A federal jury in Arizona heard four days of evidence on a claim that CenturyLink willfully broke the Fair Credit Reporting Act, and it found for Lydia Bultemeyer and a class of 56,075 people. It awarded each of them $500 in statutory damages and $2,000 in punitive damages. Multiply it out and you get $140,187,500.
On September 22, 2026, the Ninth Circuit wiped out every dollar of it. Bultemeyer v. CenturyLink, Inc., No. 24-6413 (9th Cir. Sept. 22, 2026) (per curiam).
Here’s the part that should bother you. The court never decided whether CenturyLink broke the law. It said it didn’t have to:
We need not resolve this dispute here because CenturyLink is protected by the safe harbor recognized in Safeco.
So a jury found the company did it, and the appeals court said that doesn’t matter, because the company’s lawyers could have read the statute the way the company did. That’s the FCRA’s willfulness rule doing exactly what it was built to do.
What did CenturyLink actually do?
The facts come straight from the opinion. CenturyLink sold internet service through a five-step online checkout. Step one, pick a plan. Step two, customize it. Step three, review a shopping cart. Step four, type in your name, birth date, and billing address, pick an installation date, and check a box accepting terms and conditions that said a “credit check is required to complete all online orders.” Step five, see the estimated price, enter a card, and click “Submit Order”.
Lydia Bultemeyer got through step four. At step five she walked away. Later a credit-monitoring service told her somebody had taken a hard pull of her credit. The name on it was “Qwest Land-Line,” which turned out to be a CenturyLink affiliate.
That wasn’t a one-off. CenturyLink ran an automated process on everyone who clicked “next” at step four. About half the time it went to outside sources for the data, and it got the information within seconds. The company gave two reasons. It ran an identity-fraud screen that scored each shopper from R1 to R9. And it used the credit information to decide whether to charge a deposit, which would show up in the price at step five. In the court’s words, “the price CenturyLink quotes to some customers at step five depends on the results of the credit check pulled after step four.”
Bultemeyer filed in November 2014. The case went to the Ninth Circuit twice before trial — once after the district court threw it out for lack of standing (the Ninth Circuit reversed), once on class certification. The class that finally got certified was narrowed partly because people who later became customers had signed arbitration clauses or class waivers. If you’ve wondered why that fine print matters, this is what it does. Then came the trial, the verdict, and the appeal.
What does “initiated” mean when you’re shopping online?
The FCRA only lets a business pull your report for a reason the statute lists. The one CenturyLink leaned on is in 15 U.S.C. § 1681b(a)(3)(F). A credit bureau can furnish a report to someone who:
otherwise has a legitimate business need for the information— (i) in connection with a business transaction that is initiated by the consumer
Everything turns on that word. Bultemeyer said she hadn’t initiated anything until she clicked Submit, and until then “any business transaction is merely hypothetical.” CenturyLink said she’d started the deal by step four. She’d picked her services, reviewed a cart, handed over her information, chosen an install date, and agreed to the terms. All she hadn’t done was enter a card and click.
The panel pulled out two dictionaries, found “initiate” defined as “commence; start; originate” and “begin, introduce, set going, originate”, and concluded the word could fairly be read CenturyLink’s way:
Because the term “initiated” lacks definition in the statute and bears a range of possible reasonable meanings, we conclude that CenturyLink’s reading has foundation in the statute.
That’s the first Safeco box checked. The second was easy. Bultemeyer pointed to circuit cases on what counts as a “business transaction”, but the panel said that wasn’t the question: “Bultemeyer has not directed us to, and we have not found, any appellate decision that has addressed the question of when a business transaction has been initiated.”
The third box was the fight. Back in 1998, Federal Trade Commission staff wrote a letter about car dealers pulling credit on people who walk into a showroom. It said “a request for general information about products and prices offered does not involve a business transaction initiated by the consumer.” The FTC later folded that letter into a 2011 staff report, 40 Years of Experience with the Fair Credit Reporting Act. Bultemeyer argued that was warning enough.
