Social Media Background Checks: FCRA Rules and Employer Limits

A social media background check is a structured review of an applicant’s or tenant’s publicly available online activity, used to spot red flags like violent threats, harassment, illegal conduct, or lies on a résumé. When an outside company performs the search for an employer, the Fair Credit Reporting Act sets strict rules on written disclosure, applicant consent, and how a rejection has to be communicated. Anti-discrimination laws apply no matter who runs the search, and more than two dozen states separately restrict how far an employer can reach into someone’s personal accounts.

What the Search Actually Looks At

A standard screening focuses on content that is genuinely public: posts, photos, videos, comments, and group memberships visible to anyone without logging in or sending a friend request. Analysts look for patterns that suggest violence, harassment, illegal activity, or dishonesty about qualifications. Profile bios and professional headlines get compared against what the applicant put on a résumé or application.

Private messages, posts restricted to approved contacts, and anything sitting behind an access barrier are outside the scope of a legitimate screening. Reaching for that content risks violating state privacy laws, and a consumer reporting agency that harvested private data would undermine the accuracy and fairness standards the FCRA requires. Screeners are also trained to look for sustained patterns rather than a single old post. Isolated or ambiguous content usually gets filtered out as noise.

Two ways of running the search are common. A professional agency searches public profiles and open sources, then hands over a redacted report that strips out protected characteristics and flags only role-relevant content. Reports typically cost between $25 and $40 per screening. An internal search assigned to a “firewall” reviewer with no role in the hiring decision is the other option: that person filters out any protected information before passing findings to the decision-maker. Without that separation, the hiring manager sees everything on the profile, and the organization loses any ability to show a protected characteristic didn’t influence the outcome.

When the FCRA Applies

The Fair Credit Reporting Act governs a social media background check whenever an organization hires an outside company to compile the report. The FTC has confirmed that a company selling background reports containing information pulled from social media operates as a consumer reporting agency and must follow the same FCRA rules that apply to traditional credit or criminal background checks.¹ The statute covers reports used for employment decisions, tenant screening, insurance underwriting, and similar purposes.²

When an employer conducts the search internally rather than hiring a third party, the FCRA’s disclosure and adverse action procedures don’t kick in. That doesn’t mean the search is unregulated. Title VII, the ADA, GINA, and the National Labor Relations Act still apply to every hiring decision, regardless of who did the screening. Many organizations use a third-party service precisely to create a paper trail showing they followed a compliant process.

Disclosure and Consent Before the Search

Before a third-party agency can pull a social media report for employment purposes, the employer must give the applicant a written notice explaining that a consumer report may be obtained. This notice has to appear in a standalone document with nothing else cluttering it. The applicant must then authorize the report in writing.³ Burying the disclosure inside a job application or mixing it with other terms violates the statute even if the applicant signs the form.

Skipping these steps has real consequences. A person who willfully fails to comply with the FCRA is liable for either actual damages or statutory damages between $100 and $1,000, plus punitive damages and attorney’s fees at the court’s discretion.⁴ Even negligent violations, where the organization didn’t mean to break the rules, can result in actual damages and attorney’s fees.⁵ Class action suits over botched FCRA disclosures are common enough that this is not an abstract risk.

Protected Information the Search Can Reveal

Social media profiles routinely reveal information federal law forbids employers from considering. Title VII of the Civil Rights Act prohibits employment decisions based on race, color, national origin, religion, and sex. The Supreme Court’s 2020 decision in Bostock v. Clayton County confirmed that “sex” includes sexual orientation and gender identity.⁶ A quick look at someone’s Facebook page can reveal most of these characteristics within seconds, which is why the screening process needs safeguards.

The Americans with Disabilities Act adds another layer. Employers cannot ask questions likely to reveal a disability before making a job offer, and any medical information obtained during hiring must be kept strictly confidential.⁷ If a post discloses a mental health condition or physical disability, using that information to reject a candidate violates the ADA even if the employer found it on a public profile. The EEOC has stated directly that personal information gleaned from social media may not be used to make employment decisions on any prohibited basis.⁸

The Genetic Information Nondiscrimination Act prohibits employers from requesting or purchasing genetic information about employees or applicants.⁹ The EEOC’s regulations clarify that “conducting an internet search on an individual in a way that is likely to result in a covered entity obtaining genetic information” counts as a request for that information.¹⁰ The exception for publicly available sources like newspapers and websites does not cover social media pages that require the creator’s permission to access. Family medical history or genetic test results found on restricted posts trigger GINA’s full range of remedies.

