Four subsections create the entitlements, and the third contains three separate grounds. They are cumulative rather than alternatives, which is the practical point: using one does not exhaust the others.
Subsection (a) is the familiar one. One disclosure per 12-month period from each nationwide agency and each nationwide specialty agency. For the three nationwide credit bureaus, (a)(1)(B) makes the entitlement exercisable only where "the request from the consumer is made using the centralized source" Congress required them to build. That source is not only a website: 12 CFR 1022.136(b)(1) requires it to accept requests "by any of the following request methods, at the consumers' option", namely a single dedicated website, a single dedicated toll-free telephone number, and mail directed to a single address. So AnnualCreditReport.com is the best-known channel of the centralized source rather than the whole of it, and a consumer with no internet access still has a statutory route. For the specialty agencies, (a)(1)(C) instead requires a streamlined request process including, at a minimum, a toll-free telephone number. Under (a)(2) the agency must provide the report "not later than 15 days after the date on which the request is received". A narrow carve-out in (a)(4) exempts an agency that has not been furnishing reports nationwide on a continuing basis for the preceding 12 months, so a new entrant does not owe free reports in its first year.
Subsection (b) attaches to a rejection. Any agency maintaining a file on you must make the disclosure free if you request it "not later than 60 days after receipt" of an adverse action notice under 15 USC 1681m, or of a notice from an affiliated debt collection agency stating that your credit rating may be or has been adversely affected. Note where the clock starts: at your receipt of the notice, not at the lender's decision.
Subsection (c) turns on a written certification, and gives one free disclosure per 12-month period to a consumer who certifies that they are unemployed and intend to apply for employment in the following 60 days, are a recipient of public welfare assistance, or have "reason to believe that the file on the consumer at the agency contains inaccurate information due to fraud". That third ground is the one worth remembering, because it does not require an identity theft report or a police report, only a stated reason to believe.
Subsection (d) connects to the alert machinery: a consumer who has placed a fraud alert may request free copies under 1681j(d), which is the hook the alert provisions themselves point to. The published material on fraud alerts covers how many copies each alert type carries and the three-business-day delivery deadline.
What an agency may charge for anything else is capped, and the cap is indexed. Subsection (e) prohibits any charge for a notification or disclosure the Act requires, "except as authorized by subsection (f)". Under (f)(1)(A) an agency may impose a reasonable charge for a file disclosure requested outside subsections (a) through (d), which "shall not exceed $8" and must be quoted to you before the disclosure is made. But (f)(2) directs the Bureau to increase that amount "on January 1 of each year, based proportionally on changes in the Consumer Price Index, with fractional changes rounded to the nearest fifty cents", so the $8 printed in the statute is the original figure rather than today's ceiling. Look up the current maximum rather than relying on the statutory number.
The weekly reports and the annual entitlement are two different things, and both are true. The statutory floor is one disclosure per 12 months. Separately, the Federal Trade Commission states that "all three nationwide credit bureaus have permanently extended a program that lets you check your credit report from each once a week for free at AnnualCreditReport.com". That program rests on the bureaus' commitment rather than on 1681j, which is why the published material on credit reports describes it as a voluntary industry practice and treats the annual entitlement as the part you can rely on. Both statements belong on the same page: use the weekly access, and know which half of it Congress wrote.
Two things the free report does not include. It does not include your credit score, because 15 USC 1681g(a)(1)(B) provides that nothing in the file disclosure requirement obliges an agency to disclose credit scores or other risk scores, and 1681g(f)(8) permits a fair and reasonable fee for supplying one. And the statute's anti-deceptive-marketing provision exists precisely because paid products were sold under this name: for television or radio, 1681j(g)(2) requires that the disclosure "shall consist only of the following: 'This is not the free credit report provided for by Federal law'".
