Summary. Running a background check is a regulated act, and the regulation comes from three directions. The Fair Credit Reporting Act governs the mechanics — what you disclose, what you authorize, what you send before and after a decision, and in what form. Title VII and the EEOC's guidance govern whether the criteria you apply have a discriminatory effect. And a growing body of state and local fair chance laws governs when you may ask, what you may consider, and what individualized assessment you must perform before rejecting someone. This guide walks the process end to end and identifies the specific defects that generate class actions.

An employer runs background checks on 4,000 applicants a year through a national vendor. The process is efficient: the online application includes an authorization paragraph within the general terms, the vendor returns a report, and rejected applicants receive a form letter.

There are three violations in that sentence, and each is a class action.

The disclosure is not standalone. 15 U.S.C. § 1681b(b)(2) requires that the disclosure be "in a document that consists solely of the disclosure." Burying it in an application, adding a liability release, or including state-law notices has been held to violate that requirement.

There is no pre-adverse action notice. Section 1681b(b)(3) requires that before taking adverse action based in whole or in part on a consumer report, the employer provide the applicant with a copy of the report and the summary of rights — so the applicant can dispute an error before losing the job.

The form rejection letter is not an adverse action notice. Section 1681m requires specific content: the name, address, and toll-free number of the consumer reporting agency; a statement that the agency did not make the decision and cannot explain it; and notice of the right to a free copy of the report within sixty days and to dispute its accuracy.

Statutory damages for a willful violation run from $100 to $1,000 per violation, plus punitive damages, costs, and attorney's fees. At 4,000 applicants a year, the arithmetic is why this is one of the most heavily litigated employment statutes in the country — and why the fix, which is essentially formatting and sequencing, is worth doing correctly.

The FCRA framework

What is covered. A consumer report is information from a consumer reporting agency bearing on creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living, used or expected to be used for a permitted purpose including employment.

Key consequences:

  • A report obtained from a third-party vendor is a consumer report. Criminal history, employment verification, education verification, motor vehicle records, credit reports, and drug testing results delivered by a screening company are all covered.
  • A check the employer performs itself — searching public court records directly, calling a former employer, or looking at a public social media profile — is generally not a consumer report, and the FCRA's requirements do not apply. State law may still apply.
  • An investigative consumer report — one including information obtained through personal interviews about character, general reputation, or mode of living — triggers additional disclosure requirements under § 1681d: notice within three days that such a report may be obtained, a description of its nature and scope on request, and delivery of a specified summary of rights.

The three FCRA obligations, in order.

1. Disclosure and authorization, before the report is obtained

  • A clear and conspicuous written disclosure, in a document consisting solely of the disclosure, stating that a consumer report may be obtained for employment purposes.
  • Written authorization from the applicant. Authorization may appear on the same document as the disclosure — the statute expressly permits it — but nothing else may.

What courts have held violates this:

  • Syed v. M-I, LLC, 853 F.3d 492 (9th Cir. 2017), held that including a liability waiver in the disclosure violates the standalone requirement, and that the violation was willful because the statutory language is unambiguous — exposing the employer to statutory and punitive damages rather than only actual damages.
  • Gilberg v. California Check Cashing Stores, LLC, 913 F.3d 1169 (9th Cir. 2019), held that including state-law disclosures in the same document violates the standalone requirement, and separately that a disclosure was not "clear and conspicuous" where its language was confusing to a reasonable reader.
  • Including the disclosure within an employment application, within an offer letter, or alongside an arbitration agreement.
  • Adding extraneous information — a description of the vendor's services, an explanation of what will be checked in unnecessary detail, or a certification about the accuracy of the application.

What is permitted: the disclosure, a brief and accurate description of what a consumer report is, and the authorization. Some courts have permitted a minimal amount of additional language directly related to the disclosure itself; the safe practice is to include nothing else and to put state notices on a separate page.

2. Pre-adverse action, before the decision is final

Before taking adverse action based in whole or in part on the report, provide:

  • A copy of the consumer report; and
  • A copy of "A Summary of Your Rights Under the Fair Credit Reporting Act," the form prescribed by the Consumer Financial Protection Bureau. Use the current version; it has been revised, and using an outdated form is itself a violation.