The panel didn’t decide whether the report counts as “authoritative guidance” at all. It held that even if it does, it was talking about car lots:
This cannot put CenturyLink, a telecommunications company soliciting online customers, on notice that its practices are contrary to agency guidance.
Courts don’t agree on that question, and one of the cases the panel cited is from here. In Beseke v. Equifax Information Services LLC, No. 17-4971 (DWF/KMM) (D. Minn. Nov. 22, 2019), the federal court in Minnesota relied on the same FTC report, along with a Seventh Circuit decision and FTC staff letters, and found Equifax “had the benefit of guidance that might have warned it away from the view it took.” It then left it to a jury whether that guidance made Equifax’s reading objectively unreasonable. Same report, different courtroom, different weight.
Three boxes, three checks. “We do not overturn a jury verdict lightly”, the panel wrote. Then it did.
Two judges agreed on the result and split on the law
This is where the opinion gets interesting. The per curiam opinion came from Judges Clifton, Bybee, and Miller. Two of them wrote separately, and they answered the statutory question in opposite directions.
Judge Clifton thinks CenturyLink was right, not just reasonable. Once a shopper visits the site voluntarily and finishes all but the last step, he says, she’s initiated the transaction. “She went well beyond window shopping.” His bigger point is about deposits. If a company has to quote a “final” price before it can check credit, and the check then adds a deposit, the customer gets ambushed at the register. He compared it to hotel “destination fees” and wrote: “Looked like ‘bait and switch’ to me.” His bottom line: “If required to answer the question, I would hold that CenturyLink’s interpretation was not only reasonable but also correct under the FCRA.”
Judge Bybee thinks CenturyLink was wrong, and that the court ducked. His test borrows from contract law. You haven’t initiated a transaction “until the consumer knows the material terms for the purchase”, and CenturyLink’s shoppers didn’t know the full price, deposit included, until step five. He’d hold that until Bultemeyer knew the full cost and hit Submit, she hadn’t initiated anything. He had a Walmart line I liked: “Yet we would be dismayed if Walmart pulled our credit once we picked up a cart and passed the greeters just because Walmart thought that we were commencing a business transaction and it needed our credit information.” And he offered CenturyLink a simple fix: “Ask for consent before pulling the report.”
Bybee’s real complaint is what the court’s silence does. The panel assumed a violation and then excused it, which leaves CenturyLink free to keep doing the same thing:
For CenturyLink, nothing has changed except that its Safeco defense has now become a Safeco license to continue presumptively to violate FCRA.
He also called the pull policy “a feature, not a bug”, and wrote: “Fifty-six years later, we still don’t know when a business transaction has been ‘initiated by the consumer.’”
He’s right about that last part. The next company to pull credit at step four of an online checkout gets the same three boxes checked, because no appellate court has answered the question. Bybee said the decision “virtually guarantees that there will be further litigation.”
Why a jury’s finding didn’t matter
Safeco Insurance Co. of America v. Burr, 551 U.S. 47 (2007), held that “willfully” in § 1681n reaches reckless violations, not just knowing ones. Then it built the escape hatch. A company whose reading of the statute, “albeit erroneous, was not objectively unreasonable” isn’t reckless. 551 U.S. at 69. I’ve walked through that standard before, so I won’t repeat it.
What Bultemeyer shows is how little the facts matter once the reading passes. The Eighth Circuit, which covers Minnesota, said so plainly in Hammer v. Sam’s East, Inc., 754 F.3d 492 (8th Cir. 2014). That was a receipt case under the same willfulness provision. The court accepted, for purposes of the appeal, that Sam’s Club had violated the statute by printing too many card digits, and still affirmed dismissal, because its reading was objectively reasonable. And it closed the door on evidence of motive:
When a party has read the statute in an objectively reasonable manner, we need not consider facts relating to the party’s subjective intent in assessing willfulness.
754 F.3d at 502. Read Hammer and Bultemeyer together and the lesson is blunt. A jury can find a company did it. The plaintiff can offer evidence of bad faith. None of it gets weighed if a court decides the company’s lawyers had a plausible reading and no appellate court or agency had told them otherwise.
Then sue for negligence? Maybe not.
