Avoiding Liability in Skip Tracing
Everything written about this is written from the searcher’s side: here is what a tracer must do. That is the wrong seat if you are the one commissioning the work, because three federal provisions attach liability to the person who ordered a locate independently of the person who ran it. Asking for something is itself a violation under the financial-privacy statute. Knowingly using motor-vehicle personal information for a purpose the law does not permit carries a liquidated damages floor of $2,500 whether or not you pulled the record. And the certification you signed with your data supplier gives that supplier its own cause of action against you. None of that is exotic; all of it is in the enacted text, with numbers you can check in ten minutes. This page sets out where the exposure actually sits, what the file that answers it looks like, and the boundary that decides them. We are a public-records research firm, and this is general information rather than legal advice.
The Short Version
Skip tracing liability reaches the party who ordered the locate, not only the firm that ran it. 15 U.S.C. 6821(b) makes the request itself the offence when the requester knows it will come by deception. 18 U.S.C. 2724 reaches obtaining, disclosing or using a motor vehicle record outside a permitted purpose, with damages not less than $2,500. 15 U.S.C. 1681n(b) lets your data supplier sue you. The FCRA’s permissible-purpose list at 1681b(a) is closed and names no purpose called locating a person: a locate is not a consumer report, we are not a consumer reporting agency, and using one to decide a tenancy, a job, credit or insurance is the fastest route into 1681n. General information, not legal advice.
Three Provisions That Reach the Person Who Ordered It
Quoted, numbered and checkable. This is the part the ranking pages leave out.
One: the request is the violation
15 U.S.C. 6821(b) does something the neighbouring provisions do not: it reaches the person who asked. Soliciting somebody else to go and get customer information out of a financial institution is itself a violation of the subchapter, where the person asking knows it will be sought by one of the deceptive routes subsection (a) sets out – a false statement to the institution, a false statement made to its customer, or a document known to be forged or fraudulently obtained. The provision is quoted in full on our page about that statute; what belongs here is its consequence, which is a second offence with a second defendant.
Read that against how work is actually commissioned. “Find out where he banks, I don’t care how” is not a briefing style; under subsection (b) it is conduct. The vendor’s violation and the buyer’s violation are separate, and the buyer’s does not require the vendor to have succeeded. This is a solid reason to want a supplier that declines things at intake, and it is why we put a decline in writing rather than quietly repricing the job.
Two: using the record is enough, and the floor is fixed
18 U.S.C. 2724(a) creates a private cause of action against a person who knowingly obtains, discloses or uses personal information from a motor vehicle record for a purpose not permitted under the chapter. The verb “uses” is the one that travels. A creditor who receives a DMV-derived address from a supplier and then applies it to a purpose outside 18 U.S.C. 2721(b) has a problem of their own, whatever the supplier did.
The remedies are not discretionary at the bottom. Section 2724(b)(1) allows actual damages “but not less than liquidated damages in the amount of $2,500”; (b)(2) allows punitive damages on proof of wilful or reckless disregard of the law; (b)(3) allows reasonable attorneys’ fees and litigation costs; and (b)(4) allows other equitable relief. A fixed floor per individual is what makes this statute a class-action shape rather than a nuisance.
Three: your own supplier can sue you
15 U.S.C. 1681n is usually quoted only for its consumer remedies – subsection (a)(1)(A) gives actual damages or damages of not less than $100 and not more than $1,000, and (a)(1)(B) gives a consumer whose report was obtained by a natural person under false pretenses or knowingly without a permissible purpose actual damages or $1,000, whichever is greater, with punitive damages and attorney’s fees on top. Subsection (b) is the one nobody quotes: any person who obtains a consumer report from a consumer reporting agency under false pretenses or knowingly without a permissible purpose shall be liable to the consumer reporting agency for its actual damages or $1,000, whichever is greater.
So the compliance certification you clicked through when you opened the data account is not a protection you bought. It is the mechanism by which the agency establishes that you knew, and the statute gives the agency its own claim. Buyers routinely describe that certification as evidence of their diligence. It is evidence, but not of that. If you would rather have a purpose recorded before any search runs than a certification that only helps your supplier, you can place the locate with us and state the matter and the interest at intake.
Six Ways a Buyer Gets Caught
None of these requires the vendor to have done anything wrong.
Briefing a Vendor Loosely
Telling a supplier to get bank details however they must is conduct under 6821(b). The instruction is separately unlawful.
Repurposing an Address You Received
Section 2724(a) reaches the person who knowingly uses motor-vehicle personal information for a purpose outside 2721(b), not only the person who pulled it.
Relying on a Category You Cannot Occupy
DPPA 2721(b)(8) permits use by a licensed private investigative agency or licensed security service. You either hold that licence or the paragraph is not yours.