A reasonable period must elapse before the decision is finalized, so the applicant can review and dispute. The statute does not specify a period. Five business days is the customary practice, and some jurisdictions require more. Several fair chance laws require substantially longer.

Also send, as a practical matter: a cover letter explaining what is happening, identifying the specific information at issue, and providing the vendor's contact information and instructions for disputing.

3. Adverse action notice, after the decision

If the employer proceeds, provide notice — oral, written, or electronic, though written is the only defensible form — containing:

  • The name, address, and telephone number of the consumer reporting agency, including a toll-free number if it is a nationwide agency;
  • A statement that the agency did not make the decision and cannot explain why it was made;
  • Notice of the right to obtain a free copy of the report from the agency within 60 days; and
  • Notice of the right to dispute the accuracy or completeness of the information with the agency.

Timing. The FCRA does not impose a deadline, but the notice should follow reasonably promptly after the decision, and several state laws impose their own timing.

Employer certification. Separately, the employer must certify to the consumer reporting agency that it has complied with the disclosure requirements, will comply with the adverse action requirements, and will not use the information in violation of any equal opportunity law. Vendors build this into their service agreements.

What may appear in the report

15 U.S.C. § 1681c limits what a consumer reporting agency may report:

  • Bankruptcies older than 10 years.
  • Civil suits, civil judgments, and arrest records older than 7 years or until the governing statute of limitations expires, whichever is longer.
  • Paid tax liens older than 7 years.
  • Accounts placed for collection older than 7 years.
  • Any other adverse item other than criminal convictions older than 7 years.

Note the asymmetry: criminal convictions may be reported indefinitely under federal law. But these limits do not apply where the report is for employment at an annual salary that equals or exceeds a statutory threshold — a provision that surprises applicants and that is frequently misunderstood by employers.

State law is often stricter. A number of states limit reporting of convictions to seven years regardless of salary, prohibit reporting of non-convictions entirely, or restrict specific categories such as expunged, sealed, pardoned, or juvenile records, deferred adjudications, and marijuana offenses. California, Massachusetts, New York, and others each have their own rules. Determine the applicant's location and apply that state's rule.

Accuracy. § 1681e(b) requires agencies to follow reasonable procedures to assure maximum possible accuracy. Common errors that produce disputes and litigation: mixed files (another person's record attributed to the applicant, often a name match with a different date of birth), records reported after expungement, dismissed charges reported as convictions, and a single incident reported multiple times from different sources.

When a dispute is filed, the agency must reinvestigate within 30 days and delete or correct inaccurate information. The employer should hold the position or the decision open while a dispute is pending, and should re-evaluate on the corrected report.

Title VII and the EEOC's criminal records guidance

The FCRA governs process. Title VII governs the criteria, and using criminal history has a well-documented disparate impact by race and national origin.

The EEOC's 2012 Enforcement Guidance on the consideration of arrest and conviction records sets the framework employers are measured against:

Arrests versus convictions.

  • An arrest is not proof of criminal conduct and, standing alone, may not be the basis for an employment decision. The employer may, however, consider the underlying conduct if it establishes that the conduct occurred and makes the individual unfit.
  • A conviction is generally reliable evidence that the conduct occurred.

Two paths to defensibility:

  1. A validated screen consistent with the Uniform Guidelines on Employee Selection Procedures. Rarely used, because validation studies for criminal history are difficult and expensive.

  2. The targeted screen plus individualized assessment — the practical path. The employer develops a screen tailored to:

    • The nature and gravity of the offense or conduct;
    • The time elapsed since the offense, conduct, or completion of the sentence; and
    • The nature of the job held or sought — its duties, its environment, and the degree of supervision and public or vulnerable-population contact.

    These three factors come from Green v. Missouri Pacific Railroad and are universally cited.

    Then, before rejecting, the employer conducts an individualized assessment: notifying the individual that they may be excluded because of the record, giving them an opportunity to explain and to provide additional information, and considering that information before deciding.

Information relevant to the individualized assessment: the facts and circumstances of the offense; the number of offenses; the individual's age at the time; evidence of the same work performed without incident since; the length and consistency of employment before and after; rehabilitation efforts, training, and education; employment or character references; and whether the individual is bonded.

Blanket exclusions are the highest-risk practice, and they are what enforcement actions target. "No one with a felony" applied to every position, without regard to the offense, its age, or the job's duties, is essentially indefensible.

Also: several categories of position carry statutory or regulatory disqualifications — childcare, eldercare, healthcare, transportation, financial services, security, and positions requiring a license or a clearance. Where a federal law or regulation mandates the exclusion, the employer is on solid ground; where a state law does, Title VII preemption questions can arise, and the EEOC has taken the position that a state law does not shield an employer from Title VII liability.

Ban-the-box and fair chance laws

A majority of states and a large number of cities and counties now regulate when and how criminal history may be considered. The requirements differ but cluster into four categories.

1. Timing. The inquiry may not be made until a defined point:

  • After an initial interview, in some jurisdictions;
  • After a conditional offer of employment, in the strictest and increasingly common formulation; or
  • Simply not on the initial application — the original "ban the box."

2. Scope. Restrictions on what may be considered: no arrests without conviction, no sealed or expunged records, no juvenile adjudications, no infractions, no convictions older than a stated period, and no pending charges in some jurisdictions.

3. Individualized assessment. Several jurisdictions codify the EEOC's approach with mandatory factors. New York's Correction Law Article 23-A — N.Y. Correct. Law §§ 752–753 — prohibits denial of employment because of a conviction unless there is a direct relationship to the job or employment would involve an unreasonable risk, and enumerates eight factors that must be considered. New York City's Fair Chance Act layers additional procedural requirements on top, including a written analysis provided to the applicant and a holding period.

4. Procedure. Written notice of the preliminary decision identifying the conviction at issue, a copy of the report, the employer's reasoning, a specified period for the applicant to respond (often five business days, and in some jurisdictions longer), consideration of the response, and a final written notice with the right to appeal or reapply.

California's Fair Chance Act is representative of the strict end: no inquiry before a conditional offer; a written individualized assessment; notice identifying the conviction, a copy of the conviction history report, and a statement of the right to respond within five business days; an additional five days if the applicant disputes accuracy and is gathering evidence; consideration of the response; and a final notice including any procedure for reconsideration and notice of the right to file a complaint.

The practical instruction: build the process to the strictest jurisdiction in which you hire, or maintain jurisdiction-specific workflows in the applicant tracking system. Do not maintain a single national process built to the federal minimum, because it will violate a dozen local ordinances simultaneously.

Adjacent screening practices

Credit history. Roughly a dozen states and several cities restrict the use of credit reports in employment, generally permitting it only for positions with financial responsibility, access to significant assets, or managerial authority, and requiring the employer to state the reason. Even where permitted, consider whether the credit report actually predicts anything about job performance — the evidence that it does is thin, and the disparate impact concerns are real.

Salary history bans. Many states and localities prohibit asking about an applicant's prior compensation, and some prohibit relying on it even if volunteered. Several also require disclosure of the pay range on request or in the posting. This is a distinct body of law from background checks, and it lives in the same conversation with a candidate — train recruiters on both.

Drug testing. Governed by state law, which varies enormously. Several states restrict pre-employment testing, and a growing number prohibit adverse action based on off-duty cannabis use or on a positive test for cannabis metabolites, with exceptions for safety-sensitive positions and federally regulated roles. Federal contractors and DOT-regulated employers have mandatory programs. Check the applicable state before testing, and be precise about which substances and which positions.

Reference checks. Not a consumer report if the employer calls directly. Risks run the other way: a former employer providing a reference faces potential defamation exposure, which is why most large employers confirm only dates and title. Most states have a qualified privilege statute protecting good-faith references, and some create a presumption of good faith. As the checking employer, document what was said and by whom.

Social media. Reviewing public profiles is generally lawful, but it exposes the employer to information about protected characteristics it would otherwise not have — creating a record that the decision-maker knew an applicant's religion, disability, or family status. Best practice: have someone who is not the decision-maker perform the review, using defined criteria, and pass along only job-related findings. Also note the roughly two dozen states prohibiting employers from requesting passwords or access to private accounts.

Off-duty conduct statutes. Several states protect lawful off-duty activity, including tobacco use, political activity, and in some formulations any lawful conduct, from employment consequences.

