Running Background Checks on Job Candidates: What's Legal and What Isn't

A hiring manager finds a decade-old misdemeanor on a candidate's record and rejects the application on the spot, not realizing the jurisdiction requires an individualized assessment before that record can be used to deny employment. Another business skips background checks entirely to avoid the hassle, then faces a negligent hiring claim after an employee with a relevant undisclosed history harms a customer. Background checks sit at an uncomfortable intersection of legal risk on both sides — running them wrong and not running them at all can each create real liability.

The Fair Credit Reporting Act sets the baseline

Any time a business uses a third-party company to run a background check, the Fair Credit Reporting Act governs the process, regardless of the business's size or industry. Before ordering a report, the applicant must receive clear written disclosure that a background check will be performed, separate from the job application itself, and must give written authorization. Skipping this disclosure step, or burying it in fine print among other application paperwork, is one of the most common and most litigated FCRA violations small employers commit.

The adverse action process nobody expects to need

If information in a background check leads a business to decide not to hire someone, the FCRA requires a specific two-step notice process before the decision is finalized: a pre-adverse action notice that includes a copy of the report and gives the candidate a chance to dispute inaccurate information, followed by a final adverse action notice after a reasonable waiting period. Businesses that reject a candidate and move on immediately, without this notice-and-wait period, are exposed to FCRA claims even if the underlying decision not to hire was entirely reasonable. The process exists specifically to catch reporting errors before they cost someone a job.

Ban-the-box and criminal history timing rules

A growing number of states and cities have "ban-the-box" laws that restrict when in the hiring process a business can ask about criminal history, typically requiring that the question wait until after a conditional job offer has been extended. Some jurisdictions go further, requiring an individualized assessment of a criminal record's relevance to the specific job — considering the nature of the offense, how much time has passed, and the job's actual duties — rather than a blanket policy of rejecting any applicant with a record. A business hiring across multiple states needs to know these rules vary significantly by location rather than assuming one national standard applies.

Credit checks carry their own separate restrictions

Several states and cities prohibit or sharply limit the use of credit history in hiring decisions except for specific roles, typically those involving financial responsibility or access to sensitive financial systems. Even where credit checks are legally permitted, using credit history for a role where it has no plausible connection to job performance is the kind of practice that draws regulatory attention and looks difficult to defend if challenged. Limiting credit checks to roles where the connection is genuinely job-relevant is both the more defensible and the more sensible policy.

Social media screening sits in a legal gray area

Reviewing a candidate's public social media presence isn't directly regulated the way formal background checks are, but it introduces its own risk: a hiring manager who sees a candidate's protected characteristics through their social media profile and then rejects them creates a plausible discrimination claim, even if the rejection was actually based on legitimate concerns. Businesses that do informal social media screening are generally better protected by having someone other than the final decision-maker conduct that review and report back only job-relevant findings, keeping protected-characteristic information out of the hiring manager's hands entirely.

Building a consistent policy instead of ad hoc decisions

Running background checks on some candidates but not others, or applying different standards depending on who's reviewing the results, is exactly the kind of inconsistency that turns a routine hiring decision into a discrimination claim. A written policy specifying which roles require which types of checks, and what disqualifies a candidate versus what triggers further review, gives hiring managers a consistent standard to apply and gives the business a defensible record if a decision is ever challenged. The policy is only useful if it's actually followed the same way every time, which is often the harder part in practice.

Working with a reputable background check vendor

Not all background check companies operate with the same rigor, and using a vendor that returns inaccurate or outdated information creates liability for the business even though the error originated with the vendor. A background check company that is itself a consumer reporting agency under the FCRA, with a track record of accuracy and a clear dispute process, is worth the modest premium over the cheapest option available. This is one area where the lowest-cost vendor is rarely the right choice once the legal exposure of a bad report is factored in.

Background checks are a legitimate and often necessary part of hiring, but the legal framework around them is more layered than most small business owners expect going in. Getting the disclosure, authorization, and adverse action process right protects the business just as much as it protects the candidate — and getting it wrong is one of the more avoidable ways a routine hire turns into a legal problem.

Comments