The Ninth Circuit Court of Appeals recently reversed a significant jury verdict against CenturyLink, Inc., in a case concerning the Fair Credit Reporting Act (FCRA). The decision, filed on September 22, 2026, affects consumers who may have had their credit reports accessed by the telecommunications company without their explicit consent. The ruling emphasizes the interpretation of what constitutes an initiated business transaction under the FCRA.
The case, Bultemeyer v. CenturyLink, Inc. (Docket No. 24-6413), arose after Lydia Bultemeyer filed a class action lawsuit against CenturyLink. Bultemeyer claimed that the company violated the FCRA by pulling her credit report after she had not completed the final step in an online order process for services. This ruling has broad implications for how companies interpret consumer consent in online transactions.
In the original case, Bultemeyer went through four steps of an online ordering process with CenturyLink but chose not to complete the final step, which would have confirmed her order. Despite this, CenturyLink accessed her credit report, claiming it had a legitimate business need for the information to provide accurate pricing and prevent identity theft. Bultemeyer argued that because she did not finalize her order, she had not initiated a business transaction, and thus, CenturyLink had no right to access her credit report.
The dispute reached the Ninth Circuit after a jury trial in which Bultemeyer was awarded $28 million in statutory damages and $112 million in punitive damages. CenturyLink appealed the decision, arguing that it was entitled to a defense under the Safeco Insurance Co. of America v. Burr standard, which allows companies to avoid liability for FCRA violations if their interpretation of the law is not objectively unreasonable.
The court ruled in favor of CenturyLink, stating that the company was entitled to judgment as a matter of law based on its understanding of the FCRA. The judges noted that CenturyLink's interpretation of the term "initiated" had a foundation in the statutory text and that no appellate court had previously addressed this specific issue. The opinion stated, "CenturyLink did not willfully violate FCRA," emphasizing that the company acted within a reasonable interpretation of the law.
The court's ruling underscored the importance of the Safeco defense, which protects companies from liability if they can demonstrate that their understanding of the law was reasonable, even if it was incorrect. The opinion highlighted that CenturyLink's reading of the FCRA was not reckless or willful, as it had no authoritative guidance that contradicted its interpretation.
This decision has significant implications for consumers and businesses alike. It clarifies the circumstances under which companies can access consumer credit reports in online transactions. For consumers, it means that companies may have more leeway in interpreting what constitutes an initiated transaction, potentially impacting privacy and consent in future online interactions.
Furthermore, the ruling could set a precedent for similar cases involving the interpretation of the FCRA and the handling of consumer credit information. As online transactions continue to grow, the legal standards surrounding consumer consent and privacy will likely evolve, influenced by decisions like this one.
Looking ahead, it remains to be seen whether Bultemeyer will seek to appeal this ruling or if there are other related cases pending that could further address the nuances of the FCRA. For now, the Ninth Circuit's decision serves as a reminder of the complexities involved in consumer protection laws and the ongoing challenges faced by consumers in the digital age.