Running Background Checks Without Consent for Employers

Quick answer and what it means for employers

Short answer: No — you may not run a CRA-based background check without written consent. Practically this means:

• Any time you order a consumer report (criminal history, credit, tenant screening, employment verification through a CRA), provide a clear, standalone disclosure and obtain signed consent first. Don’t hide it inside an application or a page of terms.
• Make consent an explicit step in your applicant workflow, not legal boilerplate.
• If you plan to take adverse action based on the report, follow the FCRA’s pre-adverse and adverse-action steps (copy of the report, Summary of Rights, opportunity to respond).

For granular guidance on drafting a compliant disclosure, see our Background Check Disclosure Forms: Avoid FCRA Mistakes.

When consent is legally required (FCRA baseline)

FCRA baseline rules every employer must follow:

• Before obtaining a consumer report from a CRA, provide a standalone, clear written disclosure that a report may be obtained for employment purposes and obtain written authorization. The FTC and other federal guidance require that the disclosure not be hidden in an application or bundled with other waivers.
• Consent must be unambiguous. Electronic consent (click-to-sign) is acceptable if presented separately and the method captures and stores the signed authorization.

H2 reminder: your obligation is triggered when you use a consumer reporting agency. If you obtain public records directly (county clerk, state registry) you aren’t ordering a CRA “consumer report,” but those records still must be used in compliance with state law and EEOC guidance.

What counts as a “consumer reporting agency” and “consumer report”

• Consumer reporting agency (CRA): any person or business that assembles or evaluates consumer information and sells it to third parties for employment, credit, insurance, or other purposes. Examples: background-screening companies that package criminal records, credit reporting bureaus, tenant-screening firms.
• Consumer report: any written, oral, or other communication of information bearing on a consumer’s character, general reputation, personal characteristics, or mode of living used for employment decisions — including criminal-history reports, credit reports for employment, and employment-verification packages produced by a CRA.

If your vendor pulls county court records and packages them into a single report for you, that’s a consumer report and triggers the FCRA.

Investigative consumer reports — extra disclosures and consent

Investigative consumer reports are based on personal interviews about a person’s character, reputation, or lifestyle (for example, calling neighbors or colleagues). They require additional transparency:

• Disclose that the report may include information obtained through personal interviews and obtain separate authorization for an investigative consumer report.
• Tell the consumer the nature and scope of the investigation — who may be contacted and the purpose.
• State law or vendor contract may require additional notice.

Investigative reports collect non-public, qualitative information and therefore carry higher disclosure burdens. Include the investigative disclosure with your general FCRA disclosure and get explicit consent.

Adverse action process — steps employers must follow if they act on a report

If you rely on a consumer report to take adverse action (deny hiring, rescind an offer, demote, terminate), follow these steps:

1. Pre-adverse action:
   • Provide the applicant/employee a copy of the consumer report used.
   • Provide a current copy of “A Summary of Your Rights Under the Fair Credit Reporting Act” (FTC).
   • Tell the person the action you’re considering is based in whole or in part on that report and give them a reasonable opportunity to dispute inaccuracies or explain background circumstances.
2. Final adverse action:
   • If you decide to take adverse action after any waiting period, provide a final adverse-action notice that includes:
     • A statement that the CRA did not make the adverse decision and can’t give reasons.
     • The CRA’s name, address, and phone number.
     • A notice that the individual has the right to obtain a free consumer report within 60 days from the CRA.
     • A notice of the consumer’s right to dispute information directly with the CRA.

The FTC requires the report copy and the Summary of Rights be provided before the final decision. Many employers give at least five business days between pre-adverse notice and action so the individual has time to respond; the FCRA does not set a fixed minimum.

For exact mechanics and form language, see our Adverse Action Process for Employers Pre to Final and the FCRA 613-letter guidance at 613 Letter FCRA Notice Requirements for Employers.

613 notice / FCRA notice requirements

The “613 notice” commonly refers to the requirement to provide the Summary of Rights and a copy of the report prior to adverse action. Your pre-adverse packet should include:

• Copy of the consumer report
• A “Summary of Rights Under the FCRA” (FTC)
• Clear language telling the individual what step you’re contemplating and how to respond

Document delivery method (email with PDF, tracked mail, or in-person handoff) matters — keep proof of delivery.

