Background Check Laws: FCRA, State Rules And Employer Compliance

A background check can help you make a safer hiring decision. But it can also create legal trouble when the process is handled incorrectly. Background check laws control what employers can review, when they can request information, and how that information can affect an employment decision.

The rules come from more than one place. The Fair Credit Reporting Act sets federal requirements when an employer gets a background report from a consumer reporting agency. Federal discrimination laws also affect how criminal records and other background information are used. State and local laws may add even stricter rules.

So, what does your company need to follow? This guide explains federal and state rules, criminal history checks, consent, adverse action, and the steps employers should take to keep the hiring process compliant.

Automate payroll, leave, hiring, and employee management with one simple platform.

Get Started

What Are Background Check Laws?

Background check laws are federal, state, and local rules that control how employers collect and use a person’s background information for employment purposes. A background check may cover criminal records, past employment, education, credit history, and other public information. Federal anti-discrimination laws also affect how employers use that information when making an employment decision.

The Fair Credit Reporting Act adds specific requirements when an employer gets a background report from a consumer reporting agency. For example, the employer generally needs written permission before requesting the report.

State and local background check laws can add stricter rules, especially for criminal history and credit checks. Employers should therefore check the laws that apply to each job and location before they run a background check.

What Federal Background Check Laws Apply To Employers?

Federal background check laws set rules for how employers collect and use information during the hiring process. The main requirements come from the Fair Credit Reporting Act and federal anti-discrimination laws enforced by the Equal Employment Opportunity Commission. Medical and genetic information also receive specific protection.

Fair Credit Reporting Act

The Fair Credit Reporting Act applies when an employer gets a background report from a consumer reporting agency for employment purposes. Before the check, the employer must provide a clear written disclosure and get written permission from the applicant or employee. The employer must also certify its compliance to the reporting company.

If the background report could lead to an adverse action, such as denying employment, the employer must first provide a pre-adverse action notice, a copy of the report, and a Summary of Your Rights under the FCRA. After the final decision, an adverse action notice is required. The person also has the right to dispute inaccurate information and request an additional free report within 60 days.

Title VII And EEOC

Title VII affects how employers use background information in an employment decision. The Equal Employment Opportunity Commission makes clear that employers must apply their screening standards consistently. A company cannot perform background checks differently because of race, color, religion, sex, or national origin. Other federal laws protect against discrimination based on disability, genetic information, and age.

Criminal history policies also need careful review. A policy that excludes applicants with certain criminal records may create discrimination concerns if it disproportionately affects a protected group and does not properly predict who can perform the job safely or responsibly. Employers should focus on relevant, job-related factors rather than use criminal convictions as an automatic reason for rejection.

ADA And Medical Information

The Americans with Disabilities Act limits when an employer can request medical information. Before a conditional job offer, an employer generally cannot ask disability-related questions or require a medical examination. After a conditional offer, medical questions or examinations may be allowed if the employer applies the same process to all entering employees in the same job category.

After employment begins, medical inquiries or examinations generally must be job-related and consistent with business necessity. Medical information obtained by the employer must also be kept confidential and maintained separately from regular personnel records.

GINA And Genetic Information

The Genetic Information Nondiscrimination Act, or GINA, protects applicants and employees from employment discrimination based on genetic information. Genetic information includes genetic test results and family medical history. Employers cannot use that information to make decisions about hiring, firing, promotion, pay, or other terms of employment.

GINA also generally prohibits employers from requesting, requiring, or purchasing genetic information. Only narrow exceptions apply. If genetic information is obtained lawfully or accidentally, the employer must generally keep it confidential.

Industry-Specific Requirements

Some jobs are subject to additional federal or state regulations that require specific background checks. Requirements can depend on the occupation, employer, industry, and type of work involved. An employer should therefore identify any job-specific screening requirements before deciding what a standard background check should include.

A mandatory check does not automatically replace other employer obligations. When a consumer reporting agency provides the background report, applicable FCRA requirements still need attention. Federal anti-discrimination laws also remain relevant when employers review background information and make an employment decision.

What Can Employers Check?

Employers can check several types of background information when it is relevant to the job and allowed by law. Common employment background checks cover criminal records, past employment, education, credit history, driving records, and public social media activity. Medical and genetic information face much stricter federal limits.

The rules also depend on how the information is obtained. If a consumer reporting agency provides a background report for employment purposes, the Fair Credit Reporting Act applies. State and local background check laws may place additional restrictions on what employers can request or use.

Criminal Background Checks

A criminal background check may search court records and other government sources for a person's criminal history. Depending on the search and applicable law, a report may contain criminal convictions, pending cases, or other public criminal records. Federal court records can also reveal convictions for federal crimes.

Employers need to distinguish between finding a criminal record and using it in an employment decision. An arrest alone does not prove criminal conduct. Sealed records, expunged records, reporting restrictions, and fair chance rules can also affect what information is available or usable. State law may impose stricter requirements than federal law.

Employment And Education

Employers can verify past employment and education to check whether applicants provided accurate information. A background check may confirm previous employers, work history, schools, degrees, professional credentials, and other qualifications related to the job.

The Fair Credit Reporting Act applies when a consumer reporting agency provides such information in a consumer report. The employer must follow the required disclosure and permission rules before requesting the report. FCRA requirements can apply to hiring as well as employment decisions involving retention, promotion, or reassignment.

Credit And Financial History

Employers may check credit history and other financial information when permitted by law. Credit reports can become relevant when a job involves financial responsibilities, access to money, or other specific reasons tied to the position.

Federal law is not the only consideration. Some states restrict the use of consumer reports, particularly credit reports, for employment purposes. Employers should check applicable state and local rules before including financial history in a background check. A credit report obtained through a consumer reporting agency is also subject to the FCRA.

Driving And Public Records

Driving records may be checked when driving is relevant to the job. An employer hiring a delivery driver, for example, may have a clear reason to review the applicant's driving history. Public-record searches may also reveal licenses, criminal records, and other information relevant to employment.

Job relevance still matters. Employers should define which records are necessary for each position instead of collecting information without a clear employment purpose. Federal, state, and local regulations may also limit how particular records can affect the final decision.

Social Media And Online Activity

Employers may review publicly available social media and online activity. Such a search can reveal information about a person's public posts or online conduct. However, employers cannot use information about protected characteristics to discriminate against applicants or employees.

The process changes when a third-party company conducts the social media search. If a consumer reporting agency provides social media information as part of a background report, FCRA rules apply. The reporting company must also take reasonable steps to ensure the information is accurate and belongs to the correct person.

A background check can reveal information that an employer may not be allowed to use. Employers should review the applicable federal laws, state law, and local rules before allowing background information to influence a hiring or other employment decision.

How Do State And Local Background Check Laws Differ?

State and local background check laws can impose stricter rules than federal laws. The requirements vary by location and can affect when an employer may ask about criminal history, which criminal records can be considered, and whether credit history can influence hiring.

Employers should check both state law and local regulations before they run background checks. A process that follows the Fair Credit Reporting Act may still violate a state or city rule. The EEOC and Federal Trade Commission also advise employers to review applicable state and municipal requirements when using background information for employment purposes.

Ban-The-Box Laws

Ban-the-box laws restrict when employers can ask applicants about criminal history. The goal is to let potential employees compete based on their qualifications before criminal records become part of the hiring process.

The exact rules vary. Some laws apply only to government employers, while others cover private companies. The point when an employer may ask about convictions can also differ by jurisdiction.

California provides a clear example. Its Fair Chance Act generally prevents covered employers from asking about conviction history before making a conditional job offer. Certain positions and employers are exempt, including some jobs where a criminal background check is required by law.

Fair-Chance Hiring Laws

Fair-chance laws can go further than removing a criminal history question from a job application. They may regulate how an employer reviews criminal convictions and what steps must happen before the employer decides to withdraw an offer.

California's Fair Chance Act requires covered employers to conduct an individualized assessment before rejecting an applicant because of conviction history. The assessment considers the nature and gravity of the conduct, the time that has passed, and the nature of the job. Applicants must also have an opportunity to provide evidence or challenge information before the final decision.

Fair-chance requirements differ by location, so employers should not use one hiring process everywhere without checking the applicable rules.

Criminal Record Limits

State laws can restrict which criminal records employers may receive or consider. Limits may apply to arrests, misdemeanor convictions, sealed records, expunged records, or older convictions. Some jurisdictions also impose lookback periods that restrict reporting or use of certain records after a set number of years.

California, for example, generally prevents covered employers from considering arrests that did not result in conviction and convictions that were sealed, dismissed, expunged, or statutorily eradicated.

Employers should therefore check the specific law before treating any criminal history found in a background report as usable. A record that appears in a search may still be restricted for employment purposes.

Credit Check Restrictions

State and local laws can also limit the use of credit history during employment background checks. Such restrictions are especially important when financial history has little connection to the responsibilities of the job.

An employer should first determine whether the applicable law permits an employment credit check and whether an exception applies to the position. Roles involving significant financial responsibilities may receive different treatment under some state laws.

The Fair Credit Reporting Act still applies when a consumer reporting agency provides a credit report for employment purposes. State and local regulations can add requirements on top of those federal rules, including how you coordinate related processes such as leave management systems for HR teams to maintain consistent employee treatment.

Clean Slate Laws

Clean Slate laws can automatically seal or clear eligible criminal records after statutory requirements are met. Unlike traditional record-clearing processes, an eligible person may not need to file an individual petition. Eligibility, waiting periods, covered offenses, and exceptions vary by state.

The number of states with automatic record-clearing provisions has grown. NCSL reports that 26 states and Puerto Rico now have at least one statutory automatic record-clearing provision, while several states have enacted automated systems commonly described as Clean Slate laws.

Clean Slate laws matter to employers because criminal records that were previously available may later become sealed or otherwise restricted. Employers should use current background information and avoid relying on outdated criminal history that state law no longer permits them to consider.

How To Run A Legally Compliant Background Check

A compliant background check follows a clear process before and after an employer receives a background report. When a consumer reporting agency provides the report for employment purposes, the Fair Credit Reporting Act sets specific requirements. State and local background check laws may add more rules, so employers should check the requirements for the job location before they start.

Define The Screening Scope

Start by deciding what information is necessary for the job. A criminal background check may make sense for one position, while driving records, education, past employment, or credit history may matter for another.

Use the same standards for applicants competing for similar jobs. Screening criteria should relate to actual duties and risks rather than collect unnecessary personal information. Criminal history policies also need care. The Equal Employment Opportunity Commission recommends a targeted approach that considers the nature of the offense, the time passed, and the nature of the job.

State law may impose additional restrictions, so confirm what information can be requested and when.

Provide Proper Disclosure

Before requesting a background report from a consumer reporting agency, tell the applicant or employee that the information may be used for an employment decision. The FCRA requires a clear written disclosure in a stand-alone format. It should not be buried inside the employment application.

Extra language should not distract from the disclosure. If the company requests an investigative consumer report based on personal interviews about character, reputation, or lifestyle, additional disclosure requirements apply. The person must be informed of their right to request details about the nature and scope of the investigation.

Obtain Written Authorization

The employer must get written permission before a consumer reporting agency provides a background report for employment purposes. Authorization may appear with the disclosure as long as the document meets FCRA requirements.

The employer must also certify certain information to the consumer reporting agency. That includes confirming that the applicant was notified, permission was obtained, FCRA requirements will be followed, and the information will not be misused in violation of equal employment laws.

If authorization will cover future background reports during employment, the document should state that clearly.

Review Screening Results

A background report should not turn every negative record into an automatic rejection. First, check whether the information is accurate, relevant to the job, and legally usable. Apply the same review standards to people in comparable positions.

Criminal records need particular care. An arrest does not prove that a person committed a crime. Criminal convictions may carry more weight, but the EEOC recommends considering the nature and seriousness of the offense, the time passed, and the nature of the job.

State and local fair chance rules may require additional review before the employer decides to withdraw a conditional offer.

