This appeal concerns claims brought by Colleen Auer against several defendants: the City of Minot (her former employer); the law firm of Smith, Bakke, Porsborg, Schweigert & Armstrong; and the consumer reporting agency CBCInnovis, Inc. (CBC). Auer alleged that these parties violated their obligations under the Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq ., in handling a consumer report that she agreed to provide as part of her application for employment with the City.
The district court dismissed Auer's claims against the City and the law firm for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6), and granted judgment on the pleadings for CBC under Rule 12(c). Auer appeals these orders, and a separate order directing the City and the Smith law firm to dispose of copies of her consumer report that remained in their possession. Because Auer lacked Article III standing to bring her claims in federal court, we vacate the district court's orders and remand with instructions that Auer's complaint be dismissed for lack of jurisdiction.
I.
On February 26, 2014, Auer accepted appointment as the city attorney for the City of Minot. Several days later, the City's human resources director requested that Auer authorize a background check. Auer completed and signed an authorization form. The single-page form was entitled "Authorization to Release Information and Waiver," and contained the following three paragraphs of text:
I hereby authorize representatives of the City of Minot to obtain any information in my files pertaining to my driver's license records, criminal history records, *876education records; credit records; and personal history records.
I hereby direct you and release you, as the custodian of such records, and any school, college, university or other education institution, credit bureau or related personnel, both individually or collectively, from any and all liability for damages of whatever kind, which may be at any time result to me, my heirs, family or associates because of compliance with this authorization and request to release information, or any attempt to comply with it.
Should there be any questions as to the validity of this release, you may contact me as indicated below.
The form then included a space for Auer's signature, and several spaces for Auer to input her identifying information, including her social security number and driver's license number.
After Auer signed the authorization form, the City's police department completed a background check. As part of the investigation, the police department obtained Auer's credit report from the consumer reporting agency CBC. CBC had obtained Auer's credit information from another consumer reporting agency, Trans Union, LLC.
On May 2, 2014, the City terminated Auer's employment as city attorney. Auer filed claims against the City for wrongful termination, and requested that the City provide her with records related to her employment and termination, including her complete personnel file. The City retained the Smith law firm for representation in that action and for assistance in responding to Auer's records request. The City, in an attempt to comply with the records request, provided the law firm with Auer's authorization form and associated credit check. The law firm then contacted Auer, stating that it had received Auer's consumer information pursuant to her records request, and offering to furnish that information to Auer.
After Auer received the Smith law firm's letter and subsequent correspondence, she brought this action. She alleged that the City, the Smith law firm, and CBC had violated a number of obligations under the FCRA in procuring, using, and furnishing her consumer report. The City and the Smith law firm moved to dismiss Auer's claims against them for failure to state a claim. In the same motion, they requested the court's permission to destroy any of Auer's consumer information that remained in their possession.
The district court granted the motion to dismiss and denied a later motion for reconsideration under Rule 60(b) as to all claims at issue on appeal. The court also ordered the City and the Smith law firm to surrender all physical copies of the consumer report to the clerk of court, but to destroy all electronic copies. The City and the law firm, in compliance with the order, have since destroyed all electronic copies of Auer's report and deposited the hard copies with the clerk.
Separately, the district court granted judgment on the pleadings for CBC under Rule 12(c). The court reasoned that the complaint contained "nothing more than formulaic recitations of the elements of a claim and assertions without factual enhancement," and thus failed to state a plausible claim for relief.
Auer appeals the district court's orders dismissing her claims against the City and the Smith law firm, granting judgment on the pleadings for CBC, and directing the City and the law firm to destroy and surrender the remaining copies of her consumer report.
II.
We begin with the threshold question whether Auer has Article III
*877standing to bring her suit in federal court. "Federal jurisdiction is limited by Article III of the Constitution to cases or controversies; if a plaintiff lacks standing to sue, the district court has no subject-matter jurisdiction." ABF Freight Sys., Inc. v. Int'l Bhd. of Teamsters , 645 F.3d 954, 958 (8th Cir. 2011). "Subject-matter jurisdiction can never be waived or forfeited," Gonzalez v. Thaler , 565 U.S. 134, 141, 132 S.Ct. 641, 181 L.Ed.2d 619 (2012), and we have an obligation to satisfy ourselves of our own jurisdiction and that of the district court. Bender v. Williamsport Area Sch. Dist. , 475 U.S. 534, 541, 106 S.Ct. 1326, 89 L.Ed.2d 501 (1986).
To have standing, Auer "must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision." Spokeo, Inc. v. Robins , --- U.S. ----, 136 S.Ct. 1540, 1547, 194 L.Ed.2d 635 (2016). To establish an injury in fact, a plaintiff must show an injury that is " 'concrete and particularized' and 'actual or imminent, not conjectural or hypothetical.' " Id. at 1548 (quoting Lujan v. Defs. of Wildlife , 504 U.S. 555, 560, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) ). "Article III standing requires a concrete injury even in the context of a statutory violation," and a plaintiff cannot "allege a bare procedural violation, divorced from any concrete harm, and satisfy the injury-in-fact requirement of Article III." Id. at 1549.
