frequency of the annual disclosures under §1681j(a); an adverse-action free copy is a different trigger and is also required federally by §1681j(b), so the state and federal entitlements stand together. (10) §380-l/§380-m damages and fees and §380-n limitations — remedies provisions are not listed in (b)(1); they apply to whatever substantive New York duties survive. Two further authorities bear on the question in New York. Against the ban: Cornerstone Credit Union League v. CFPB, No. 4:25-cv-16-SDJ, Doc. 52 (E.D. Tex. July 11, 2025) (Jordan, J.), vacating the CFPB's January 2025 medical-debt rule, stated at p. 29 that 'any state law purporting to prohibit a CRA from furnishing a credit report with coded medical information would be inconsistent with FCRA and therefore preempted' — dicta, not binding in New York, resting on §1681t(a) inconsistency (FCRA §1681b(g) permits coded medical debt) rather than on §1681t(b)(1)(E), and therefore not answered by Frey's narrow reading of (b)(1)(E); it is the most recent federal court statement on point and a defendant will cite it. For the narrow reading: the Second Circuit in Galper v. JP Morgan Chase Bank, N.A., 802 F.3d 437 (2d Cir. 2015) construed §1681t(b)(1) 'fairly but narrowly' and held that a state claim is preempted only when it 'concerns that subject matter'; Galper addressed (b)(1)(F) and identity-theft claims, so its application to (b)(1)(E) and the medical-debt ban is by analogy, but it is binding circuit authority in New York that the CFPB's rule expressly disagrees with. Galper's narrow reading of (b)(1)(F) does not save PHL §4926, which directly concerns furnishing to consumer reporting agencies.

Reinvestigation days detail

GBL §380-f(a) requires the agency to 'promptly re-investigate' and 'promptly notify the consumer of the result of its investigation'. 'Promptly' is not defined anywhere in Article 25. A demand letter should state the federal 30-day deadline (15 U.S.C.

Read the full rule

§1681i(a)(1)(A)) and may add that New York independently requires prompt reinvestigation and, on a finding of error or unverifiability, prompt expungement and a free corrected copy (§380-f(b), (d)). Preemption: 15 U.S.C. §1681t(b)(1)(B) preempts state law on 'the time by which a consumer reporting agency must take any action ... in any procedure related to the disputed accuracy of information in a consumer's file, except that this subparagraph shall not apply to any State law in effect on September 30, 1996.' Because New York sets no time, nothing turns on the grandfather; do not describe 'promptly' as a New York deadline shorter than 30 days.

Read it yourself

Official sources. If a number below matters to your case, open the statute and read it — laws get amended, and cities often stack stricter local rules on top.

• N.Y. Gen. Bus. Law Article 25 (table of contents)
• N.Y. Gen. Bus. Law § 380-f(a)
• N.Y. Gen. Bus. Law § 380-f(b), (d)
• N.Y. Gen. Bus. Law § 380-l
• N.Y. Gen. Bus. Law § 380-m
• N.Y. Gen. Bus. Law § 380-n
• N.Y. Gen. Bus. Law § 380-j(a), (e)
• N.Y. Gen. Bus. Law § 380-j(f)(1), (f)(2)
• N.Y. Gen. Bus. Law § 380-a(v), (o), (q), (e), (i)
• N.Y. Gen. Bus. Law § 380-d(c)
• N.Y. Gen. Bus. Law § 380-e(e)
• N.Y. Gen. Bus. Law § 380-t(b), (e)(1), (n), (p)
• N.Y. Gen. Bus. Law § 380-u (placement timing; fees)
• N.Y. Gen. Bus. Law § 380-s
• N.Y. Gen. Bus. Law § 380-o
• N.Y. Pub. Health Law § 4926
• N.Y. Pub. Health Law § 4927
• N.Y. Senate Bill S4907-A (2023), Fair Medical Debt Reporting Act, Chapter 727 of 2023
• 15 U.S.C. § 1681t(a), (b)(1)(B), (E), (F), (J), (b)(4), (b)(5)
• 15 U.S.C. § 1681c-1(i), (j)
• Consumer Data Industry Ass'n v. Frey, No. 20-2064 (1st Cir. Feb. 10, 2022) (reported at 26 F.4th 1)
• CFPB, Fair Credit Reporting Act; Preemption of State Laws (interpretive rule), 90 Fed. Reg. 48710 (Oct. 28, 2025)
• ABA Banking Journal, 'Maine district court rules FCRA partially preempts state law on credit reporting restrictions' (Feb. 2024) — SECONDARY SOURCE summarizing the D. Me. remand decision in CDIA v. Frey (No. 1:19-cv-00438)
• NCLC Digital Library, 'What the CFPB's Recent FCRA Preemption Guidance Gets Wrong' — SECONDARY SOURCE
• 23 NYCRR Part 201 (adopted text), §§ 201.02, 201.05, 201.06
• NY DFS, Consumer Credit Reporting Agencies (registration page)
• NY DFS, File a Complaint
• NY Attorney General, File a complaint
• N.Y. Executive Law § 63(12)
• N.Y. Gen. Bus. Law § 349(a), (d), (h)
• N.Y.C. Civil Court Act § 1801
• N.Y. Uniform City Court Act § 1801
• N.Y. Uniform Justice Court Act § 1801
• Galper v. JP Morgan Chase Bank, N.A., 802 F.3d 437 (2d Cir. 2015) — §1681t(b)(1) construed 'fairly but narrowly'
• Cornerstone Credit Union League v. CFPB, No. 4:25-cv-16-SDJ, Doc. 52 (E.D. Tex. July 11, 2025) — vacatur of the CFPB medical-debt rule; dicta on state bans at p. 29
• 15 U.S.C. §1681i(a)(1)(A) (30-day reinvestigation duty)
• 15 U.S.C. §1681i(a)(1)(A) (opening clause making the duty subject to subsections (f) and (g))
• 15 U.S.C. §1681i(f)(1) (reseller exemption)
• 15 U.S.C. §1681i(g) (heading)
• 15 U.S.C. §1681i(a)(1)(B) (15-day extension)
• 15 U.S.C. §1681i(a)(1)(C) (limit on the extension)
• 15 U.S.C. §1681i(a)(3)(A) (frivolous or irrelevant disputes)
• N.Y. Gen. Bus. Law art. 25, section list (§380-f)
• N.Y. Gen. Bus. Law §380-m (persons liable; §380-t carve-out)
• N.Y. Gen. Bus. Law §380-m(b) (costs and attorney's fees)
• N.Y. Gen. Bus. Law §380-m(a) (actual damages)
• N.Y. Gen. Bus. Law art. 25, section list (§380-t)
• N.Y. Gen. Bus. Law art. 25, section list (§380-a)
• N.Y. Gen. Bus. Law art. 25, section list (§380-l)
• N.Y. Gen. Bus. Law art. 25, section list (§380-s)
• N.Y. City Civ. Ct. Act §1801 (money-claim branch)
• N.Y. City Civ. Ct. Act §1801 (22 NYCRR Part 137 arbitration-award branch)
• N.Y. City Civ. Ct. Act §1801 (venue proviso)

Last checked: 2026-09-07