Employment background check laws vary by state on top of a federal floor set by the Fair Credit Reporting Act. Every employer in the United States has to follow the same consent and adverse action steps before pulling a report, but what an employer can actually ask about, look into, and hold against a candidate depends heavily on where the job is located. More than 37 states restrict when employers can ask about criminal history, about 21 bar questions about prior pay, roughly a dozen limit credit checks in hiring, and over two dozen prohibit demands for social media passwords.
The Federal Floor: FCRA Consent and Adverse Action
Before an employer can run a background check through a third-party screening company, two things have to happen. The employer must give the applicant a written notice, on a standalone document, explaining that a background check may be obtained for employment purposes. The applicant then has to authorize the check in writing.1Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports Burying the disclosure inside a job application or combining it with other hiring paperwork is one of the most common FCRA violations and a frequent source of class-action lawsuits.
If something in the report pushes the employer toward rejecting the candidate, a two-step notice process kicks in. First, a pre-adverse action notice goes to the applicant with a full copy of the background report and a summary of FCRA rights. The employer then has to wait a reasonable period — the FTC has informally suggested at least five business days — so the applicant can review and dispute errors. If the rejection stands, a final adverse action notice follows, identifying the screening company and reminding the applicant of the right to dispute inaccurate information with that agency.2Office of the Law Revision Counsel. 15 USC 1681m – Requirements on Users of Consumer Reports
Willful violations carry statutory damages between $100 and $1,000 per affected applicant, plus punitive damages and attorney fees.3Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance Across a large applicant pool, that math gets ugly fast.
How Far Back a Report Can Go
For most negative information — civil judgments, collection accounts, paid tax liens, and arrest records — a consumer reporting agency cannot include anything older than seven years. Bankruptcy filings can be reported for ten years. Convictions have no federal time limit and can appear indefinitely.4Office of the Law Revision Counsel. 15 USC 1681c – Requirements Relating to Information Contained in Consumer Reports The seven-year cap disappears for positions paying $75,000 or more per year. Many states have shorter lookback windows or drop the salary exception entirely, so the true reporting window depends on state law.
Title VII Limits on Using Criminal History
Following every FCRA procedure does not immunize the way an employer uses criminal history. Title VII of the Civil Rights Act treats a neutral practice that disproportionately screens out applicants of a particular race or national origin as unlawful unless the employer can show the practice is job-related and consistent with business necessity.5Office of the Law Revision Counsel. 42 USC 2000e-2 – Unlawful Employment Practices Blanket policies that reject every applicant with any conviction are the classic problem.
EEOC enforcement guidance says employers should weigh three factors instead: the nature and seriousness of the offense, how much time has passed since the offense or the end of the sentence, and the nature of the job. The guidance also draws a hard line between arrests and convictions. An arrest alone does not show the person did anything wrong, so screening on arrest records rarely survives challenge. An employer can consider the conduct underlying an arrest if it has reliable information about what actually happened and the conduct is relevant to the job.6EEOC. Enforcement Guidance on the Consideration of Arrest and Conviction Records in Employment Decisions
Ban-the-Box and Fair Chance Hiring Laws
More than 37 states and over 150 cities and counties have adopted a ban-the-box or fair chance rule. The point is to strip the conviction question off the initial application so candidates get evaluated on qualifications first. Coverage varies. Some laws apply only to public employers, others reach every private employer above a size threshold.
The strictest versions push any criminal history inquiry to after a conditional offer. If the employer then finds a record and wants to pull the offer back, they generally have to:
- Conduct an individualized assessment weighing the nature of the offense, how long ago it occurred, and its relevance to the specific job — essentially the EEOC’s factors.
- Give written notice identifying the parts of the record that drove the decision, along with a copy of the background report.
- Allow the applicant at least five business days to respond with context, evidence of rehabilitation, or corrections, sometimes plus another five days to dispute report accuracy.7California Civil Rights Department. Fair Chance Act – Criminal History and Employment
Lighter versions simply keep the question off the application while allowing it during interviews. Either way, the timing shifts so skills get evaluated before the record does. Employers who ask too early, or who reject applicants without the required assessment, face administrative fines and lawsuits.
Salary History Bans
About 21 states and a growing number of cities prohibit employers from asking candidates about their prior pay. If a worker was underpaid due to discrimination or weak leverage, tying the next offer to that old number just carries the gap forward. Cutting off the question forces the employer to price the role on its market value and the candidate’s qualifications.
A typical ban blocks the question in interviews, on applications, and through public records or third-party database searches. Some states also restrict how employers use salary information the applicant volunteers. Violations can bring civil penalties, and many of these laws let affected workers recover compensatory damages or liquidated damages that double the back pay owed.
Several states pair the ban with pay transparency rules, requiring employers to disclose a salary range in the posting or on request. The applicant sees the budget, the employer cannot anchor to old pay, and the negotiation starts on more level ground.
Credit Check Restrictions
Roughly a dozen states limit when employers can pull a consumer credit report on an applicant. The general rule in those states is that a credit check is off-limits unless the information is substantially related to the job. Exemptions usually cover positions that involve access to financial assets, fiduciary responsibilities, trade secrets, or law enforcement duties, and sometimes roles requiring a security clearance or handling large amounts of cash. For everything else, the check is either prohibited or the employer has to give a written explanation of why the report matters for that particular position.