The usual fallback is 15 U.S.C. § 1681o. It covers negligent violations and pays “any actual damages sustained by the consumer as a result of the failure”, plus fees. No willfulness, no Safeco. Right?
Maybe not in the Ninth Circuit. In Marino v. Ocwen Loan Servicing LLC, No. 19-15530 (9th Cir. Oct. 20, 2020), a case where the plaintiffs sought only statutory and punitive damages, the court still said this:
To prove a negligent violation, a plaintiff must show that the defendant acted pursuant to an objectively unreasonable interpretation of the statute.
Slip op. at 8. Under either standard, the court said, when the statute’s language is unclear, a defendant “will nearly always avoid liability so long as an appellate court has not already interpreted that language.” Slip op. at 9. Marino didn’t have a negligence claim to decide, so that’s the Ninth Circuit talking rather than ruling. But if it holds, a negligence claim in a pure interpretation fight like Bultemeyer dies right alongside the willfulness claim.
What about here? I couldn’t find an Eighth Circuit or District of Minnesota decision that adopts Marino’s negligence rule or rejects it. I searched CourtListener’s opinion collection in several phrasings. That’s a gap in the case law I can see, not a green light.
Where negligence still does real work is the case that isn’t about reading the statute. A pull with no arguable purpose at all. The wrong person’s file. A procedure the company had on paper and didn’t follow. Nobody’s parsing an ambiguous word there. Somebody got it wrong, and § 1681o is built for that.
But § 1681o pays only actual damages, and the Eighth Circuit means it. In Taylor v. Tenant Tracker, Inc., 710 F.3d 824 (8th Cir. 2013), the court held “a consumer must present competent evidence of actual injury to state a claim under the FCRA.” Id. at 828. Taylor testified she was “extremely upset and embarrassed”, and a witness saw her crying. Not enough. “Taylor offered no reasonable detail about the nature and extent of her alleged emotional distress”, and “corroboration of a brief episode of frustration and unhappiness does not establish the sort of concrete emotional distress that is required to constitute a genuine injury and actual damages.” Id. at 829.
A hard inquiry you didn’t authorize is real. Proving what it cost you is a different job.
Your report got pulled without permission. Now what?
Find out who did it. Under 15 U.S.C. § 1681g(a)(3)(A)(ii), a credit bureau’s file disclosure has to identify each person that procured your report for a non-employment purpose in the prior year. Under § 1681g(a)(3)(B), that means the name or full trade name, and on request, an address and phone number. Ask for them. Bultemeyer saw “Qwest Land-Line” and had to figure out who that was.
Save the inquiry record. Download or print the disclosure that shows the pull and its date, and keep it. Don’t expect a bureau dispute to fix this. The inquiry is accurate. Somebody really did pull your report, and the question is whether they had the right to. Disputes are for information that’s wrong, and that’s a different fight.
Know who the claim is against. It runs against whoever pulled the report. Section 1681b(f) says “A person shall not use or obtain a consumer report for any purpose unless” the purpose is one the statute allows and the user certified it under § 1681e. Nothing in that subsection makes a dispute a condition of the claim. The bureau has its own, separate duty under § 1681e(a): its procedures must require users to “identify themselves, certify the purposes for which the information is sought, and certify that the information will be used for no other purpose.” Bultemeyer sued the company that pulled. The caption reads Bultemeyer v. CenturyLink, and no bureau is in it.
Document the harm while it’s happening. Denied applications, higher rates, deposits, time off work, a doctor’s note if it came to that. Taylor is the standard you’ll be measured against. I’ve laid out how that proof gets built, and it gets built early or not at all.
Know which claim you have. § 1681n pays statutory damages “of not less than $100 and not more than $1,000” plus punitive damages, but only for willful violations, and Safeco guards that door. § 1681o pays what you can prove you lost. A pull that rests on an arguable reading of the statute is a § 1681n problem with a Safeco defense waiting. A pull that rests on nothing is a different case. Standing is its own hurdle; here’s what TransUnion did to it.
Watch the clock. § 1681p gives you two years from discovery or five from the violation, whichever comes first.
