TransUnion LLC v. Ramirez
The Supreme Court ruled that only the roughly 1,800 class members whose false terrorist-flagged credit reports were actually sent to third-party businesses can sue TransUnion in federal court — the other 6,300 members, whose inaccurate files sat inside TransUnion's internal database and were never shared, lacked a sufficiently real injury to proceed.
The decision tightens the rules for when people can bring federal lawsuits over companies' violations of consumer-protection laws, holding that a technical statutory violation — without a concrete, recognizable harm of the kind courts have historically remedied — is not enough to open the courthouse doors.
How it got here: A federal district court certified the class and ruled all 8,185 members had standing; a jury awarded over $60 million; the Ninth Circuit affirmed with reduced punitive damages (~$40 million); TransUnion asked the Supreme Court to step in and the Court agreed to hear it.
The Case in Depth
What happened
TransUnion, one of the three major credit reporting agencies, sold an add-on service that flagged consumers as possible terrorists or drug traffickers if their first and last names matched a federal government watchlist — without checking any other identifying information. Thousands of ordinary Americans were wrongly flagged. A class of 8,185 people sued under the Fair Credit Reporting Act. The parties agreed that only 1,853 of them had their misleading reports actually sent to businesses during the relevant period; the other 6,332 members' files stayed inside TransUnion's internal system.
The question before the Court
Can people wrongly flagged as potential terrorists on their credit reports sue a credit bureau in federal court under a consumer-protection law, even if their inaccurate reports were never actually shared with anyone outside the company?
The Court's answer
Partly — the Court split the class into two groups. For the 1,853 members whose misleading, terrorist-flagged credit reports were actually sent to third-party businesses, the Court found they suffered a real harm closely resembling defamation — having a damaging falsehood published to others — and so they can sue in federal court. For the 6,332 members whose inaccurate files were never shared outside TransUnion, the Court found no concrete harm. Just as a defamatory letter sealed in a desk drawer injures no one, an inaccurate internal database entry that no outside party ever saw does not supply the kind of real injury Article III demands.
On two separate claims about the formatting of TransUnion's mailings, the Court ruled that none of the 8,185 class members — except the lead plaintiff Ramirez — have standing either, because no one produced evidence that they were confused, misled, or in any way actually harmed by the formatting defect. Receiving information in the wrong format, with no real-world consequences, is a bare technical violation that does not qualify as a concrete injury.
Curious how the Court got there? See the step-by-step legal reasoning →
Why it matters
Consumers whose data is mishandled by credit bureaus or other companies must show that the mistake caused a real, recognizable harm — not just a technical rule violation — before they can sue in federal court. Large class-action lawsuits may be much harder to maintain when only a portion of the class experienced direct harm, potentially leaving millions of people with legal rights they cannot practically enforce.
What changes now
The Ninth Circuit's roughly $40 million class damages award is undone. On remand, the appeals court must reconsider what form of lawsuit can go forward. Only the 1,853 class members whose credit reports were disseminated to third parties retain standing on the core accuracy claim; Ramirez alone retains standing on the formatting claims. The Ninth Circuit may also reconsider whether a narrower class can be properly certified under those constraints. The Court separately noted the question of whether TransUnion even violated the law for members whose files were never shared remains open.
What this does not decide
The Court does not decide whether TransUnion actually violated the Fair Credit Reporting Act with respect to the 6,332 class members whose files were never shared — it assumed a violation for purposes of the case. It also leaves open whether the remaining 1,853-member group can be properly recertified as a class on remand.
Concurrences and dissents
Dissent — Justice Thomas
Justice Thomas argued the majority's 'concrete harm' rule is a modern invention unsupported by history. At the founding, courts recognized that any violation of a private legal right — not just a public duty owed to the whole community — was itself an actionable injury, no additional showing required. Congress created individual rights under the FCRA and gave each consumer a cause of action; the jury found those rights were violated. That, Thomas argued, is all the Constitution requires. He would have affirmed the judgment for the full class.
Dissent — Justice Kagan
Justice Kagan joined Thomas's dissent but wrote separately to note one disagreement: she maintains, consistent with Spokeo, that Article III requires a concrete injury even when Congress creates a statutory right. But she argues courts should heavily defer to Congress's judgment about what causes real-world harm. Because Congress determined that inaccurate terrorist-flagging in credit files causes genuine injury, and common sense confirms it, she would have found standing for the entire class.
How the Court got there
The legal reasoning, step by step
- The Constitution's Article III limits federal courts to resolving real 'Cases' and 'Controversies,' which means every plaintiff must show a concrete, real-world injury — not just a technical legal violation. The Court reaffirmed that Congress can give people the right to sue over statutory violations, but that power does not let Congress convert a non-injury into an injury simply by authorizing a lawsuit. A violation of law is not automatically an injury in fact.
- To decide whether an injury is concrete enough for Article III, the Court applies a 'close relationship' test from its 2016 Spokeo decision: does the alleged harm resemble a type of harm that American courts have traditionally allowed people to sue over — such as physical harm, monetary loss, or reputational damage? The closer the match to a well-established legal wrong, the more likely the harm qualifies.
- For the 1,853 class members whose credit reports containing false terrorist flags were actually sent to businesses: the harm closely resembles the common-law tort of defamation, which has always required publishing a damaging false statement to a third party. TransUnion published those misleading reports to creditors, giving those 1,853 members concrete standing to sue.
- For the 6,332 class members whose files were never shared outside TransUnion: defamation law has always required publication — a letter stored in a desk drawer harms no one, no matter how insulting it is. The Court rejected the argument that the mere risk the files might someday be shared was enough for a damages lawsuit, because those members never showed the risk materialized or that they were independently harmed by knowing about it (indeed, many never knew about the flag at all).
- For the formatting claims — about how TransUnion structured its disclosures to all 8,185 class members — no member other than Ramirez showed any evidence of actual confusion, reliance on the information, or harm resulting from the format. Receiving a technical violation of disclosure rules with no real-world consequence is what the Court called a 'bare procedural violation, divorced from any concrete harm,' and it does not supply standing for a damages claim.
Doctrinal impact
Cases affected by this decision
Reaffirms Spokeo, Inc. v. Robins (578 U. S. 330)
The Court builds squarely on Spokeo's 'close relationship' test for deciding when a statutory harm is concrete enough for standing.
Reaffirms Lujan v. Defenders of Wildlife (504 U. S. 555)
The Court reaffirms that plaintiffs must show a concrete, particularized injury in fact — not merely a legal violation — to sue in federal court.