When credit does factor into a decision, the FCRA adverse action process still applies: the applicant gets a copy of the report and a chance to dispute errors before the rejection is final. Credit checks on entry-level, retail, and non-financial roles are increasingly risky and declining in use.
Social Media Password Bans
Over two dozen states bar employers from demanding access to an applicant’s private social media accounts. Public posts are fair game. Forcing someone to hand over a password, log in in front of an interviewer, or change privacy settings to expose hidden content is not.
Many of these laws also bar workarounds: requiring the applicant to “friend” a manager, open the account on the employer’s device, or otherwise bypass privacy settings. Penalties are typically misdemeanor-level fines, often up to $1,000 per incident, and an applicant denied a job for refusing access may have a civil claim.
Separate from state law, the National Labor Relations Act protects employees who discuss pay, benefits, and working conditions with coworkers on social media as concerted activity under Section 7.8Office of the Law Revision Counsel. 29 USC 157 – Right of Employees as to Organization and Collective Bargaining Firing or refusing to hire someone for that kind of post can violate federal labor law regardless of state. The NLRB has said individual gripes unrelated to group concerns, deliberately false statements, and egregiously offensive posts lose the protection.9National Labor Relations Board. Social Media
Drug Testing and Marijuana
Pre-employment drug testing is governed almost entirely by state law, and the rules range from minimal to detailed. Common state requirements include written notice of the testing policy before the test, testing only after a conditional offer, and confirmation of positive results by a certified laboratory using a second method. For federally regulated transportation roles, the Department of Transportation requires labs certified through the Department of Health and Human Services’ National Laboratory Certification Program.10US Department of Transportation. Drug Testing Laboratories
Marijuana legalization has reshuffled the landscape. Recreational use is legal in 24 states, and medical use is permitted in many more. A growing number of states prohibit adverse action based solely on a positive marijuana test, particularly for off-duty use, unless the role is safety-sensitive or covered by federal drug-free workplace rules. The trend is toward testing for active impairment rather than the presence of THC metabolites, which can linger for weeks.
Marijuana’s federal status under the Controlled Substances Act has been in flux. Federal rescheduling was under consideration as of late 2025, and if marijuana moves to Schedule III, employers may need to treat prescribed medical marijuana more like other lawful medications under the Americans with Disabilities Act, evaluating accommodation requests individually rather than imposing blanket bans.11Congress.gov. Legal Consequences of Rescheduling Marijuana Employers who haven’t updated policies recently are likely out of step in at least some states where they operate.
Narrower Federal Rules Worth Knowing
Bankruptcy
Under 11 U.S.C. § 525, government employers cannot deny employment to, fire, or discriminate against a person solely because they filed for bankruptcy or failed to pay a dischargeable debt. The protection covers current cases, past filings, and pre-bankruptcy insolvency. Private employers get a narrower rule: the statute bars firing or discriminating against current employees over bankruptcy, but conspicuously omits the phrase “deny employment to” that appears in the government subsection.12Office of the Law Revision Counsel. 11 USC 525 – Protection Against Discriminatory Treatment Several federal courts have read that gap to allow private employers to refuse to hire based on a bankruptcy filing.
Education Records
When a check includes degree or transcript verification, the Family Educational Rights and Privacy Act controls the release. Schools cannot share education records with a third-party screening company without written consent that is signed and dated, identifies the specific records, states the purpose, and names the recipient.13Protecting Student Privacy. What Must a Consent to Disclose Education Records Contain A general background check consent may not meet those requirements. Schools can release directory information like enrollment dates and degrees awarded without individual consent, but only if students had a chance to opt out.
Driving Records
For any role involving driving, the employer pulls a motor vehicle record from the state DMV. The Driver’s Privacy Protection Act allows employers to obtain or verify driver information for employment purposes under 18 U.S.C. § 2721.14Office of the Law Revision Counsel. 18 USC 2721 – Prohibition on Release and Use of Certain Personal Information From State Motor Vehicle Records Records show license status, traffic violations, DUI history, and suspensions. Commercial driving positions regulated by the Federal Motor Carrier Safety Administration require at least a three-year review before hire. State DMV fees generally run $2 to $10. If a screening company bundles the driving record into a broader consumer report, the FCRA process applies to the whole package.
What Background Checks Cost
For applicants, the screening itself is free. Federal and most state laws prohibit employers from passing the cost to the candidate. Employer costs depend on scope. State criminal record checks generally range from free to about $95, with most under $40. Bundled screening packages that combine criminal records, credit checks, employment verification, and drug testing typically run $30 to $200 or more per applicant. Fingerprint-based FBI checks, extensive international searches, and multi-jurisdiction court pulls sit at the top of that range.
If you know a check is coming, request your own consumer file from the major screening agencies before the employer does, so you can spot and dispute errors first. Under the FCRA, every consumer is entitled to one free report per year from each nationwide consumer reporting agency.1Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports