An FCRA-compliant background check is one that follows the Fair Credit Reporting Act’s rules for screening someone through a third-party consumer reporting agency: the employer gives the applicant a standalone written disclosure, gets written authorization, confirms a permissible purpose with the screening company, and — if the report leads to a rejection — sends both a pre-adverse and a final adverse action notice with the required content and timing. Miss any of those steps and the exposure is statutory damages between $100 and $1,000 per violation, punitive damages, and the applicant’s attorney fees.
The rules below apply whenever you hire an outside company to compile information on a candidate. A do-it-yourself Google search or a look at a public social media profile generally sits outside the FCRA. The moment a screening vendor is involved, the full federal framework attaches.
When the FCRA Applies to Your Background Check
The FCRA reaches any “consumer report” — information a consumer reporting agency communicates about a person’s creditworthiness, character, reputation, or personal characteristics that will be used to make a decision about employment, credit, insurance, or housing.1Office of the Law Revision Counsel. 15 U.S. Code 1681a – Definitions; Rules of Construction For hiring, that captures the routine tools: criminal history searches, driving records, credit reports, and reference checks routed through a vendor. If a consumer reporting agency is in the chain, the FCRA is in the chain.
Disclosure and Written Authorization
Before you order the report, two documents have to be right.
The first is a written disclosure telling the applicant that a consumer report will be obtained for employment purposes. It must be a standalone document. It cannot be bundled into the job application, an employee handbook acknowledgment, or a liability waiver.2Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports This is the single most common place employers get caught. Adding extra language on the same page — even language that seems related, like a release of claims against former employers — can void the consent.
The second is the applicant’s written authorization. It can sit on the same standalone page as the disclosure, and it can be signed electronically under the ESIGN Act if you can show the signer intended to sign, consented to electronic records, and the audit trail ties the signature to that person.
How Long to Keep the Signed Form
The FCRA doesn’t set a specific retention period. Federal equal employment rules require private employers to keep hiring-related records for at least one year from the date the record was made or the personnel action occurred, whichever is later; state and local governments and educational institutions face a two-year minimum.3U.S. Equal Employment Opportunity Commission. Summary of Selected Recordkeeping Obligations in 29 CFR Part 1602 Some states go longer. The practical rule is to hold the authorization for the length of employment plus whatever your state adds on top.
Certifying a Permissible Purpose
A consumer reporting agency can only release a report when the requester certifies a permissible purpose recognized by statute. For hiring, that purpose is employment. The certification is the agency’s gatekeeping function, and it protects you as well: an agency that won’t release without one is doing its job.2Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports Anyone who obtains a report under false pretenses or without a permissible purpose faces liability of the greater of actual damages or $1,000.
Extra Steps for Investigative Consumer Reports
If your screening goes beyond database searches and includes personal interviews with neighbors, former co-workers, or acquaintances about the applicant’s character, reputation, or lifestyle, that is an “investigative consumer report” and it carries added duties.
You have to notify the applicant in writing no later than three days after requesting the report. The notice must say an investigative report is being prepared and tell the applicant they can request a full description of its scope. If they ask in writing within a reasonable time, you have five days to respond with that description.4Office of the Law Revision Counsel. 15 USC 1681d – Disclosure of Investigative Consumer Reports
What the Report Can Legally Contain
The FCRA restricts how far back a consumer report can reach. Most negative information falls off after seven years:
- Bankruptcies: ten years from filing or adjudication.
- Civil suits and judgments: seven years from entry, or until the statute of limitations runs, whichever is longer.
- Paid tax liens: seven years from the date of payment.
- Collection accounts and charge-offs: seven years from the date placed for collection or charged off.
- Other adverse items: seven years.
- Criminal convictions: no federal time limit; they can be reported indefinitely.5Office of the Law Revision Counsel. 15 USC 1681c – Requirements Relating to Information Contained in Consumer Reports
The conviction exception is the one to watch. Federal law will not stop a decades-old felony from surfacing, but state law often does, and state limits control when they are stricter than the FCRA.
The Adverse Action Process
If something in the report makes you inclined to reject the applicant, the FCRA requires two separate notices. Merging them into one communication is a violation even if all the required content is technically in there.
Pre-Adverse Action Notice
Before you make the final call, send a pre-adverse action notice that includes a copy of the report and a written summary of the applicant’s FCRA rights.2Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports The point is to give the person a real chance to see what’s in the report and flag errors before losing the job. The statute requires a “reasonable” waiting period but doesn’t quantify it. Industry practice treats five business days as the minimum safe window.
Final Adverse Action Notice
If you proceed with the rejection, the second notice has to include:
- The name, address, and phone number of the consumer reporting agency that supplied the report.
- A statement that the agency did not make the decision and cannot explain it.
- Notice that the applicant has 60 days to request a free copy of the report from that agency.
- Notice that the applicant can dispute the accuracy or completeness of any information in the report.6Office of the Law Revision Counsel. 15 USC 1681m – Duties of Users Taking Adverse Actions on the Basis of Information Contained in Consumer Reports
The pre-adverse notice goes out while the decision is still tentative. The final notice goes out after it’s made. Keeping them separate is the point.
Disposing of the Report When You’re Done
Compliance doesn’t end at the hiring decision. Any business that has consumer report data has to dispose of it using measures that prevent unauthorized access. The FTC’s Disposal Rule recognizes three approaches: burning, pulverizing, or shredding paper; destroying or erasing electronic media so data can’t be recovered; or hiring a document destruction contractor after doing due diligence on their methods.7eCFR. 16 CFR Part 682 – Disposal of Consumer Report Information and Records Dropping a printed report in the office recycling bin doesn’t clear the bar.
What Noncompliance Costs
The FCRA splits civil liability into two tracks depending on the employer’s state of mind.
A willful violation — knowingly disregarding the statute — exposes you to statutory damages of $100 to $1,000 per violation with no requirement that the applicant prove any actual harm, plus punitive damages in whatever amount the court considers appropriate, plus attorney fees and costs.8Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance In a class action covering thousands of applicants who signed the same defective disclosure form, the per-person statutory damages become the whole ballgame.
A negligent violation — carelessness rather than intent — is limited to the applicant’s actual damages plus attorney fees and costs, with no statutory floor and no punitive damages.9GovInfo. 15 USC 1681o – Civil Liability for Negligent Noncompliance Actual damages are uncapped, though. An applicant who can document a lost job offer and the financial fallout can recover substantially even without the willfulness label.
State Laws That Layer On Top
The FCRA is a floor. More than 37 states and 150 cities and counties have enacted “ban the box” or fair-chance hiring laws that restrict when you can ask about criminal history or run a criminal background check. Most delay criminal-record inquiries until after a conditional offer, and some require you to assess whether the conviction is actually relevant to the position before withdrawing that offer.
Several states also cap how far back criminal records can be reported — seven or ten years for certain offenses — even though the FCRA allows convictions to be reported indefinitely. A few states require notices or disclosures beyond the federal set. Federal compliance alone does not equal state compliance, so if you hire in more than one jurisdiction, check each one before you finalize your forms and workflow.