Job applications are not automatically confidential. Whether the details you submit stay private depends on who is hiring you, what kind of information is involved, and which state you live in. Federal law locks down a few specific categories — medical records, genetic information, and background check results — while state laws and employer policies fill in the rest with uneven coverage.
Who Sees Your Application at a Private Employer
Most private companies feed applications into an Applicant Tracking System that stores your resume, cover letter, and any other materials you upload. Access is generally limited to human resources staff and the hiring managers working on that specific opening. Employers often label this data “confidential” in their internal policies, but the label refers to restricted access inside the organization, not a binding promise that no one else will ever see it.
Reviewers inside the system may add notes about your salary expectations, interview performance, and overall fit. If a company considers you for more than one role, managers across departments can sometimes pull up those records. These controls are company guidelines, not legally enforceable promises. When someone inside the organization shares your application details outside proper channels, whether you have a remedy depends on whether a specific law was broken, not simply whether a policy was.
Third-party recruiters add another layer. A staffing firm or headhunter routes your candidacy through an additional organization with its own data practices. If a recruiter reaches you at your current workplace or reveals your job search to your current employer, you may have grounds for a claim based on invasion of privacy or interference with your employment, depending on the circumstances. Before you work with an outside recruiter, ask directly how they will handle your information and whether they will contact your current employer.
What Federal Law Actually Protects
Federal statutes carve out three areas where confidentiality is more than a policy promise: background checks, medical information, and genetic information.
Background Checks Under the FCRA
When an employer uses an outside company to investigate your background, the Fair Credit Reporting Act governs the process. Before the screening firm pulls your criminal records, credit history, or educational credentials, the employer must give you a written notice in a standalone document, separate from the application itself, telling you a background check may be conducted. You then have to authorize the check in writing before it can proceed.1Office of the Law Revision Counsel. 15 U.S. Code 1681b – Permissible Purposes of Consumer Reports
If the employer decides not to hire you based on something in that report, they cannot just reject you and move on. They must first send a pre-adverse action notice that includes a copy of the report and a summary of your rights, giving you a chance to review and dispute anything inaccurate.2Federal Trade Commission. Background Checks What Employers Need to Know After the final adverse decision, they must notify you again, identify the screening company, and tell you that you can dispute the report and obtain a free copy within 60 days.
Willful violations expose the employer or screening firm to actual or statutory damages, punitive damages, and attorney’s fees.3Office of the Law Revision Counsel. 15 U.S. Code 1681n – Civil Liability for Willful Noncompliance
Medical Information Under the ADA
The Americans with Disabilities Act restricts what employers can ask about your health and what they can do with the answers. Before making a job offer, an employer generally cannot ask whether you have a disability or probe the nature of one. They can ask only whether you can perform the specific functions of the job.4Office of the Law Revision Counsel. 42 U.S. Code 12112 – Discrimination
After a conditional job offer, an employer may require a medical examination, but only if every incoming employee in the same job category takes the same one. Any medical information collected at that point must be stored on separate forms and in separate files from your general application or personnel records, and treated as a confidential medical record.5eCFR. 29 CFR 1630.14 – Medical Examinations and Inquiries Only a narrow group of people can see those files: supervisors who need to know about work restrictions or accommodations, safety personnel in case of emergency, and government officials investigating compliance.
Genetic Information Under GINA
The Genetic Information Nondiscrimination Act bars employers from intentionally requesting or obtaining genetic information from applicants or employees. That includes family medical history, genetic test results, and information about genetic services. Employers cannot use any genetic information in hiring decisions, and the same confidentiality rules that apply to ADA medical records apply here — genetic data has to be kept in separate, secure files.6U.S. Department of Labor. The Genetic Information Nondiscrimination Act of 2008 – GINA
What Your State May Add
State laws fill in significant gaps, and they vary widely. Three categories matter most for job seekers.
Comprehensive Consumer Privacy Laws
Several states have passed broad consumer privacy statutes that cover personal data collected during hiring. These laws generally let residents find out what personal information an employer has collected, learn how it is used or shared with third parties, request corrections, and ask for deletion. If you live in one of these states, you can typically submit a data access request to an employer you have applied to and expect a response within a set timeframe.
Social Media Password Protections
More than half of the states prohibit employers from asking applicants for social media login credentials, requiring applicants to pull up accounts during an interview, or demanding privacy-setting changes that expose those accounts. No federal law addresses this, so protection depends entirely on your state. If an employer asks for social media passwords, check your state’s law before deciding how to respond.
Salary History Bans
Roughly half the states, along with a number of cities and counties, restrict employers from asking about your prior compensation during hiring. These laws treat salary history as private information that should not shape a new offer. The federal government has adopted a similar policy for most federal positions, but no federal statute bans the practice across all private employers.
Government Job Applications Are Different
Applying to a government agency changes the picture. State open-records laws and the federal Freedom of Information Act are built to let the public see how public money is spent and how public jobs are filled, and that transparency often reaches into applications themselves.
For senior or executive government roles, finalists’ application materials often become part of the public record. Candidates for jobs like agency directors and school superintendents routinely have their materials released to journalists and community members. Even for lower-level roles, some details about the applicant pool may be subject to disclosure through a public records request.
Federal law does provide a privacy exemption that lets agencies withhold personal information when releasing it would be a clearly unwarranted invasion of privacy. Home addresses, phone numbers, and Social Security numbers are typically redacted. The agency weighs the public interest in understanding the hiring process against the applicant’s personal privacy, and pure personal identifiers usually get redacted.
If you apply for a government position, assume your candidacy — and potentially your application — could become public if you reach the finalist stage. Transparency requirements generally override an individual applicant’s preference for confidentiality, and agencies that refuse valid records requests can be sued to compel disclosure.
How Long Employers Keep Your Application
Even after a position is filled and you were not selected, your application does not disappear. Federal regulations require employers covered by antidiscrimination laws to keep all application materials and related hiring records for at least one year from the date the record was created or the hiring decision was made, whichever is later.7eCFR. 29 CFR Part 1602 – Recordkeeping and Reporting Requirements The retention period exists so the Equal Employment Opportunity Commission and applicants can investigate potential discrimination claims.8U.S. Equal Employment Opportunity Commission. Recordkeeping Requirements
If a discrimination charge has been filed or a lawsuit is pending, the employer has to preserve all relevant records until the matter is fully resolved, no matter how long that takes. Many employers voluntarily keep applications longer than the one-year minimum, either for future openings or to protect against late-filed claims. In a state with a comprehensive consumer privacy law, you may be able to request deletion of your data after the mandatory retention period has passed.
Practical Steps to Protect Yourself
Legal rules matter, and so do practical habits. Use a dedicated email address and phone number for job applications rather than your primary personal accounts. Read the employer’s privacy notice before submitting anything; most companies have to disclose what they collect and how they use it, and the notice usually appears early in the online application flow.
If you are worried about your current employer finding out, be deliberate about where you post your resume. Many job boards let you block specific companies from viewing your profile. When you work with a recruiter, put your confidentiality expectations in writing and state clearly that your current employer should not be contacted without your permission. For government applications, look up the applicable open-records law before you apply so you are not caught off guard if your candidacy becomes public.