Complete Adverse Action

If an employer may reject an applicant based on a consumer report, the FCRA requires a pre-adverse action step first. The employer must provide the person with a copy of the background report and a copy of A Summary of Your Rights Under the Fair Credit Reporting Act. That gives the person an opportunity to review the information and address possible errors before the final decision.

If the employer decides to proceed with the adverse action, it must provide an adverse action notice. The notice must identify the consumer reporting agency, explain that the agency did not make the employment decision, and tell the person about their right to dispute the report and obtain an additional free report within 60 days.

Compliant background check process:

Define job-related scope → Check applicable laws → Provide disclosure → Get written authorization → Certify compliance → Run the background check → Review results → Send pre-adverse action notice if needed → Allow report review or dispute → Make the final decision → Send adverse action notice if required

How Should Employers Handle Criminal Records?

Employers can consider criminal records in hiring, but a criminal history should not automatically disqualify an applicant. The Equal Employment Opportunity Commission recommends a targeted review that connects the record to the risks and responsibilities of the specific job. Employers should also apply the same standards consistently and check state and local background check laws for additional restrictions.

Distinguish Arrests And Convictions

Arrests and criminal convictions should not be treated the same way. An arrest means a person was suspected of an offense. It does not prove that criminal conduct occurred. An employer should not reject an applicant simply because an arrest appears in a background report.

A conviction usually provides stronger evidence that criminal conduct occurred. Even then, employers should check whether the record is accurate and current. Sealed records, expunged records, or incorrectly reported convictions may create problems. State law can impose further limits. California, for example, generally prohibits covered employers from considering arrests that did not result in conviction and certain sealed, dismissed, or expunged records.

Apply The Green Factors

The EEOC identifies three factors that help employers assess criminal history. Known as the Green factors, they consider:

• Nature and gravity of the offense: How serious was the conduct, and what harm did it cause?
• Time since the offense: How much time has passed since the conduct or completion of the sentence?
• Nature of the job: What duties, responsibilities, environment, and risks come with the position?

The factors help employers move away from blanket exclusions. A misdemeanor conviction from years ago may carry very different relevance from a recent serious conviction tied directly to the responsibilities of the job.

Assess Job Relevance

The employer should connect criminal history to the actual job before making an employment decision. Ask whether the specific conduct creates a reasonable concern based on the duties, work environment, level of supervision, access to property, or responsibilities of the position.

The EEOC advises employers to use targeted criminal record screens rather than policies that reject anyone with any conviction. The goal is to determine whether specific criminal conduct has a close connection to the risks of the job. Some federal or state laws may also prohibit people with particular convictions from holding certain regulated positions.

Make Individualized Assessments

An individualized assessment gives the applicant a chance to explain why a criminal record should not lead to exclusion. The employer can consider the circumstances surrounding the offense, number of convictions, employment history, rehabilitation, education or training, references, and evidence that the background report is inaccurate.

The EEOC notes that Title VII does not require an individualized assessment in every situation. However, it can help employers determine whether an exclusion is truly job-related and consistent with business necessity. State fair chance laws may impose stronger requirements. California's Fair Chance Act, for example, requires covered employers to conduct an individualized assessment before rescinding a conditional job offer based on conviction history.

Document The Decision

Employers should document how criminal history policies and employment decisions are made. Record the job requirements, relevant criminal conduct, screening criteria, Green factors considered, information provided by the applicant, and the reason for the final decision.

The EEOC recommends a narrowly tailored written policy for criminal background checks. It also recommends documenting the justification, research, and procedures behind that policy. Criminal history information should remain confidential and be used only for its intended employment purpose.

Clear documentation helps the company apply the same rules across applicants. It also creates a record of why a specific conviction was considered relevant to a particular job instead of relying on assumptions about people with criminal records.

How Can Employers Manage Background Check Compliance?

Background check compliance does not end after a hiring decision. Employers need consistent policies for every stage of the process, from choosing a background check to storing the final report. Federal laws provide the baseline, while state and local rules can add stricter requirements. Regular reviews help employers catch outdated forms, inconsistent screening, and changes in background check laws, especially when combined with broader HR workflow automation that standardizes how checks are requested and reviewed.

