The Ninth Circuit’s Reversal of a $140 Million FCRA Verdict

Gives Companies a License to Willfully Violate the FCRA

All things considered, abandoned online shopping carts raise little concern; many of us leave the online checkout process before completing a purchase without thinking twice. But what if abandoning our online cart allowed a business to pull our credit score, prior addresses, employment history, and Social Security Number without us making a purchase? 

That’s what happened to Lydia Bultemeyer and the other members of a 56,075-person class in a lawsuit against telecom service provider CenturyLink. The class’s claim arose under the Fair Credit Reporting Act (“FCRA”), which protects consumers’ privacy by requiring companies to have a “legitimate business need” in connection with a transaction “initiated by the consumer” if they want to retrieve a consumer’s credit report from a consumer reporting agency. 15 U.S.C. § 1681b(a)(3)(F). 

In Bultemeyer v. CenturyLink, No. 24-6413 (9th Cir. Sept. 22, 2026), the key legal question was when Bultemeyer “initiated” a business transaction during the online checkout process. Reversing a jury award of $140 million in statutory and punitive damages ($28 million and $112 million, respectively), a Ninth Circuit panel held that CenturyLink’s Safeco defense shielded it from liability for a willful FCRA violation, but declined to decide whether it violated the statute. 

Deciding an FCRA case on a defense without interpreting the statute is within the court’s discretion, but that choice has consequences. Until a federal appeals court says when an online shopper “initiates” a transaction under the FCRA, businesses that pull consumers’ credit reports mid-checkout face little risk of the statutory and punitive damages that make these privacy claims worth bringing. The Safeco defense, meant as a shield, is now a license to flaunt the FCRA.

FCRA remedies and the Safeco defense

The remedy for an FCRA violation depends on whether the business acted negligently or willfully in making an unlawful credit report pull. A negligent violator is liable only for actual damages, plus costs and attorney’s fees. 15 U.S.C. § 1681o. A willful violator is liable for actual damages or statutory damages of $100 to $1,000 per consumer, plus punitive damages. Id. § 1681n(a). In practice, the actual damages for an improper credit check, such as unnecessary access to information or a temporary dip in credit score, are often small and difficult to quantify. Because of that, permissible-purpose claims like the one in Bultemeyer are typically brought as class actions, where willfulness is often the entire case. 

In Safeco Insurance Co. of America v. Burr, 551 U.S. 47 (2007), the U.S. Supreme Court addressed what it means for a person or organization to “willfully fail[] to comply” with the FCRA. The Court clarified that “willfulness” includes both knowing and reckless violations. However, it also created a safe harbor for defendants by holding that an erroneous reading of a statute that’s “not objectively unreasonable” is not reckless.

In Safeco, the Supreme Court held that whether a defendant’s reading of the FCRA is objectively reasonable is determined by three factors: (1) it must have “a foundation in the statutory text,” (2) no court of appeals has spoken on the issue, and (3) the defendant had no “authoritative guidance” from an agency that “might have warned it away” from its reading. Failing to satisfy any of the three defeats the defense. 

A credit check during online checkout led to an FCRA class action

At the time of Bultemeyer’s online visit, CenturyLink’s online checkout was a five-step process. In the first three steps, the customer chose a service option and its pricing, customized the order (deciding, for example, whether to lease a modem), and reviewed an online shopping cart of those selections. In the fourth, the customer entered personal information such as name, birth date, and billing address, chose an installation date, and accepted the terms and conditions. The terms and conditions stated that a “credit check is required to complete all online orders.” The fifth and final step displayed CenturyLink’s estimated pricing (including any deposit the credit check had triggered), requested payment information, and was completed when the customer clicked “Submit Order.” 

Bultemeyer completed the first four steps but did not click “Submit Order” at step five and abandoned the inquiry. She later learned, through a credit monitoring service, that CenturyLink accessed her credit information even though she never placed an order. 

The online system triggered an automated pull within seconds after Bultemeyer clicked “next” at step four, gating the displayed price behind that credit check. CenturyLink claimed the check served two purposes: to prevent identity fraud and to determine whether the order would require a deposit.

Bultemeyer filed her class action in November 2014. CenturyLink first raised its Safeco defense in a pretrial brief, then moved for a directed verdict and judgment as a matter of law. Both motions were denied. After a four-day trial, the jury awarded each class member $500 in statutory damages and $2,000 in punitive damages, totaling more than $140 million.

The Ninth Circuit reverses but does not decide if CenturyLink’s credit check was lawful

On appeal, the Ninth Circuit reversed the judgment entered on the jury’s verdict, wiping out the $140 million award. However, the ruling itself is narrower and less clarifying than that result makes it appear.

While the parties disputed whether a business transaction was “initiated” during checkout or only after an order was placed, the court declined to clarify which FCRA interpretation was correct. Instead, it exercised its discretion to address only the Safeco defense, even though its own precedent “encourag[es]” courts to decide first whether a violation occurred. Marino v. Ocwen Loan Servicing LLC, 978 F.3d 669 (9th Cir. 2020). The Safeco defense does not require CenturyLink’s interpretation of the FCRA to be correct, only “objectively reasonable.”