In Count 4 of her complaint, Auer pleaded that the City violated several procedural requirements of the FCRA. She asserted that the City procured her consumer report without making "a clear and conspicuous disclosure" that her "consumer report may be obtained for employment purposes." She also complained that the City did not obtain Auer's written authorization. See 15 U.S.C. § 1681b(b)(2)(A)(i), (ii). Auer further alleged that the City procured and used her report for purposes that were not authorized by the FCRA, see id. § 1681b(f)(1), and furnished her report to the Smith law firm for an unauthorized purpose and without obtaining the required certifications. See id. § 1681b(f)(1), (2). Auer pleaded that these violations caused her to suffer "injury to her privacy, reputation, personal security, the security of her identity information and loss of time spent trying to prevent further violations of her rights under the FCRA."
"To determine whether an intangible harm counts as an injury in fact, we must consider Congress' judgment and whether the alleged intangible harm has a close relationship to a harm that traditionally provided a basis for suit in the Anglo-American legal system." Heglund v. Aitkin County , 871 F.3d 572, 577 (8th Cir. 2017). Although invasion of privacy did provide a basis for suit at common law, Braitberg v. Charter Commc'ns, Inc. , 836 F.3d 925, 930 (8th Cir. 2016), a plaintiff's consent to the invasion of a protected interest traditionally served as a bar to recovery in a tort action. Restatement (Second) of Torts § 892A (Am. Law. Inst. 1979) ; see, e.g. , Hill v. Nat'l Collegiate Athletic Ass'n , 7 Cal.4th 1, 26 Cal.Rptr.2d 834, 865 P.2d 633, 648 (1994) ; Gray v. McDonald , 28 Mo. App. 477, 488 (1888), aff'd , 104 Mo. 303, 16 S.W. 398 (1891) ; Sampson v. Burnside , 13 N.H. 264, 265 (1842).
Because Auer consented to the City's background check, she failed to plead an intangible injury to her privacy that is sufficient to confer Article III standing. Before the City procured Auer's consumer information, it provided Auer with an authorization form that stated: "I hereby authorize representatives of the City of Minot to obtain any information in my files pertaining to my driver's license records, criminal history records, education *878records; credit records; and personal history records." Auer filled out this authorization form because she understood that "a completed Authorization was required to initiate a background check," and that "a completed background check was a prerequisite to City Council approval of [Auer's] appointment as City Attorney."
Although Auer pleaded that she did not "authorize or consent (in writing or otherwise) to the procurement and use" of her consumer report "for any purpose," this conclusory allegation is belied by her well-pleaded allegation that she completed the City's authorization form, so we need not accept the denial as true. See Griffin Indus., Inc. v. Irvin , 496 F.3d 1189, 1205-06 (11th Cir. 2007). Auer asserts in a conclusory fashion that the City used her report for unauthorized purposes, but there is no well-pleaded allegation that the City acted beyond her consent. Auer's "unadorned, the-defendant-unlawfully-harmed-me accusation[s]" are not entitled to the assumption of truth. Ashcroft v. Iqbal , 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009). Thus, even assuming that there were technical violations of the statute, Auer has not established that she suffered a concrete injury to her privacy interests. See Groshek v. Time Warner Cable, Inc. , 865 F.3d 884, 889 (7th Cir. 2017) ; Woods v. Caremark, LLC , No. 4:15-cv-00535-SRB, 2016 WL 6908108, at *4 (W.D. Mo. July 28, 2016).
Nor do we think that Auer established Article III standing on the basis of her other claimed injuries-namely, reputational harm, compromised security, and lost time. Although reputational harm may constitute an injury in fact for Article III purposes, see Robins v. Spokeo, Inc. , 867 F.3d 1108, 1115 (9th Cir. 2017), Auer did not plead any facts establishing that the City's actions damaged her reputation. Auer's "naked assertion[ ]" of reputational harm, "devoid of 'further factual enhancement,' " falls short of plausibly establishing injury. Iqbal , 556 U.S. at 678, 129 S.Ct. 1937 (quoting Bell Atl. Corp. v. Twombly , 550 U.S. 544, 557, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) ).
As to Auer's alleged injury to her personal security and identity information, she did not allege that her identity information had been stolen or accessed by any person other than the defendants within the scope of her consent. Auer did plead that the City kept her consumer information in "unsecure locations," where it was supposedly accessible to "unauthorized persons," but these facts alone do not establish an "actual" or "certainly impending" injury. Any breach of Auer's security interests is speculative. See Clapper v. Amnesty Int'l USA , 568 U.S. 398, 401, 133 S.Ct. 1138, 185 L.Ed.2d 264 (2013) ; In re SuperValu, Inc. , 870 F.3d 763, 769-71 (8th Cir. 2017).