And if you run a business that takes orders online, Judge Bybee already handed you the answer. 15 U.S.C. § 1681b(a)(2) lets a bureau furnish a report “In accordance with the written instructions of the consumer to whom it relates.” Get the consent. It costs a checkbox.
CenturyLink spent twelve years in court, and as of the Ninth Circuit’s ruling it owes nothing. The statute still doesn’t say when an online shopper has “initiated” anything. Until a court answers that, every company with a checkout page gets the benefit of the doubt.
Madgett Law, LLC represents Minnesota consumers in Fair Credit Reporting Act cases, including impermissible-pull claims, inaccurate reporting, and disputes the bureaus won’t fix, through our Credit File Corrections practice. If someone pulled your credit without a reason, send us a message or call 612-470-6529.
Sources: Bultemeyer v. CenturyLink, Inc., No. 24-6413 (9th Cir. Sept. 22, 2026) (per curiam), slip op. at 5 ($28 million statutory and $112 million punitive; “We hold that CenturyLink was entitled to a Safeco defense”), 8–9 (five-step process; “credit check is required to complete all online orders”; “Qwest Land-Line”; automated pulls after step four; outside sources roughly half the time, within seconds; R1–R9 identity score), 10 (“the price CenturyLink quotes to some customers at step five depends on the results of the credit check pulled after step four”; complaint filed November 2014; 2017 standing dismissal reversed in 2019; class-certification history and arbitration/class-waiver exclusion), 11 (class of 56,075; four-day trial; $500 statutory and $2,000 punitive per member; “more than $140 million”), 12 (“We need not resolve this dispute here”), 13–14 (dictionary definitions; Bultemeyer’s “merely hypothetical” reading; “bears a range of possible reasonable meanings”), 15 (no appellate decision on when a transaction is initiated), 17–21 (1998 FTC staff letter; 40 Years Report; Beseke; “This cannot put CenturyLink . . . on notice”; “We do not overturn a jury verdict lightly”); id. at 22–28 (Clifton, J., concurring) (“She went well beyond window shopping”, at 23; “bait and switch”, at 26; “not only reasonable but also correct”, at 28); id. at 28–41 (Bybee, J., concurring) (“Safeco license”, at 29; “a feature, not a bug” and “Fifty-six years later,” at 37; “virtually guarantees that there will be further litigation”, at 38; Walmart, at 39; “until the consumer knows the material terms for the purchase” and “Ask for consent before pulling the report”, at 40), Ninth Circuit opinion PDF. Safeco Ins. Co. of America v. Burr, 551 U.S. 47, 57, 69 (2007) (willfulness reaches reckless violations; “albeit erroneous, was not objectively unreasonable”), Caselaw Access Project. Hammer v. Sam’s East, Inc., 754 F.3d 492, 501–02 (8th Cir. 2014) (accepting the violation, affirming on Safeco; subjective intent not considered where the reading is objectively reasonable), Caselaw Access Project. Marino v. Ocwen Loan Servicing LLC, No. 19-15530 (9th Cir. Oct. 20, 2020), slip op. at 8–9 (negligence requires an objectively unreasonable interpretation; “will nearly always avoid liability”), Ninth Circuit opinion PDF. Taylor v. Tenant Tracker, Inc., 710 F.3d 824, 828–29 (8th Cir. 2013) (competent evidence of actual injury; emotional-distress proof), Caselaw Access Project. Beseke v. Equifax Info. Servs. LLC, No. 17-4971 (DWF/KMM) (D. Minn. Nov. 22, 2019), Mem. Op. & Order at 22–23 (FTC guidance “might have warned it away”; willfulness left for the jury), govinfo. 15 U.S.C. § 1681b(a)(2), (a)(3)(F)(i), (f); § 1681e(a); § 1681g(a)(3)(A)(ii), (a)(3)(B); § 1681n(a)(1)(A); § 1681o(a)(1); § 1681p, Cornell Legal Information Institute.
This article is general legal information about federal law and Minnesota practice, not legal advice, and reading it does not create an attorney–client relationship. It describes decisions in cases involving other parties; nothing here predicts how any court would rule on your facts, and no outcome is promised or implied.