State and local rules that add restrictions (what to watch for)

Beyond the FCRA, many state and local laws add limits. Main categories:

• Ban-the-box laws: restrict when you can ask about criminal convictions (commonly until after a first interview, job offer, or conditional offer).
• Seven-year reporting limits: some states limit reporting of arrest or conviction information older than seven years in certain contexts.
• Local consent/disclosure requirements: a few jurisdictions require extra language or timing.

Example: hiring a delivery driver in Ohio while placing ads in Chicago. Chicago has local ordinances limiting when you can inquire about criminal history — your standard form could be illegal there. Build a jurisdiction checklist. Justia’s summaries are a good starting point.

How to build a jurisdiction checklist

Practical approach:

• Maintain a spreadsheet with: jurisdiction, ban-the-box timing, 7-year limits (yes/no), credit-report rules, specific wording or notice requirements, effective date, last reviewed date.
• Assign an owner (HR or compliance) and review quarterly.
• Flag hard stops (e.g., local ordinances that prohibit asking about convictions before offer) so your ATS can skip criminal-history questions until the correct stage.

What employers can access without consent — public records and verification

You may access public records directly (court dockets, county clerks, motor vehicle records) without CRA consent. But:

• If you harvest public records and have a third party compile and interpret them into a report you rely on for employment decisions, that counts as a consumer report under the FCRA.
• Use of public-record information must still comply with EEOC guidance — avoid blanket exclusions that disparately impact protected classes.
• Direct verification calls (employment verification, reference checks) do not require FCRA consent unless the verifier is a CRA preparing a consumer report.

Refer to EEOC guidance when you build policies that use public records.

Credit reports and special categories

Any credit report used for employment requires written consent under the FCRA. Some states further restrict employer use of credit information. If you screen on credit for positions of financial trust, document the job-related necessity and get written authorization every time.

Industry- and role-specific rules (DOT, healthcare, others)

• DOT: drivers regulated by the Department of Transportation have specific prescreening and record-check requirements, drug and alcohol testing protocols, and driver-history requirements.
• Healthcare: background checks may include checks against state nurse/physician discipline lists; HIPAA applies if you handle protected health information during screening.
• Financial services, childcare, eldercare: often have heightened state licensing checks and statutory screening timelines.

Check industry-specific rules before you deviate from standard FCRA processes. Justia and DOT guidance are useful reference points.

Consequences of non-compliance — legal and financial risks

If you skip FCRA steps, you risk:

• Civil liability under the FCRA, including statutory and actual damages and attorneys’ fees.
• Private lawsuits and class actions that can be expensive even where damages per plaintiff are small.
• EEOC enforcement or litigation for disparate impact.
• Reputational harm and hiring delays while you remediate policy and training failures.

Document compliance steps to reduce risk and exposure.

Practical compliance checklist for HR and recruiters

Use this sequence when you plan to screen:

1. Determine whether the check will be a consumer report from a CRA.
2. If yes: prepare a standalone disclosure and obtain written consent (email/e-sign record kept).
3. Note jurisdiction-specific restrictions (ban-the-box, 7-year limits) before presenting criminal-history questions.
4. Order the report through a compliant CRA.
5. If information triggers potential adverse action, provide pre-adverse packet: report copy + FTC Summary + clear note of contemplated action; allow a reasonable response period (commonly 3–7 business days).
6. After the response period, decide. If adverse action: provide final adverse-action notice with CRA contact details and rights.
7. Log all steps and keep documentation per your retention policy.
8. Securely dispose of consumer information per the FCRA Disposal Rule when retention ends.

In-house vs. CRA:

• In-house: more control, higher internal burden, risk of inconsistent investigative practice; still must comply with EEOC.
• CRA: standardized reports and FCRA compliance support, easier audit trails; vendor management is required.

For guidance on outsourcing and selecting vendors, see FCRA Background Check Requirements for Employers 2026.

Sample language and timing (copy-ready snippets)

Standalone disclosure (one sentence):

• “We may obtain a consumer report for employment purposes. By signing below, you authorize [Company Name] to obtain the report.”

Consent checkbox wording:

• “I authorize [Company Name] to obtain a consumer report for employment purposes. I have received a copy of the consumer disclosure.”

Investigative consumer report disclosure:

• “You may be subject to an investigative consumer report that includes information obtained through personal interviews regarding your character, reputation, and lifestyle. By signing you authorize this investigation.”