Immigration status. Form I-9 must be completed for every hire, and E-Verify is mandatory for federal contractors and in a number of states. These are separate obligations from background screening, and using E-Verify to prescreen before an offer, or requiring specific documents, is an unfair immigration-related employment practice.

A compliant workflow

Job posting and application

  • Include the pay range where required.
  • No criminal history question on the application in any jurisdiction that prohibits it; the practical answer for a multistate employer is to remove it everywhere.
  • No salary history question.
  • Include an EEO statement and, where required, a fair chance statement.

Interview

  • Train interviewers on what may not be asked: criminal history where prohibited at this stage, salary history, disability, family status, immigration status beyond authorization to work.
  • Use structured, job-related questions applied consistently.

Conditional offer

  • Extend the offer, conditioned on satisfactory completion of background screening, in writing.
  • Deliver the standalone FCRA disclosure and obtain written authorization.
  • Deliver state and local notices on a separate document.
  • Deliver the investigative consumer report notice if applicable.

The report

  • Order only what the job requires. A broad package for every role is both wasteful and a discrimination risk.
  • Review the report against the targeted screen, not against a general impression.

If the report is clean

  • Proceed. Retain the authorization and the report per the retention policy.

If it is not

  1. Pause. Do not communicate a decision.
  2. Send the pre-adverse action package: cover letter identifying the specific information at issue, a copy of the report, the current CFPB summary of rights, and any state-required notices and forms.
  3. Where a fair chance law applies, include the written individualized assessment and the specific reasoning it requires.
  4. Wait the required period — five business days at minimum, longer where required.
  5. If the applicant responds, consider the response substantively and document that consideration. If they dispute accuracy, hold the decision until the reinvestigation concludes.
  6. Decide, and document the decision and its basis.
  7. If proceeding, send the adverse action notice with the required content, plus any state-required elements and any reconsideration or appeal rights.

Records

  • Retain the disclosure, authorization, report, pre-adverse and adverse action notices, individualized assessment, and any applicant response for the applicable limitations periods — generally at least two to four years, and longer where a state or a government contract requires it. Federal contractors and employers covered by EEOC recordkeeping rules have their own retention requirements.

Vendor management

The screening vendor is a consumer reporting agency with its own obligations, and the employer's compliance depends substantially on the vendor's systems.

Diligence and contract points:

  • Compliance with § 1681e(b) accuracy procedures, and specifically how the vendor matches records to individuals — full name, date of birth, and address history at minimum, with a documented protocol for common names.
  • Handling of expunged, sealed, and dismissed records, and jurisdiction-specific suppression rules.
  • Adverse action support — whether the vendor sends notices on the employer's behalf, using which forms, and how the employer controls the timing and content. Verify the forms the vendor uses, because the employer is liable for them.
  • Dispute handling and turnaround.
  • Data security and retention, and deletion on termination.
  • Indemnification, and whether it is backed by insurance.
  • Audit rights, exercised at least annually.
  • Notification of legal changes and system updates for new state requirements.

Do not delegate the judgment. Vendors sometimes offer "adjudication" services that apply the employer's criteria and return a pass/fail. That is convenient and it does not transfer liability — the employer remains responsible for whether the criteria are job-related and for the individualized assessment, and a vendor's automated decision is exactly the kind of blanket exclusion the EEOC targets. Keep the human review.

Continuous screening and current employees

A growing number of employers subscribe to continuous criminal monitoring for current employees. The same rules apply:

  • The original authorization must be broad enough to cover ongoing checks, or a new one is required. Language authorizing checks "at any time during employment" is generally accepted, though some states require a fresh authorization.
  • Adverse action procedures apply to termination or reassignment based on a report, exactly as they apply to hiring.
  • State fair chance laws frequently apply to current employees as well as applicants.
  • Consider whether monitoring is proportionate. For a driver, a childcare worker, or a person handling client funds, it is defensible. For an office role with no such exposure, it is surveillance with legal risk and questionable value.

Negligent hiring, the other side

The reason employers screen at all is not only regulatory. Negligent hiring and negligent retention claims impose liability where an employer knew or should have known of an employee's dangerous propensity and placed them in a position where harm was foreseeable.

