Section 230 Applies to Consumer Reporting Agencies (But Only Sometimes)–Foley v. IRBsearch

[A reminder that I don’t do April Fools gags.]

This lawsuit is against IRBsearch, a data aggregator of public records and other material allegedly scraped from the web. The plaintiffs claim that IRBsearch provided erroneous reports that denied them employment opportunities. The plaintiffs sued for FCRA violations and defamation. I’ll focus only on the Section 230 discussion.

ICS Provider. “Defendant’s website falls within the broad sweep” of ICS.

Information Provided by Another ICP.

Defendant is not the developer of the content at issue. Defendant’s report on Plaintiff — which is incorporated by reference in the Amended Complaint — is essentially a compendium of third-party information…Defendant’s summarizing and rearranging of third-party information does not amount to materially contributing to it. The report is a straightforward list of public records organized into categories such as “Address Summary,” “Bankruptcy Records,” and “Voter Registrations.” By compiling this report, Defendant merely makes third-party content more available and usable

Publisher/Speaker Claims. The defamation claim is a publisher claim. The plaintiff literally described the defendant as publishing the report. “A defamation claim based on publishing false statements provided by third parties is the quintessential claim that treats the defendant as the publisher of thirdparty content.” Section 230 preempts the defamation claim against IRBsearch.

(In a footnote, the court notes that if the defendant is a consumer reporting agency, the defamation claim also will be preempted by the FCRA).

In contrast, the FCRA claims aren’t preempted. “Plaintiff alleges that Defendant violated several provisions of the FCRA by refusing to provide all the information it possessed about Plaintiff in response to a request; failing to provide ‘at the time’ notice; and failing to ensure maximum possible accuracy.” The last piece sounds a little dubious: inaccurate credit reports only matter when they are published to third parties, so the “maximum possible accuracy” claim is a backdoor defamation claim that should get equivalent Section 230 treatment.

The court continues:

Plaintiff also alleges that Defendant “violate[d] the prohibition on publishing obsolete information in violation of” § 1681c(a)(2) of the FCRA. Although the latter allegation (Count Three) includes the term “publishing,” the gravamen of this claim (and, indeed, of all Plaintiff’s FCRA claims) is the violation of a statutory requirement, not the publication of third-party content. The FCRA prohibits CRAs from including in consumer reports “[c]ivil suits, civil judgments, and records of arrest that, from date of entry, antedate the report by more than seven years.” Any allegation that Defendant violated this provision has nothing to do with the content of the obsolete record (here, “tax lien, judgment, and bankruptcy information that antedated the report by more than seven years.”) Thus, it is not a claim against Defendant qua publisher; rather, it is a claim against Defendant qua CRA, subject to this and other FCRA requirements aimed at providing consumers with certain kinds of information

What? The other FCRA claims already address the defendant’s alleged failure to provide proper disclosures to the consumer. This provision, in contrast, plainly involves the publication of third-party content–the word “publishing” is literally in the statutory text, and the violation allegedly occurred by transmitting a report with the verboten material. This highlights the false dichotomy the court articulates between “the violation of a statutory requirement” and “the publication of third-party content”–huh? If the statutory requirement imposes liability for publishing third-party content, then it’s covered by Section 230. I cannot understand how the court concluded that this FCRA prong wasn’t a “publisher/speaker” claim.

The court acknowledges the very relevant Henderson ruling from the Fourth Circuit, which rejected Section 230’s application to FCRA claims. (This case is in the SDNY, so it’s not bound by the Fourth Circuit’s ruling). However, the court says it “parts company with the Fourth Circuit” and distinguishes Henderson in a series of two footnotes.

In the Henderson case, the defendant allegedly “materially contributed” to the report by summarizing the materials. In contrast, in this case, the plaintiff alleges that the defendant included old information and, with respect to allegedly false information about a past judgment, “Plaintiff does not allege that Defendant manipulated or edited the information about this judgment to make it inaccurate.”

Later, the court says: “the Court disagrees with the Henderson Court’s reasoning insofar as it considered FCRA §§ 1681e(b) and 1681k(a) to hold CRAs liable for publishing third-party content rather than for their own conduct as CRAs.”

On the plus side, this opinion shows that Section 230 does apply to consumer reporting agencies, despite the FCRA regulatory structure. Also, the court finds ways around the abysmal Henderson ruling, rather than accepting it verbatim.

On the minus side, the court navigates around Henderson in an even more plaintiff friendly way, by saying that several FCRA claims are about the CRA’s first-party conduct and thus can never be subject to Section 230, even when the statute refers to “publishing.”

We’ll see if this produces any benefits for the plaintiffs once we find out if the defendant even qualifies as a consumer reporting agency, something the court sidestepped in deference to the plaintiffs’ allegations on a motion to dismiss.

Case Citation: Foley v. IRBsearch, LLC, 2025 WL 950679 (S.D.N.Y. March 28, 2025)