Employment Background Check Questions

What employers can and cannot ask, what shows up on a pre-employment report, the EEOC and FCRA rules that govern both sides, and the 2025-2026 state-law shifts (ban-the-box, Clean Slate, marijuana, credit checks) that change the rules in real time.

Employment is the most heavily regulated use of background checks in the United States. Three federal frameworks, the FCRA, Title VII as interpreted by the EEOC, and the federal Fair Chance Act, layer on top of state ban-the-box laws, state Clean Slate laws, state credit-check restrictions, and state drug-testing restrictions. This guide is the 2026 reference for both sides: what employers can do, what applicants can demand, and what the regulatory landscape actually looks like in your state.

Employers running a background check

94%PBSA and HR.com survey

Average cost per hire

$4,700SHRM Real Costs of Recruitment

States with fair chance hiring laws

37NELP count

Time to investigate a dispute

30 daysFCRA, 15 U.S.C. §1681i

Pre-employment background screening is now near-universal in U.S. hiring, but the legal terrain it sits on has been completely rewritten in the last decade. The federal scaffolding has three layers: the Fair Credit Reporting Act (FCRA), 15 U.S.C. §1681 et seq., which governs consent, content, and adverse-action mechanics; Title VII of the Civil Rights Act, as interpreted by EEOC, which polices disparate-impact use of criminal records; and the federal Fair Chance Act (effective Dec 20, 2021), which bans criminal inquiry before a conditional offer for federal hires and federal contractors.

Stacked on top of that federal frame is a dense and growing patchwork of state law. As tracked by the National Employment Law Project and the Clean Slate Initiative: a majority of states have some form of ban-the-box / fair-chance rule (NELP's recent edition counts roughly 37); a growing number of states operate Clean Slate automatic sealing in some form; about a dozen states plus several major cities restrict employer credit checks; and more than 20 states now provide some level of off-duty cannabis or salary-history protection. The exact counts shift as new statutes take effect, consult the linked trackers for the current authority in your jurisdiction. Employers operating across state lines cannot run a one-size-fits-all process; applicants need to know which protections apply where.

What this page does: Treats every section bilaterally. Each rule, each form, each statutory deadline is described from the applicant's perspective and the employer's. Where one side has a duty, the other has a right.

The FCRA imposes parallel obligations on the consumer reporting agency (CRA) that prepares the report and the employer (the "user") that orders it. Missing any one of these creates federal liability under 15 U.S.C. §1681n (willful) or §1681o (negligent), with statutory damages of $100 to $1,000 per willful violation plus actual damages and attorney fees.

What the screening company must do (15 U.S.C. §1681e)

Verify the user has a permissible purpose under §1681b.

Follow reasonable procedures to assure maximum possible accuracy of the report (§1681e(b)).

Reinvestigate disputed items within 30 days under §1681i.

Notify the consumer if public-record adverse information is reported for employment under §1681k.

Provide the consumer a free copy of the file on request under §1681j.

What the employer must do (15 U.S.C. §1681b(b))

1. Standalone disclosure. Written notice that a consumer report may be obtained, must be a clear, conspicuous document by itself (not buried in the application).
2. Written authorization. Applicant signs consent. May be combined with the disclosure but cannot contain extraneous waivers or release-of-liability language (a frequent litigation trigger).
3. Certification to the CRA. Employer certifies a permissible employment purpose and FCRA compliance.
4. Pre-adverse action notice. If considering an adverse decision based even in part on the report: send the applicant a copy of the report and the CFPB "Summary of Your Rights Under the FCRA".
5. Reasonable waiting period. FCRA does not specify a fixed number of days. FTC informal guidance has long suggested roughly five business days as a reasonable benchmark; many employers use five to seven business days. State or local law may impose its own timing.
6. Final adverse action notice. Names the CRA (with phone and website), states the CRA did not make the decision, confirms the right to a free copy within 60 days, and the right to dispute inaccurate information.

Most common employer violation: Burying the FCRA disclosure inside the job application. Federal courts have repeatedly held this defeats the "standalone document" requirement, exposing the employer to class-action damages even if the report itself was accurate and the hiring decision sound.