Treating a Locate as a Screening Report
The FCRA’s permissible-purpose list is closed and contains no locating purpose. Using a locate to decide a tenancy or a hire is the classic 1681n case.
Assuming the Certification Protects You
Section 1681n(b) makes the certifier liable to the consumer reporting agency itself for actual damages or $1,000, whichever is greater.
Keeping No Record of Why
The permissible purpose is a fact about the moment of the request. Reconstructed a year later under discovery, it reads as reconstruction.
Do You Actually Have a Purpose?
The four paragraphs of DPPA 2721(b) that a locate is usually claimed under, read against what each one actually says.
| Paragraph | What it permits | The condition people forget |
|---|---|---|
| 2721(b)(3) | Use in the normal course of business by a legitimate business or its agents, employees or contractors | Only to verify the accuracy of information the individual submitted to you, and where that information is wrong or has gone stale, only to obtain the correct information, and only for preventing fraud by, pursuing legal remedies against, or recovering on a debt or security interest against, that individual. Not a general research permission. |
| 2721(b)(4) | Use in connection with any civil, criminal, administrative or arbitral proceeding in any court or agency, or before a self-regulatory body The litigation route | The paragraph names service of process, investigation in anticipation of litigation, and the execution or enforcement of judgments and orders. It is anchored to a proceeding, actual or anticipated – not to a commercial interest in finding somebody. |
| 2721(b)(8) | Use by any licensed private investigative agency or licensed security service, for any purpose permitted under the subsection | It is a licence category, not a description of work. A firm that is not licensed as an investigative agency cannot stand in this paragraph however investigative its work sounds – and note it only reaches purposes already permitted elsewhere in (b). |
| 2721(b)(13) | Use by any requester who demonstrates it has obtained the written consent of the individual | Written, obtained, and demonstrable. Consent recalled from a phone call is none of the three. |
| 2721(c) | Resale or redisclosure by an authorised recipient | Only for a use permitted under subsection (b), and the recipient must keep records for five years identifying every person or entity that received the information and the permitted purpose it will be used for, available to the motor vehicle department on request. |
The FCRA List Is Closed, and Locating Is Not On It
This is the structural reason a locate must never become a screening decision.
15 U.S.C. 1681b(a) opens with a phrase that does a lot of work: subject to subsection (c), a consumer reporting agency may furnish a consumer report under the following circumstances and no other. What follows is a court order or a qualifying subpoena; the consumer’s own written instructions; a person the agency has reason to believe intends to use it for one of seven listed sub-purposes at (a)(3)(A) through (G) – a credit transaction including review or collection of an account, employment purposes, insurance underwriting, eligibility for a government licence or benefit where financial responsibility must be considered, valuation or credit-risk assessment of an existing obligation by an investor, servicer or current insurer, a legitimate business need arising from a consumer-initiated transaction or an account review, and government travel charge cards; a certified request from a State or local child support enforcement agency at (a)(4); furnishing to an agency administering a State plan under 42 U.S.C. 654 for use in setting an initial or modified child support award at (a)(5); and furnishing to the Federal Deposit Insurance Corporation or the National Credit Union Administration in connection with its appointment or its exercise of powers as conservator, receiver or liquidating agent at (a)(6). Six paragraphs, (a)(1) through (a)(6), and that is all of them.
Read the whole list and the omission is conspicuous. There is no permissible purpose called locating a person. Congress regulated the decisions – credit, employment, insurance, licensing, tenancy through the credit route – and not the act of finding somebody. That is the doctrinal reason a locate is a different product from a consumer report, and it is why the boundary matters in both directions.
What it means for us
We are not a consumer reporting agency and nothing we produce is a consumer report. Nothing that leaves this office may be applied to a tenancy decision, an employment decision, an extension of credit, or the underwriting or rating of insurance. That is not a modesty clause; it is the line the closed list draws. Where the real need is a screening decision, the lawful product is a compliant consumer report from a consumer reporting agency, obtained a different way from a different kind of company, and we say so at intake rather than delivering something that will be misused.
What it means for you
The exposure runs the other way too. A locate that arrives in your file with no permissible-purpose architecture around it is safe until somebody applies it to a regulated decision, at which point 1681n is available to the consumer and, under subsection (b), to the agency. The control is procedural and cheap: state the purpose before you order, keep the product in the lane it was ordered for, and do not let a locate drift into a screening file because it happened to contain an address. Our skip tracing compliance checklist is the operational version of that paragraph.
The File That Answers the Question Later
Four artefacts. Each exists because a specific provision above will ask for it.
The Purpose, Recorded Before the Work
One sentence naming the matter and the interest, dated at intake rather than reconstructed. Under DPPA 2721(b) and FCRA 1681b the purpose is a fact about the moment of the request, and a purpose written afterwards reads exactly like one written afterwards.