Check Work Location Laws

Check the laws that apply to the position before you run a background check. State and local regulations may control when an employer can ask about criminal history, how far criminal records can go back, and whether credit history can be considered.

Location matters even more when a company hires remote employees across several states. A standard company policy may meet federal requirements but conflict with a state or city fair chance rule. Employers should identify applicable laws for each work location and review any exceptions that apply to the specific job, and may benefit from HR and payroll software for SaaS and software businesses that centralizes multi-location rules.

Standardize Screening Policies

Create a written background screening policy that explains which checks apply to each type of job, including how you will handle issues like employee vs. contractor classification The policy should cover criminal background checks, employment verification, education, credit history, and other checks the company actually needs, and can be aligned with broader HR policy templates and HR workflow automation practices that govern hiring and employee management.

Avoid ordering comprehensive packages for every applicant when some information has no connection to the position, and instead use innovative HR software features to trigger only the background checks that match defined job profiles. Screening scope should reflect job duties and specific risks. Apply the same criteria to applicants competing for similar roles, and consider using AI resume screening software to standardize early-stage evaluations. The EEOC recommends narrowly tailored written policies for employers that consider criminal records.

Train Hiring Teams

HR staff, recruiters, and hiring managers should know what they can ask, when they can ask it, and how background information may affect an employment decision, and using HR software for small businesses can help embed compliant steps into everyday hiring workflows. Training should cover the Fair Credit Reporting Act, fair chance requirements, discrimination rules, and the company's screening policy, and can be supported by modern HR software for small and medium businesses that embeds compliant workflows.

Managers also need to understand that a criminal record does not always justify rejection. The EEOC specifically recommends training managers and hiring officials on Title VII and criminal history decisions. Clear training helps the company apply its rules consistently instead of leaving each employer decision to personal judgment.

Protect Screening Records

Background reports can contain sensitive personal information, including criminal history, financial history, addresses, and other identifying data, as well as time-off details stored in leave management software. Limit access to employees who need the information for legitimate employment purposes and align your approach with broader employee data protection in HR systems and a secure employee record management system.

Private employers covered by EEOC recordkeeping rules generally must preserve personnel and employment records for one year from the date the record was made or the personnel action occurred, whichever is later, and transitioning payroll from Excel to software can make it easier to maintain accurate, centralized records. Different retention periods apply in some circumstances. Records must also be kept longer when a discrimination charge is filed, and specific employee payroll records may be subject to additional retention rules, so partnering with a trustworthy HR management provider can support long-term compliance.

After applicable retention requirements are satisfied, dispose of consumer reports securely. Paper records can be shredded or otherwise destroyed. Information stored electronically should be erased or destroyed so it cannot be read or reconstructed.

Audit Compliance Regularly

Review the background check process on a regular schedule. Check disclosure and authorization forms, screening criteria, consumer reporting agency procedures, adverse action steps, record retention, and state-specific requirements, and confirm that your practices still align with current payroll compliance guidance for small businesses.

An audit should also compare current practices with changes in federal, state, and local law. Review whether hiring teams still use the approved screening policy and whether each background check remains necessary for the job.

Vendor use should be part of the review too. A consumer reporting agency can provide the background report, but the employer still has its own FCRA obligations, which can be supported by payroll compliance software that helps track legal requirements. The Federal Trade Commission requires employers using consumer reports to follow applicable disclosure, authorization, certification, and adverse action procedures.

Automate payroll, leave, hiring, and employee management with one simple platform.

Get Started

Final Thoughts

Background checks can support better hiring decisions, but employers need to follow the law at every step. The Fair Credit Reporting Act sets key requirements when a consumer reporting agency provides a background report. State and local background check laws may add stricter rules for criminal records, credit history, and fair chance hiring.

A consistent process matters just as much as the check itself. Get written permission when required, review information fairly, and follow the proper adverse action process before making a final decision. Criminal history should also be assessed for its relevance to the specific job rather than used as an automatic reason for rejection.

Regular policy reviews can help employers keep their hiring process fair, consistent, and compliant as regulations change.