The EEOC's Enforcement Guidance on the Consideration of Arrest and Conviction Records (April 25, 2012) is still controlling. It is built on a Title VII disparate-impact theory: blanket disqualification policies based on criminal history have a documented adverse impact on Black and Hispanic applicants, and unless the policy is "job-related and consistent with business necessity," it violates 42 U.S.C. §2000e-2.

The Green factors (job-related/business-necessity assessment)

From Green v. Missouri Pacific Railroad, 549 F.2d 1158 (8th Cir. 1977):

1. Nature and gravity of the offense or conduct
2. Time elapsed since the offense or completion of the sentence
3. Nature of the job sought, including duties, supervision, and access to vulnerable populations or assets

Individualized assessment

Before excluding an applicant the employer should give the individual notice and an opportunity to demonstrate why exclusion is not warranted in their specific case, rehabilitation evidence, time in the workforce since the offense, education completed, references, age at the time of the offense, mitigating circumstances. A pattern of automatic exclusion based on conviction history alone, without this assessment, is the practice the EEOC targets.

Real consent-decree record

Pepsi Beverages, $3.13M (2012), blanket exclusion of applicants with arrest records pending prosecution.

BMW Manufacturing, $1.6M (2015), criminal background check rolled out to incumbent contractors with disparate-impact effect.

Dollar General, $6M (2019), nationwide criminal-history screening program lacking individualized assessment.

EEOC vs. FCRA, two separate compliance tracks: FCRA is about process (disclosure, consent, adverse action). EEOC is about substance (whether the conviction-based decision is job-related). An employer can run a perfect FCRA process and still face an EEOC charge if the underlying disqualification policy lacks individualized assessment.

"Ban-the-box" is shorthand for laws that prohibit employers from asking about criminal history on the initial job application. Stronger fair-chance laws push the inquiry all the way back to after a conditional offer of employment. The National Employment Law Project tracker (current edition) counts roughly 37 states and over 150 cities and counties with some form of fair-chance law. Counts shift as new statutes pass, check the live tracker for current numbers.

Beyond these 15 examples, additional ban-the-box or fair-chance states (most public-sector only) include Delaware, Georgia, Hawaii, Indiana, Kansas, Kentucky, Louisiana, Maine, Minnesota, Missouri, Nebraska, Nevada, New Mexico, North Dakota, Ohio, Oklahoma, Rhode Island, Tennessee, Utah, Vermont, and Wisconsin. Coverage scope and exempt industries vary by state, check the NELP tracker for the current authority in your jurisdiction.

Applicant action step: If you live in a ban-the-box state and the application asks about criminal history before a conditional offer, save the listing, screenshot the application, and file a complaint with your state Department of Labor or attorney general. Statutory damages and reinstatement remedies vary by state but are real.

Enacted in 2019 as part of the National Defense Authorization Act and codified at 5 U.S.C. §9202, the Fair Chance to Compete for Jobs Act took effect December 20, 2021. It prohibits federal agencies and federal contractors (for contracts above the simplified-acquisition threshold) from requesting criminal-history information from an applicant before a conditional offer of employment.

Who it covers

All federal civilian agencies.

Federal contractors (for the position to be filled in connection with a covered contract).

Excludes positions requiring access to classified information, law enforcement, national security positions, and a handful of other statutory exceptions.

Penalties

For federal employees who break the rule: a written warning for a first violation, and stronger penalties for later ones, which can include a civil penalty. For federal contractors: a written warning for a first violation; for later violations the agency can require the contractor to confirm in writing that it is taking steps to comply and can suspend payment on the contract until it complies. OPM decides violations by federal employees; for contractors, the head of the contracting agency acts.

Federal vs. state stacking: The Fair Chance Act sets a floor for federal hires and contractors. Many states impose stricter timing (conditional offer in California and Washington; after first interview in Maryland) and broader coverage (private employers above set size thresholds). Where state law is stricter, state law controls.

More than twenty states plus the District of Columbia and a growing list of localities now prohibit employers from asking about an applicant's salary history. The policy goal is pay equity: if women and minority workers enter the workforce at depressed wages and each new employer benchmarks against the prior salary, the gap compounds across careers.