The Decline, in Writing
Where a request asks for something the lawful route does not reach – account contents, a screening decision, a locate whose object looks like someone who moved to be safe – the refusal is documented. A refusal you can produce is worth more than a job you completed.
The Source Behind Every Line
Each finding attributed to the record and date that produced it, so the file can be examined by somebody who did not run it. That is also what makes a result usable in the proceeding that 2721(b)(4) is anchored to.
The Scope Note, Including the Gaps
What was not established, and why. A report that states its own limits is the one that survives cross-examination; a report that claims completeness invites somebody to test it.
Watch: Where the Exposure Sits
Why the buyer’s risk is not the same risk as the searcher’s.
Watch Overview
Diligence on the Firm You Are About to Hire
Four questions, and what a good answer sounds like.
Which paragraph do you rely on? A supplier working inside the DPPA can name the paragraph it stands in for a given class of work, and will not name 2721(b)(8) unless it actually holds the licence that paragraph describes.
What happens to a request you cannot lawfully fill? The answer you want is that it is declined at intake and the decline is recorded. The answer that should worry you is a quoted price. A vendor that finds a way to do everything is a vendor whose file will not help you when 6821(b) is quoted at your instruction.
What does the deliverable attribute? A named record with a date beats a confidence score. If the report cannot tell you where a line came from, neither can you, and neither can your counsel. There is more on reading a deliverable critically on our page about how to verify a skip tracing report.
What is the position on pretexting, stated as conduct rather than as a value?
State law sits on top of all of this
Everything above is federal. Some states licence private investigators in terms broad enough to reach locating work, some run their own pretexting statutes, and several have consumer-privacy regimes with their own private rights of action. We have not enumerated all fifty and so make no claim quantified over that set; where a matter turns on a particular state’s rules that is a question for counsel admitted there. Our general notes are on state privacy laws and investigations.
The boundary that closes the most files
Separately from any statute, we decline work whose purpose is to find somebody who moved in order to be safe. Domestic violence, sexual assault, stalking, trafficking, protective orders, no-contact orders: any of those in the background closes the file. So does a pattern that says the same thing while the stated reason sounds ordinary – a requester who will not identify the interest they hold, an inexplicable hurry about somebody who has just moved without leaving word, an account of the matter that shifts each time it is questioned. A confidential address programme exists for exactly this situation and an advocate who handles these cases can reach it quickly; anyone in that position gets far more out of that route than out of a locate, and we say so rather than take the file. From a purely defensive standpoint the boundary also removes the one category of case in which a locate becomes the worst possible exhibit.
Who Reads This Page Before Ordering
Usually somebody who owns the risk rather than the task.
Counsel Signing Off on a Vendor
Wanting the paragraph named before the invoice is approved
Compliance and Risk Reviewers
Building a file that answers a question asked two years later
Collections and Recovery Managers
Whose own instruction can be the violation under 6821(b)
Service and Recovery Firms
Standing in 2721(b)(4) and needing to show it
Rental Portfolio Owners
Where a locate must never become a screening decision
Buyers Comparing Two Quotes
Where one bid promises what the other declines
What We Put in Writing on Your File
The purpose you gave, recorded on the day you gave it rather than reconstructed later. A written decline where a request reaches past what the law permits, including the ones that would have been profitable. A source and a date behind every finding, so the work can be examined by somebody with no stake in it. A plain statement of what could not be established and why, because a report claiming completeness invites the first question a cross-examiner asks. We are not a consumer reporting agency and nothing we produce is a consumer report. Every provision quoted on this page was read in the enacted text, and where something was contested or unenumerated – how many states licence this work, whether header data is a consumer report – the page says so instead of guessing. That is the whole of the compliance claim, and it is checkable.
Liability Questions
If I hire a skip tracing firm and it breaks the law, is the risk theirs or mine?
Both, and the reason is that several provisions attach to the commissioner directly. 15 U.S.C. 6821(b) makes it a violation to request that a person obtain customer information from a financial institution knowing they will do it by deception – the request is its own offence and does not depend on the vendor succeeding. 18 U.S.C. 2724(a) attaches to a person who, knowing what they are doing, takes information out of a motor vehicle record, passes it on, or puts it to work, where the purpose is one the chapter does not allow – so a buyer who applies a supplied address to an impermissible end is exposed for that application even if the original pull was clean. And 15 U.S.C. 1681n(b) gives the consumer reporting agency a claim against a person who obtained a consumer report under false pretenses or knowingly without a permissible purpose. Contractual indemnity between you and a vendor is a matter for your counsel and is not addressed here.
What is a permissible purpose, and do I have one?