Pre-adverse notice (short):

• “We may withdraw our employment offer based on information in the attached consumer report prepared by [CRA name]. Enclosed is a copy of the report and a copy of ‘A Summary of Your Rights Under the Fair Credit Reporting Act.’ You may dispute inaccurate information with the CRA or provide additional information to us. Please respond within five business days if you believe the information is incorrect.”

Final-adverse notice (short):

• “We are withdrawing our employment offer. This decision was based in whole or in part on information in a consumer report prepared by [CRA name] (contact: [address, phone]). The CRA did not make this decision and cannot provide reasons. You may request a free copy of your report from the CRA within 60 days and dispute with the CRA.”

Keep these templates in your ATS and vendor portal and log dates and delivery receipts.

Record retention and disposal requirements

FCRA’s Disposal Rule requires reasonable measures to protect consumer information from unauthorized access — destroy or render unreadable paper and electronic records when no longer needed. Practical controls:

• Retain adverse-action packets and associated reports for at least two years (industry standard to defend claims). Consult counsel for your jurisdiction.
• Keep proof of consent and delivery (email logs, signed forms) for the same period.
• Use shredding for paper and secure wiping for electronic files. Limit access to HR staff only.
• Maintain a disposal log showing date, method, and responsible party.

For legal specifics and model disposal steps, review FCRA Disposal Rule summaries and our compliance resources.

How to implement this in your HR workflow (tools and outsourcing)

Two options:

• In-house: Train HR, build standalone disclosures into your ATS, manually order public records or verifications, and maintain documentation. Pros: control, lower per-report cost at low volume. Cons: higher compliance risk and inconsistent recordkeeping.
• Outsource to a CRA: Use vetted vendors with FCRA-compliant processes, prebuilt disclosures, and adverse-action templates. Pros: standardized reporting and faster turnaround. Cons: vendor management and per-report fees.

For most employers, using a CRA reduces the chance of skipping FCRA steps and provides documented workflows for adverse action. If you keep screening in-house, invest in training, audited checklists, and periodic compliance audits.

See more on outsourcing and vendor selection in FCRA Background Check Requirements for Employers 2026.

Next steps and resources

Action items for HR leaders:

• Update your application and ATS to include a standalone disclosure and consent step.
• Train hiring managers on ban-the-box timing and adverse-action steps.
• Build and maintain a jurisdiction rules matrix and review quarterly.
• Standardize pre-adverse and final-adverse templates and log all communications.
• Consult employment counsel for complex, multi-state, or industry-regulated roles.

Authoritative resources:
Federal Trade Commission (FTC) — consumer.ftc.gov (FCRA requirements and Summary of Rights); Equal Employment Opportunity Commission (EEOC) — eeoc.gov (discrimination guidance); Justia and state government sites for local law summaries.

If you want a sample disclosure form and adverse-action templates ready to drop into your ATS, our Background Check Disclosure Forms: Avoid FCRA Mistakes and 613 Letter FCRA Notice Requirements for Employers pages include copy-ready downloads.

FAQ

Q: Is it legal for an employer to run a background check without my permission?

A: Not if the check is a consumer report from a CRA. The FCRA requires a clear, standalone disclosure and written consent before ordering such a report.

Q: What are the requirements for employer background checks in the U.S.?

A: At a minimum: provide a standalone written disclosure, obtain written consent, and follow pre-adverse and adverse-action steps if you rely on the report. Also follow state/local rules and EEOC guidance.

Q: Do employers need consent to check criminal records?

A: If the criminal-history check is obtained through a CRA, yes — you need written consent. Direct searches of public court records do not require CRA consent, but using a CRA to compile and deliver that data does.

Q: What is the Fair Credit Reporting Act and how does it relate to background checks?

A: The FCRA governs consumer reports used for employment decisions. It requires disclosure, authorization, accuracy, and specific adverse-action procedures when a CRA is involved.

Q: Can an employer conduct a background check after hiring an employee?

A: Yes — you can conduct post-hire checks, but the FCRA still applies if you use a CRA. Provide a standalone disclosure and written consent before ordering any CRA-based report.

Conclusion

You can’t run a CRA-based background check without consent. Build that rule into your workflow: standalone disclosure, recorded consent, CRA order, pre-adverse packet if needed, then final adverse notice and secure recordkeeping. If you want help turning this checklist into ATS-ready forms and templates, Express Background Checks offers compliant screening workflows and document templates to keep hiring fast and defensible.