The Ninth Circuit first assessed CenturyLink’s interpretation of “initiated,” which must have “a foundation in the statutory text.” The FCRA does not expressly define the term. Bultemeyer argued that initiating a transaction required knowing the final price and submitting the order. CenturyLink cited dictionary definitions such as “commence; start; originate” to argue that it was reasonable to assume a transaction had been initiated by step four of the five-step checkout. The court held that it “need not decide between these two readings” because “initiated” is undefined and “bears a range of possible reasonable meanings.” Thus, in the court’s view, CenturyLink’s reading had a foundation in the text.

Second, the court looked at whether any appellate decisions had already addressed the issue. The panel noted, quoting Marino, that when the FCRA’s language is unclear, “a defendant will nearly always avoid liability so long as an appellate court has not already interpreted that language.” Appellate courts, including the Ninth Circuit, have interpreted the term “business transaction” in multiple decisions, but none specifically addressed “when a business transaction has been initiated.”

Third, the court examined whether any agency had published “authoritative guidance” that would have notified CenturyLink that it had misread the statute. In 2011, as FCRA authority was shifting to the newly created Consumer Financial Protection Bureau, Federal Trade Commission staff published 40 Years of Experience with the Fair Credit Reporting Act, a report summarizing the agency’s interpretations of the statute. That report discussed a 1998 FTC staff opinion letter to the Texas Auto Dealers Association (the “Coffey Letter”), summarizing it to mean that “a request for general information about products and prices offered does not involve a business transaction initiated by the consumer.” 

The Ninth Circuit noted that whether this report was “authoritative guidance” for the Safeco defense was not settled. The court said the Coffee Letter could not qualify as “authoritative guidance” because it noted it was “not binding on the Commission.” Additionally, the court said that because the advice in the Coffee Letter concerned brick-and-mortar auto dealerships rather than online purchases for telecommunication services, even if the 40 Years Report was “authoritative,” its summary of the Coffee Letter was “not sufficiently specific to CenturyLink’s online process to have warned the company that its statutory interpretation was incorrect.”

While the court held that CenturyLink was thus entitled to judgment on its Safeco defense, the decision did not hold that pulling a credit report during online checkout was lawful. The dueling concurrences reinforce that limited holding.

Judge Bybee wrote that to “express [his] regret” that the court did not resolve when a “‘business transaction’ has been ‘initiated by the consumer’ in the context of online transactions.” He noted that “[f]or CenturyLink, nothing has changed except that its Safeco defense has now become a Safeco license to continue presumptively to violate FCRA.”

Judge Clifton responded that he would have held CenturyLink’s interpretation “not only reasonable but also correct,” while explaining that the panel’s own disagreement gave sound reason to limit the holding to just the Safeco defense. Judge Miller, the panel’s third member, joined neither concurrence.

The Ninth Circuit has ushered in the Safeco license era

When a defendant violates the FCRA because of a reasonable misinterpretation of the language, it makes sense to distinguish that conduct from willful violations. When a court decides the violation question first, as the Supreme Court did in Safeco itself, consumers and businesses learn what the statute protects and what conduct crosses the line. 

The Safeco defense, though, only asks about the defendant’s interpretation of when the consumer initiates a transaction. So when a court skips the violation question, the defendant business—not the court or consumer—effectively decides when privacy protection begins, at least for the statutory and punitive damages that drive private enforcement. In doing so, as Judge Bybee noted, a court transforms the Safeco defense into a license for CenturyLink and other businesses with similar online checkout processes to continue presumptively violating the FCRA.

Worse still, after Bultemeyer, neither the litigants nor the public is any closer to knowing when a consumer initiates a transaction under the FCRA. As the panel acknowledged, quoting Marino, if the statutory language is ambiguous, defendants will “nearly always avoid liability.” In other words, the willfulness remedies that make private enforcement viable are effectively unavailable until a court decides what the statute means. And if Bultemeyer’s approach becomes standard rather than an exception, courts will, as Judge Bybee warned, “postpone in perpetuity the antecedent statutory question, thus preventing consumers from receiving the protection to which [the] FCRA entitles them.” 

Judge Clifton’s concurrence suggests Bultemeyer will be an exception and not the standard treatment. The panel’s own disagreement over the statute’s language makes a definition difficult, if not imprudent. And, as he argued, checking credit before quoting a final price can also protect consumers. Otherwise, a customer with poor credit might be hit with a deposit after believing the deal was done, which he likened to a “bait and switch.” But as Judge Bybee noted, if CenturyLink or another company wants to see its potential customers’ credit reports earlier, it could ask for consent before pulling them.

Objective reasonableness, appellate opinions, and agency decisions still provide an outer limit on the Safeco defense. A business that pulls a credit report when a visitor merely clicks an ad would struggle to show that an objectively reasonable interpretation of the FCRA permits it to do so. And, because Safeco bars only willfulness liability under the FCRA, negligent violations remain actionable under § 1681o. 

But until a federal appeals court or Congress says when an online shopper “initiates” a transaction, you can expect companies across the U.S. to use the Ninth Circuit’s newly minted Safeco license in Bultemeyer v. CenturyLink to attempt to escape liability for willfully violating the FCRA when accessing consumers’ credit reports during the online checkout process like CenturyLink did—and openly flout the privacy protections Congress intended to provide consumers when purchasing goods or services.

Reprinted with permission from the November 9, 2026, edition of The Legal Intelligencer © 2026 ALM Media Properties, LLC. All rights reserved.