Background Check Merchant Accounts: FCRA, Subscription Billing and California's Delete Act

A background check company sells information about people who are not its customers. The person paying for the report is a landlord, an employer, or someone curious about a neighbour or a date. The person in the report never agreed to be in it. That gap is why acquiring banks look harder at this business than at most online services: the regulatory exposure comes from what you compile and who you sell it to, and the payment exposure comes from how you bill for it.

This guide is for employment and tenant screening companies, people-search and public-records websites, and the founders building them. It covers how the card networks classify the business, when a records site becomes a consumer reporting agency under federal law, what the FTC's case against two people-search sites tells an underwriter, what California's Delete Act now requires of data brokers, and how subscription billing shows up in your dispute numbers. Laws and rules are cited as they stood in early October 2026.

Two businesses that look alike

Companies in this space tend to fall into two groups, and the risks are different.

• Screening companies sell reports to businesses that use them to decide on a job applicant or a tenant. They are consumer reporting agencies under the Fair Credit Reporting Act (FCRA) and must check that each customer has a lawful reason to pull a report.
• People-search sites sell directly to the public online, often on a monthly subscription. Whether they are consumer reporting agencies depends on how their reports are marketed and used.

Some companies do both. As the FTC case below shows, a disclaimer on the website does not decide which side of the line you are on.

Where the card networks put background checks

Every merchant account carries a merchant category code. Visa's Merchant Data Standards Manual (April 2026) has no code named for background checks or people search, so the acquirer chooses the closest fit for what is actually sold. Codes an acquirer may consider include MCC 7321, Consumer Credit Reporting Agencies, covers merchants that provide consumer credit reporting services such as credit investigation and credit clearinghouses. MCC 7393, Detective Agencies, Protective Services, and Security Services, includes investigative services and lists private investigators and detective agencies. Visa lists MCC 7399, Business Services (Not Elsewhere Classified), as a similar-merchant alternative to both.

If an account approved as a business screening service later starts selling consumer subscriptions, the acquirer is processing a different business from the one it underwrote, so describe every product and channel up front.

When a records website is a consumer reporting agency

The FCRA defines a consumer reporting agency as anyone who, for monetary fees or dues, regularly assembles or evaluates consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties. A consumer report is any communication of information bearing on a person's credit worthiness, character, general reputation, personal characteristics or mode of living that is used or expected to be used as a factor in deciding their eligibility for credit, insurance, employment or certain other purposes (15 U.S.C. 1681a).

Being a consumer reporting agency brings specific duties. Among them:

• Follow reasonable procedures to assure maximum possible accuracy of the information in each report (15 U.S.C. 1681e(b)).
• Furnish reports only for a permissible purpose listed in the statute, and require users to identify themselves, certify the purpose for which they want the information, and certify it will be used for no other purpose (15 U.S.C. 1681b and 1681e(a)).
• For reports used in hiring, obtain the employer's certification that it has given the applicant a clear written disclosure, in a document that consists solely of that disclosure, and obtained the applicant's written authorization (15 U.S.C. 1681b(b)).

The TruthFinder and Instant Checkmate case

In 2023 the FTC brought a case against TruthFinder and Instant Checkmate, two California people-search sites that, according to the FTC, charged monthly subscription fees to view full background reports. The FTC filed its complaint on September 11, 2023 in the US District Court for the Southern District of California, and the court entered a stipulated order on October 11, 2023 requiring the companies to pay a $5.8 million civil penalty. The case ended in a stipulated order, not a trial. According to the FTC's complaint:

• The sites operated as consumer reporting agencies despite disclaimers on their websites, because they marketed reports for employment and tenant screening, including by using search engine advertising keywords such as "best background check for landlords" and "pre-employment screening".
• As consumer reporting agencies, they failed to ensure the maximum possible accuracy of their reports, sold reports to people without a permissible purpose, failed to limit who could obtain them, and did not investigate consumers' complaints about inaccuracies.
• They made millions from monthly subscriptions using push notifications and marketing emails telling subscribers that the subject of a report had a criminal or arrest record, when the record was merely a traffic ticket.
• They advertised their reports as containing "the MOST ACCURATE information available to the public", although the data came from third parties that expressly disclaimed its accuracy and the companies took no steps to verify it.
• A "Remove" button removed disputed information only from the report shown to the customer who clicked it, and a "Flag as Inaccurate" button led to no investigation at all.

Beyond the penalty, the order requires the companies to run a monitoring program that regularly assesses whether they are operating as consumer reporting agencies, to comply with the FCRA when they are, and to stop misrepresenting the accuracy of their reports. The FTC also noted that Instant Checkmate had already settled FCRA charges with the agency in 2014.

Two lessons follow for a merchant account application. Your marketing helps decide your legal category, so expect an underwriter to read your ads, not just your terms. And subscription revenue driven by alarming claims about a report's contents is the pattern the FTC challenged.

There is no new federal rule to plan for: in December 2024 the CFPB proposed a rule on how the FCRA's definitions of consumer report and consumer reporting agency apply to data brokers, then withdrew it on May 15, 2025.

