What the FCRA actually requires
The Fair Credit Reporting Act governs any employer who uses a third party — a “consumer reporting agency” in the statute's language — to run a background check for employment purposes. Before you can order the report, you need a clear, standalone written disclosure telling the person a background check may be obtained, and their signed authorization. Standalone is doing real work in that sentence: since a 2012 clarification, the disclosure can't be buried in a job application or bundled with a liability waiver. It has to be its own document, saying only that.
Skip that step and the report is unauthorized under federal law, regardless of what the report finds or how the employer intended to use it.
The exceptions people overstate
The FCRA only covers reports assembled by a consumer reporting agency. That leaves real gaps that people sometimes stretch further than they actually reach:
- Informal reference checks.An employer personally calling a candidate's listed references and asking about their work isn't a consumer report, and doesn't trigger FCRA consent. The line is who's doing the checking — the moment a third-party company is paid to compile the information, it's covered again.
- Public record searches an employer runs itself. Googling someone, checking a public court docket directly, or reviewing their public social media isn't FCRA-covered either. It can still run into other legal problems — state privacy law, and the risk of learning something (age, disability, pregnancy) that turns a later rejection into a discrimination claim — but consent specifically isn't the FCRA issue there.
- Internal investigations of suspected misconduct. There's a narrower FCRA carve-out for investigations of existing employee misconduct that doesn't require the same upfront disclosure — but it's specific to investigating a current employee, not a general workaround for skipping consent on new hires.
The exception that isn't
Public records ≠ FCRA-free hiring check
Running your own public-records search avoids FCRA consent requirements, but not state consent or notice laws, and not the discrimination exposure of learning something you weren't supposed to ask about. It's a narrower loophole than it sounds.
State law can require more, never less
Several states layer their own consent and disclosure rules on top of the federal floor — separate authorization language, specific notice timing, or restrictions on what can even be asked before a conditional offer. The FCRA sets the federal minimum; it doesn't preempt a state requiring more. Check your state's specific rule before assuming the federal form covers you everywhere you hire.
What happens if you skip it
The FCRA carries a private right of action, meaning the candidate can sue directly rather than only relying on a regulator to act, and statutory damages apply even without proof of actual financial harm. Willful violations carry meaningfully higher exposure than negligent ones. This is also exactly the gap that built-in compliance workflows exist to close — GoodHire and Certn both bundle the disclosure, authorization, and adverse-action steps into the ordering flow specifically because DIY consent handling is where employers get sued.
Once consent is handled correctly, the practical questions become what actually shows up on the report and how long it takes to come back. None of this is legal advice — state consent requirements vary enough that an employment attorney is worth the call before you build a hiring process around any of it.