The tension is real: fair chance laws limit inquiry, and tort law penalizes failing to inquire. The resolution is proportionality: screen for what the job actually presents. A position with unsupervised access to homes, to children, to vulnerable adults, to cash, or to weapons warrants a thorough, job-related screen and a documented assessment. A remote data-entry position does not, and screening it heavily creates exposure without reducing risk.

Document the reasoning in either direction. An employer who can show why it screened for what it screened for, and how it evaluated what it found, is defensible on both sides.

Closing

The compliance failures in this area are almost never substantive. Employers rarely intend to exclude people unlawfully; they use a form that has a waiver in it, or they skip the pre-adverse action step because the decision seems obvious, or they apply a national process in a city with its own ordinance.

Which means the fix is mostly documents and sequencing: a standalone disclosure with nothing else on the page, a current summary of rights, a real waiting period, a written individualized assessment where required, and a jurisdiction-aware workflow. That is a week of work for an HR function and it eliminates the overwhelming majority of the exposure.

The harder question — what criminal history should actually disqualify someone from what job — deserves genuine attention rather than a policy inherited from a form. Ask what the record predicts about this job, how old it is, and what the person has done since. That inquiry is what the EEOC's guidance asks for, what the fair chance statutes require, and what a defensible hiring decision looks like in any event.

Litigation risk, and what plaintiffs actually plead

FCRA employment cases are brought as classes because the violations are uniform by design — the same defective form goes to every applicant.

The three theories, in order of frequency:

  1. Defective disclosure. The document contained a waiver, state notices, extraneous explanatory text, or was embedded in an application. Damages are statutory, and willfulness is pleaded by pointing to the statute's plain language and to published decisions putting employers on notice.
  2. No pre-adverse action notice, or one sent simultaneously with the final decision, which courts treat as no notice at all because it defeats the purpose.
  3. Deficient adverse action notice — missing the toll-free number, the statement that the agency did not make the decision, or the sixty-day free-copy right.

Standing. Spokeo, Inc. v. Robins, 578 U.S. 330 (2016), and TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), require a concrete injury, and defendants have used them with some success against pure procedural claims. Courts have divided: a defective disclosure that caused no confusion and led to a report the applicant authorized anyway may not support standing, while a failure to provide the report before adverse action — depriving the applicant of the chance to correct an error — generally does. The practical effect for defendants is often a remand to state court, where Article III standing does not apply, which is not always an improvement.

Willfulness matters enormously because it unlocks statutory and punitive damages. The standard from Safeco Insurance Co. v. Burr is reckless disregard — an objectively unreasonable reading of the statute. An employer relying on a vendor's form, without review, has a weak reasonableness argument once published appellate decisions have addressed the exact defect.

Insurance. Employment practices liability policies frequently exclude FCRA claims or sublimit them severely. Check the policy specifically, ask for the exclusion to be removed or a sublimit raised at renewal, and do not assume EPLI covers a background check class action — many do not.

The defense that works best is prevention. These cases are hard to defend on the merits because the documents are the evidence and they either comply or they do not. An employer that reviews its forms annually against current case law, uses the current CFPB summary, and enforces the waiting period will not be a defendant.

A one-page audit

Answer these about your own process. Any "no" is a task.

Disclosure

  • Is the FCRA disclosure on a page containing nothing else — no waiver, no state notices, no application content, no vendor description?
  • Is it written in plain language a reasonable applicant would understand?
  • Is the authorization signed and retained, and can you produce it for any applicant from the past four years within a day?
  • Are state-specific notices delivered on separate documents?
  • Is the investigative consumer report notice delivered where interviews are conducted?

Report

  • Do you order only the components each role requires, documented by role?
  • Does the vendor suppress records the applicant's state prohibits reporting?
  • Do you have a written targeted screen identifying, by job family, what records are disqualifying and why?

Pre-adverse action

  • Do you send the report and the current CFPB summary of rights before any decision is communicated?
  • Is there a documented waiting period of at least five business days, enforced by the system rather than by memory?
  • Where a fair chance law applies, do you send the written individualized assessment with the specific reasoning?
  • Do you actually read and consider responses, and document that consideration?
  • Do you hold decisions while a dispute is pending?