California's Delete Act and the August 2026 deadline

A people-search company may also be a data broker under state law. California's Delete Act defines a data broker as a business that knowingly collects and sells to third parties the personal information of a consumer with whom it has no direct relationship. Entities are excluded only to the extent they are covered by the FCRA, the Gramm-Leach-Bliley Act and certain insurance and health privacy laws (Cal. Civ. Code 1798.99.80), so a company that runs an FCRA-covered screening business alongside a consumer people-search site may still be a data broker for the second.

A data broker must register with the California Privacy Protection Agency (CalPrivacy) by January 31 following each year in which it meets the definition, and pay a registration fee. The statute required the agency to build a single deletion platform, the Delete Request and Opt-out Platform (DROP), by January 1, 2026, through which a consumer can ask every registered data broker to delete their information at once. Since August 1, 2026, each registered data broker must:

• Access DROP at least once every 45 days.
• Process every deletion request within 45 days and delete all personal information related to the consumer, subject to limited exceptions.
• Treat a request it cannot verify as an opt-out of the sale or sharing of that consumer's information.
• Direct its service providers and contractors to do the same.
• Keep deleting the consumer's personal information at least every 45 days afterwards, and stop selling or sharing new information about them, unless the consumer asks otherwise.

From January 1, 2028, data brokers must undergo an independent compliance audit every three years (Cal. Civ. Code 1798.99.86). The fines are set per day. Failing to register costs $200 for each day, plus the fees that were due, and failing to comply with the deletion requirements costs $200 for each deletion request for each day (Cal. Civ. Code 1798.99.82).

CalPrivacy is enforcing. On August 11, 2026 it announced a $116,490 order against LocateSmarter, an Iowa data broker whose data included names, dates of birth, Social Security numbers, employment information and bankruptcy and litigation information, for failing to register on time and for requiring Californians to provide partial Social Security numbers before they could opt out of the sale of their data. Expect an underwriter to ask whether you are registered and how you process DROP requests.

Subscription billing is where the disputes come from

For a site that sells subscriptions, the card networks' recurring-billing rules apply. Under Visa's rules (18 April 2026, Tables 5-20 and 5-21), a merchant running recurring transactions must:

• Provide a simple cancellation procedure, and an online one if the subscription was sold online.
• State the fixed dates or intervals on which the customer will be charged.
• Notify the customer at least seven days before the first charge after a trial, introductory or promotional period ends, with the amount, the date and an easy way to cancel online or by text message.
• Show the recurring terms, including the length of any trial, at the moment the customer consents, separately from the general purchase terms.

When a subscriber cancels and the charges keep coming, the issuer can file Visa dispute condition 13.2, Cancelled Recurring Transaction, within 120 calendar days of the processing date, for the unused portion of the service. From April 18, 2026, a 13.2 dispute is invalid where the cardholder's cancellation came after the date of the charge, so a timestamped record of every cancellation is now direct evidence. A subscriber who says the report was not what the site described can also dispute under condition 13.3, Not as Described, which for US card-absent purchases extends to a merchant's verbal description or other documentation presented at the time of purchase.

Federal law adds the Restore Online Shoppers' Confidence Act (ROSCA), which requires an online seller using a negative option to clearly and conspicuously disclose all material terms before taking billing information, get express informed consent before charging, and provide a simple way to stop recurring charges. The FTC's 2024 click-to-cancel amendments were vacated by the Eighth Circuit in July 2025, and the FTC restarted that rulemaking with an advance notice published on March 13, 2026. Our guide to free trial and subscription billing rules covers ROSCA and the state automatic renewal laws in detail.

What an underwriter will ask

• Which products you sell, to whom, and through which channels: business screening, consumer reports, subscriptions, one-off reports, API access.
• Whether any product is FCRA-covered, and if so your permissible-purpose certification, user credentialing, accuracy and dispute procedures.
• How you keep customers from using reports for FCRA purposes, and whether your ads, landing pages and search keywords are consistent with that.
• Whether you are registered as a data broker in California and any other state that requires it, and how you handle deletion and opt-out requests.
• Your subscription flow: trial terms, renewal notices, cancellation path, refund policy and billing descriptor.

Getting the account file ready

1. Decide which of your products are FCRA-covered and make your marketing match. If you do not want to be a consumer reporting agency, stop advertising for employment and tenant screening, including in search keywords.
2. Describe your reports accurately. Do not call a traffic ticket a criminal record, and do not claim accuracy your data sources disclaim.
3. Make removal and dispute buttons do what they say, and keep records showing they did.
4. Register as a data broker where required, and build DROP processing into your data pipeline on the 45-day cycle.
5. Make cancellation as easy as sign-up, send renewal reminders, and keep timestamped records of every cancellation.
6. Use a billing descriptor that matches the brand name on your site, so a subscriber recognises the charge.
7. Keep one website per merchant account. Running another site's sales through an account approved for a different business is transaction laundering under card network rules and can put your company and its principals on the MATCH list.

Background checks are high risk because the law cares about what is in your reports and who buys them, and the card networks care about how you bill for them. A file showing which side of the FCRA line you are on, current data broker compliance and subscriptions that are easy to leave is what turns that into an approval on workable terms. PayKings works with background check and screening companies and can help you present that file to an acquiring bank. We do not give legal advice. Whether a product is covered by the FCRA is a question for your counsel.