Finally, Auer pleaded that she lost time "trying to prevent further violations of her rights under the FCRA." But plaintiffs "cannot manufacture standing merely by inflicting harm on themselves based on their fears of hypothetical future harm that is not certainly impending." Clapper , 568 U.S. at 416, 133 S.Ct. 1138. Because Auer did not establish that the City was likely to violate the FCRA on future occasions, she did not suffer an injury in fact by dedicating her time to this cause. Auer failed to plead even "general factual allegations of injury resulting from the [City's] conduct," so she lacked Article III standing to pursue her claims against the City in federal court. Defs. of Wildlife , 504 U.S. at 561, 112 S.Ct. 2130.
For similar reasons, Auer lacked standing to pursue her claims against the Smith law firm in Count 5 of her complaint. Auer alleged that § 1681b(f)(2) required the law firm to certify that it would use Auer's report for a permissible purpose *879before procuring her report from the City. According to Auer, the Smith law firm did not provide the City with this certification and used Auer's report for unauthorized purposes, in violation of § 1681b(f)(1). Auer claimed the same injuries that she allegedly suffered at the hands of the City: invasion of privacy, reputational harm, compromised security, and lost time.
As discussed, Auer consented to the background check, and signed a form authorizing "representatives of the City of Minot" to obtain her credit records and other personal information. The Smith law firm was a representative of the City, so disclosure to the firm was covered by Auer's consent. Whether or not the law firm provided the City with a certification that satisfied § 1681b(f)(2), Auer did not plead sufficient facts to establish an injury to her privacy. She consented to the law firm obtaining her consumer information as a representative of the City; indeed, she alleged that the law firm obtained the information to assist the City in responding to Auer's own open records request. Auer provided no factual enhancement for her threadbare assertion that the law firm used her information for an unauthorized purpose, or that its actions otherwise caused her injury.
In Count 6, Auer claimed that the Smith law firm and CBC failed to take "reasonable measures" to dispose of her consumer information, in violation of 15 U.S.C. § 1681w and 16 C.F.R. § 682.3(a). Federal regulations provide several examples of "reasonable measures" used to dispose of consumer information, including "burning, pulverizing, or shredding of papers containing consumer information." 16 C.F.R. § 682.3(b). Auer did not allege, however, that the law firm or CBC disposed of her consumer information in an unreasonable manner. She claimed that by retaining her information, the law firm and CBC violated the statute and regulations. But the defendants' alleged retention of Auer's information does not, without more, establish a privacy injury. Braitberg , 836 F.3d at 930. Even if their alleged failure to dispose of Auer's information may have increased the risk that Auer's information could fall into the wrong hands, that risk is too speculative to support Article III standing. In re SuperValu, Inc. , 870 F.3d at 769-71. That Auer's consumer information remains theoretically "accessible by unauthorized persons" does not establish a likelihood that such persons will access her information. Auer does not have standing to pursue her § 1681w claim against the law firm or CBC.
In Counts 1, 2, and 3 of her complaint, Auer alleged that CBC violated several procedural requirements of the FCRA. She claimed that CBC violated § 1681b(a) when it furnished her report to the City for an unauthorized purpose; violated §§ 1681e(a) and 1681e(e)(2) when it did not make "reasonable efforts" to verify the City's identity or the use the City had for Auer's report, and failed to maintain and enforce "reasonable procedures" to ensure that it furnished consumer reports for permissible purposes only; violated § 1681b(b)(1) when it furnished Auer's consumer report to the City for employment purposes before the City certified that it had made a proper disclosure to Auer; and violated § 1681e(e)(1) when it failed to make certain disclosures to Trans Union about the City before it procured Auer's information from Trans Union for resale purposes. Auer again alleged harm to her privacy, reputation, and security interests, as well as loss of time.
Taking as true the allegation that CBC failed to comply with the panoply of procedural requirements set forth in the FCRA before furnishing Auer's report to the City, Auer suffered no injury because she *880gave the City consent to obtain her report. Thus, whether or not CBC met all of its statutory obligations before furnishing the report, no concrete harm came of the transaction. Auer did not allege that CBC disclosed her consumer information to any person other than the City. She did not assert sufficient facts to establish that CBC's policies and procedures for handling consumer information created an imminent risk that unauthorized persons would access her report in the future. And even assuming that Auer suffered an invasion of privacy when CBC obtained her consumer information from Trans Union, CBC's alleged failure to provide Trans Union with the identity and permissible purpose information required by § 1681e(e)(1) did not cause Trans Union to furnish the information. Any injury, then, is not "fairly traceable to the challenged conduct of the defendant." Spokeo , 136 S.Ct. at 1547.
Auer also appeals the portion of the district court's April 7, 2015, order directing the City and the Smith law firm to surrender all physical copies of Auer's consumer report to the clerk of court, and to destroy all electronic versions of the reports. Auer's only reason for seeking to unwind the order is that she thinks it will assist in her litigation of claims that the defendants did not handle or dispose of the reports properly. Given that all claims will be dismissed, however, Auer's request to transfer materials among third parties to assist with litigating the dismissed claims is moot.
* * *
For the foregoing reasons, we vacate the district court's orders dismissing Auer's claims on the merits and remand with instructions to dismiss for lack of jurisdiction.