Adverse action

  • Does the notice contain the agency's name, address, and toll-free number?
  • Does it state the agency did not make the decision and cannot explain it?
  • Does it state the 60-day free report right and the right to dispute?
  • Does it include state-required content and any reconsideration rights?

Governance

  • Is the process jurisdiction-aware in the applicant tracking system?
  • Are recruiters and hiring managers trained annually?
  • Are forms reviewed by counsel annually against current case law?
  • Is the vendor contract current, with audit rights actually exercised?
  • Does your EPLI policy cover FCRA claims, and at what limit?

Automated screening and artificial intelligence

Employers increasingly use algorithmic tools to score applicants, rank resumes, and adjudicate background reports. Three regimes now reach that practice.

Title VII and the ADA. A tool with a disparate impact is unlawful unless job-related and consistent with business necessity, regardless of whether anyone intended the outcome, and an assessment that screens out individuals with disabilities without an accommodation path violates the ADA. The EEOC has issued technical assistance confirming that an employer is responsible for a vendor's tool used on its behalf. Ask the vendor for its adverse impact analysis, and if it has none, that is the answer.

State and local AI hiring laws. New York City's Local Law 144 requires an annual independent bias audit of an automated employment decision tool, publication of a summary of the results, and notice to candidates at least ten business days before use, including an opportunity to request an alternative process. Illinois regulates the use of artificial intelligence to analyze video interviews, requiring notice, explanation, consent, and destruction of recordings on request. Several states have enacted or proposed broader statutes imposing impact assessment and notice obligations on developers and deployers of high-risk systems, with employment expressly designated as high-risk.

The FCRA itself. A vendor that assembles information about an individual and provides a score or an assessment used for employment decisions may be a consumer reporting agency, and its output a consumer report — which triggers everything in this guide, including the applicant's right to a copy and to dispute the underlying information. Vendors dispute this characterization for scoring products; regulators have taken the position that it applies.

Practical guidance: inventory every automated tool touching hiring, demand the bias audit and the validation study, provide notice and an alternative process, keep a human decision-maker who can explain the reasoning, and preserve the ability to give an applicant the information used against them. A tool that cannot explain its output cannot support an individualized assessment, and the individualized assessment is what the law requires.

Primary authority

  • 15 U.S.C. §§ 1681–1681x (FCRA) — the employment-screening provisions: permissible purpose in § 1681b(a)(3)(B), the standalone disclosure and authorization requirement in § 1681b(b)(2), the pre-adverse-action notice and copy of the report in § 1681b(b)(3), and obsolescence limits in § 1681c.
  • 15 U.S.C. § 1681m — the adverse action notice, and § 1681g — the consumer's right to file disclosure.
  • 15 U.S.C. § 1681n and § 1681o — willful and negligent noncompliance, with statutory damages of $100 to $1,000 per violation that drive class exposure.
  • Safeco Insurance Co. v. Burr, 551 U.S. 47 (2007) — the reckless-disregard standard for willfulness, and TransUnion LLC v. Ramirez, 594 U.S. 413 (2021) — concrete harm and class standing.
  • CFPB Regulation V, 12 C.F.R. Part 1022, and the Bureau's summary-of-rights model forms.
  • 42 U.S.C. § 2000e-2(k) — disparate impact, and the EEOC Enforcement Guidance on the Consideration of Arrest and Conviction Records (Apr. 25, 2012), which supplies the individualized-assessment framework.
  • Griggs v. Duke Power Co., 401 U.S. 424 (1971) — the origin of the impact theory as applied to facially neutral screening criteria.
  • Cal. Gov't Code § 12952 and 2 Cal. Code Regs. § 11017.1 — the Fair Chance Act and its 2023 regulations, and Cal. Lab. Code § 432.7 on arrest records.
  • N.Y.C. Admin. Code § 8-107(11-a) — the Fair Chance Act and the Article 23-A factors, one of the strictest municipal regimes in the country.
  • 41 C.F.R. § 60-1.4 — the affirmative action obligations of federal contractors that interact with screening policy.

Related articles

This guide is provided for general informational purposes and does not constitute legal advice. State and local fair chance, credit check, salary history, and drug testing laws differ substantially and change frequently, and FCRA form requirements are updated periodically. Consult qualified employment counsel before implementing or modifying a screening program.