When an employer uses a third-party company to run a background check, that background check is a “consumer report” under federal law, and the company providing it is a “consumer reporting agency.” The Fair Credit Reporting Act, enacted in 1970 and amended many times since, governs how that information is collected, reported, and used.
The FCRA is not a technicality layer on top of hiring. It is the framework the entire background screening process operates inside, and both employers and screening providers have distinct obligations under it. Understanding the basics helps employers avoid the most common and most litigated mistakes.
Disclosure and authorization come first
Before a background check is run for employment purposes, the FCRA requires two things: a clear and conspicuous disclosure to the candidate, in a document that consists solely of the disclosure, and the candidate's written authorization.
The standalone requirement trips up more employers than almost any other provision. Disclosure language buried inside an application, or combined with liability waivers and other extraneous text, has generated years of class-action litigation. The safest practice is a clean, separate disclosure document paired with a clear authorization.
The adverse action process is a sequence, not a letter
If information in a background report may lead an employer to decline, suspend, or terminate a candidate or employee, the FCRA requires a multi-step process. Before the decision is final, the employer must provide a pre-adverse action notice, a copy of the report itself, and the CFPB's “Summary of Your Rights Under the FCRA.”
The purpose of that pause is meaningful: reports can contain errors, and candidates must have a genuine opportunity to review and dispute the information before it costs them a job. Only after a reasonable waiting period should the employer send a final adverse action notice, which carries its own required content, including the CRA's contact information and a statement that the CRA did not make the hiring decision.
Accuracy obligations sit with the CRA
Consumer reporting agencies must follow reasonable procedures to assure maximum possible accuracy of the information they report. Consumers have the right to dispute inaccurate or incomplete information, and the CRA must reinvestigate, generally within 30 days, and correct or delete information that cannot be verified.
What counts as a “reasonable procedure” is often the central question in FCRA litigation, which is why documented, tested, consistently applied procedures matter so much on the operations side of a screening company.
State and local laws add another layer
The FCRA is the floor, not the ceiling. Fair chance and ban-the-box laws, lookback-period limits, and jurisdiction-specific notice requirements layer additional obligations on top of the federal baseline, and they vary significantly by state and city. A compliant program accounts for every jurisdiction in play: where the employer sits, where the candidate sits, and where the work will be performed.
The through-line of all of it is simple: background screening affects people's livelihoods, and the law expects the process to be accurate, transparent, and fair. Employers that build their programs around those principles, and partner with screening providers that do the same, are the ones that stay out of trouble.