It depends which statute you mean, which is the first thing to get straight. Under the FCRA, 15 U.S.C. 1681b(a) lists the circumstances in which a consumer reporting agency may furnish a consumer report and says “and no other” – court order or qualifying subpoena, the consumer’s written instructions, seven sub-purposes at (a)(3) covering credit, employment, insurance underwriting, government licences and benefits, investor or servicer risk assessment, a legitimate business need from a consumer-initiated transaction or account review, and government travel cards; a certified child support enforcement request; furnishing to a State agency under 42 U.S.C. 654 to set a child support award; and furnishing to the FDIC or the NCUA acting as conservator, receiver or liquidating agent – six paragraphs in all. Under the DPPA, 18 U.S.C. 2721(b) lists fourteen permissible uses of motor-vehicle personal information. They are different lists in different Acts governing different data, and a purpose under one is not a purpose under the other.
What are the actual penalties under the DPPA?
18 U.S.C. 2724(b) sets out four heads of relief and the first of them is the one that matters commercially. (b)(1) allows actual damages, subject to a liquidated floor of $2,500 – so a plaintiff who cannot prove a loss still recovers. (b)(2) adds punitive damages where wilful or reckless disregard of the law is shown. (b)(3) adds reasonable attorneys’ fees and the litigation costs reasonably incurred. (b)(4) leaves the court whatever preliminary and equitable relief it thinks appropriate. A fixed per-individual floor with fee-shifting on top is what turns this section from a nuisance into a class-shaped exposure. It was added by Public Law 103-322 in September 1994.
Can I use a skip trace to screen a tenant or an employee?
No, and this is the boundary that gets tested. A locate is not a consumer report and we are not a consumer reporting agency. Screening decisions – a tenancy, a hire, credit, insurance underwriting or rating – are the decisions the Fair Credit Reporting Act regulates, and they require a compliant consumer report obtained from a consumer reporting agency. Notice how that follows from the statute rather than from our preference: 1681b(a)’s list is closed and contains no purpose called locating a person, because Congress regulated the decisions rather than the act of finding somebody. If a screening report is what you need, you need a different kind of company, and we will say so before taking the file.
Doesn’t the certification I signed with my data provider protect me?
It does the opposite of what most buyers assume. 15 U.S.C. 1681n(b) provides that any person who obtains a consumer report from a consumer reporting agency under false pretenses or knowingly without a permissible purpose shall be liable to the consumer reporting agency for actual damages sustained by the agency or $1,000, whichever is greater. The certification is how the agency establishes what you represented and what you knew, and the statute hands it a cause of action of its own. It is a real document with real effect – it just does not run in the direction it is usually described as running.
Do I need a licence to commission or run this work?
That is a state question and it is not uniform. Some states licence private investigators in terms broad enough to reach locating work and some do not; we have not enumerated all fifty jurisdictions and so make no claim about how many do. What is federal and countable is narrower: 18 U.S.C. 2721(b)(8) permits use of motor-vehicle personal information by a licensed private investigative agency or licensed security service for any purpose already permitted under the subsection, and 15 U.S.C. 6821(g) carves out a state-licensed private investigator collecting adjudicated child support under a court order. Both are licence categories. We work public records and lawfully licensed data instead.
What documentation should I keep on my side?
Four things, each of which exists because a specific provision will eventually ask for it. The purpose, written before the request rather than after, naming the matter and the interest. The instruction you actually gave, since 6821(b) makes the instruction itself capable of being the violation. What you did with the result, because 2724(a) reaches the use and not only the acquisition. And the supplier’s deliverable with its sources intact, so the chain from record to conclusion is legible to somebody else. If you resell or redisclose motor-vehicle-derived information, note that 18 U.S.C. 2721(c) requires an authorised recipient to keep records for five years identifying each recipient and the permitted purpose, available to the motor vehicle department on request.
Is this legal advice about my situation?
No. It is a reading of federal provisions with the section numbers given so they can be checked against the enacted text, and it is general information rather than advice about any particular matter. We are not lawyers, and this creates no professional relationship. Where something is contested or was not verified at primary source it has been left out rather than hedged – this page takes no position on whether credit-header data is a consumer report, offers no count of state licensing regimes, and makes no assertion about what an indemnity clause does to statutory liability, because that is a conclusion about a contract rather than a fact. For your own matter, read the sections and ask counsel.
Commission Work That Answers for Itself
Send the name, the identifiers you hold, the last address on paper, and the purpose the request sits under – that last one first, because it is the fact everything downstream depends on. If the request reaches past what the law permits, you will get a written decline and the reason, at intake, before anything is billed. If it does not, you will get an address with the record and date behind it and a plain note of what could not be established. The method is described on the skip tracing services hub and on how skip tracing works, and the underlying legality question is covered on is skip tracing legal. For a workable request, a first read usually comes back within 24 hours. Contact us to begin.
Start Your Request →