Protected Speech About Wages and Working Conditions

Section 7 of the National Labor Relations Act guarantees employees the right to engage in concerted activities for mutual aid or protection, and the NLRB has made clear that this right extends to online platforms.¹¹ This applies whether or not the employees belong to a union. A post complaining about low pay or unsafe conditions can be protected activity if it relates to group concerns or invites coworker participation. Penalizing an applicant or employee for that kind of post can generate an unfair labor practice charge. The protection has limits: purely personal venting, knowingly false statements about the employer, and public attacks on the company’s products unrelated to any workplace dispute all fall outside the shield.¹²

State Laws Against Demanding Account Access

More than two dozen states have enacted laws that prevent employers from reaching into an applicant’s personal social media accounts. These statutes generally prohibit three things:

Asking for usernames, passwords, or any other authentication information for personal accounts.
Requiring someone to log into an account and navigate it while a company representative watches, sometimes called “shoulder surfing.”
Requiring applicants or employees to add the employer, a supervisor, or any company representative as a contact or “friend” on personal accounts.

These protections typically extend to both applicants and current employees, and violations can result in civil lawsuits or fines from state labor agencies. Specific penalties and scope vary by jurisdiction, so employers operating across state lines need to follow the most restrictive set of rules that applies to their workforce. Some of these laws also cover educational institutions screening students, not just employer-employee relationships.

Rejecting Someone Based on What the Search Found

When a social media background check turns up something that might disqualify an applicant, the employer cannot simply reject them and move on. The FCRA mandates a two-step adverse action process whenever a decision is based even partly on a consumer report.

Before making a final decision, the employer must provide the applicant with a copy of the consumer report and a written summary of their rights under the FCRA.³ The purpose is to give the person a real chance to review what was found, correct any errors, and provide context. The FCRA does not specify an exact number of days between this pre-adverse notice and the final decision, but the FTC has indicated that at least five business days is a reasonable waiting period. Rushing this step, or skipping it, is one of the most common compliance failures.

If the employer decides to proceed with the rejection after the waiting period, the final notice must include several specific items: notice that adverse action has been taken; the name, address, and phone number of the consumer reporting agency that furnished the report; a statement that the agency did not make the decision and cannot explain the reasons behind it; and notice that the applicant has the right to obtain a free copy of their report within 60 days and to dispute any inaccurate information.¹³ Every element is separately required. Missing any single item is a violation.

What Noncompliance Costs

Financial exposure for getting a social media screening wrong spans several federal statutes, and the penalties stack. An employer can face FCRA liability, discrimination damages, and NLRA complaints from the same screening decision.

FCRA willful violations: statutory damages of $100 to $1,000 per affected person, plus actual damages, punitive damages, and attorney’s fees.⁴
FCRA negligent violations: actual damages plus attorney’s fees and court costs.⁵
Title VII and GINA discrimination: compensatory and punitive damages capped at $50,000 for employers with 15 to 100 employees, $100,000 for 101 to 200, $200,000 for 201 to 500, and $300,000 for more than 500 employees, plus back pay, reinstatement, and attorney’s fees with no cap.¹⁴
ADA violations: same damages framework as Title VII, with additional requirements to keep any medical information discovered during hiring strictly confidential.⁷
NLRA violations: the NLRB can order reinstatement, back pay, and require the employer to post notices acknowledging the violation.
State law violations: civil lawsuits and administrative fines for demanding login credentials or forcing account access, with penalties varying by state.

These categories are independent. An employer who skips the FCRA disclosure, uses protected health information from a profile to reject an applicant, and also penalizes a post about working conditions has triggered at least three separate federal violations from one screening decision. The per-person statutory damages under the FCRA can look modest in isolation, but in a class action involving hundreds or thousands of applicants who received defective disclosures, the math gets serious fast.

1
Federal Trade Commission. The Fair Credit Reporting Act and Social Media – What Businesses Should Know
2
Office of the Law Revision Counsel. 15 USC 1681 – Congressional Findings and Statement of Purpose
3
Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports
4
Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance
5
Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance
6
Supreme Court of the United States. Bostock v Clayton County
7
U.S. Equal Employment Opportunity Commission. Job Applicants and the ADA
8
U.S. Equal Employment Opportunity Commission. Social Media Is Part of Todays Workplace but Its Use May Raise Employment Discrimination Concerns
9
Office of the Law Revision Counsel. 42 USC 2000ff-1 – Employer Practices
10
U.S. Equal Employment Opportunity Commission. Questions and Answers for Small Businesses – EEOC Final Rule on Title II of the Genetic Information Nondiscrimination Act of 2008
11
Office of the Law Revision Counsel. 29 USC 157 – Right of Employees as to Organization, Collective Bargaining, Etc
12
National Labor Relations Board. Social Media
13
Office of the Law Revision Counsel. 15 USC 1681m – Duties of Users Taking Adverse Actions on the Basis of Information Contained in Consumer Reports
14
Office of the Law Revision Counsel. 42 USC 1981a – Damages in Cases of Intentional Discrimination in Employment