Salary-history ban states (representative)

Applicant tactic: In a salary-history-ban state you are entitled to refuse the question. Employers shifted to "salary expectations" instead, answer with a range based on the posted role + market data (Glassdoor, BLS OEWS, Levels.fyi), not a number anchored to your prior pay.

The companion movement to salary-history bans: requiring employers to publish the pay range in the job posting. Pay-transparency laws are spreading rapidly and 2025-2026 brought several major effective dates.

Penalties

California: $100 to $10,000 per violation. New York State: civil penalties to $3,000. Washington: actual damages or $5,000 per applicant (whichever greater) plus statutory penalties. Illinois (HB 3129): $250-$10,000 per violation. Massachusetts: written warning for first violation, then $500-$25,000.

Posted-range honesty test: Watch for the "$50K-$500K" gimmick range, technically compliant, useless to applicants, and now a litigation target. CA and WA have begun enforcement actions against employers posting unreasonably broad ranges that defeat the law's purpose.

Some states and cities now regulate algorithmic hiring tools such as resume parsers, video interview scoring and automated rejection systems. The rules include bias audits, notice to applicants and, in Colorado from January 1, 2027, an explanation and a right to human review after an adverse decision.

NYC Local Law 144, Automated Employment Decision Tools

Effective: July 5, 2023, enforcement by NYC Department of Consumer and Worker Protection.

Coverage: Any "AEDT" used to substantially assist or replace discretionary employment decisions in NYC.

Requirements: Annual independent bias audit; public summary of audit; applicant notice 10 business days before use; alternative-process option.

Statute: NYC Admin Code §20-870 through §20-874.

Illinois AI Video Interview Act

Effective: January 1, 2020 (amended 2022).

Requirements: Notice + consent before AI analysis of video interviews; demographic reporting if AI is the sole hiring decision factor.

Statute: 820 ILCS 42/.

Colorado automated decision law (SB26-189), effective January 1, 2027

Colorado repealed and reenacted its 2024 AI Act (SB24-205) with SB26-189, signed May 14, 2026. It covers automated decision-making technology used in consequential decisions, employment included. Starting January 1, 2027:

• A business using a covered tool must give clear notice at the point of interaction.
• After an adverse outcome, it must give a plain language description of the tool's role within 30 days.
• Applicants can ask for the personal data used, have factual errors corrected, and ask for meaningful human review and reconsideration.
• The Colorado Attorney General enforces the law; it creates no new private right of action.

Federal rules

Title VII and the ADA cover hiring decisions however they are made, software included. The two EEOC technical assistance papers on AI hiring tools (May 2022 on the ADA, May 2023 on adverse impact) are no longer posted on the EEOC website.

Applicant privacy note: In NYC and Illinois you are entitled to notice that an AI tool is scoring your application or interview. If you do not receive notice, you have a private right of action in IL (820 ILCS 42/) and a complaint route through DCWP in NYC.

Federal law (FCRA) permits employer credit checks with applicant consent. A number of states (currently around eleven, including CA, CO, CT, HI, IL, MD, NV, OR, VT, WA) plus several major cities (including NYC, Philadelphia, Chicago, and DC) restrict the practice further, often allowing it only for positions with fiduciary responsibility, financial-account access, or law enforcement duties.

If a credit report costs you the job: the FCRA adverse action steps above still apply. The employer must give you a copy of the report and the CFPB summary of your rights before acting on it.

Several federal statutes and a growing list of state laws restrict the content of what an employer can request or consider, independent of the FCRA process.

Genetic Information Nondiscrimination Act (GINA)

42 U.S.C. §2000ff. Employers cannot request, require, or purchase genetic information about an applicant or family member. The EEOC's GINA enforcement page covers details. Background-check vendors must scrub family-medical-history data from any record they deliver.

Americans with Disabilities Act (ADA), medical inquiry

42 U.S.C. §12112(d). Pre-offer medical exams or disability-related inquiries are prohibited. Post-offer medical exams are allowed only if required of all entering employees in the same job category. Drug testing is not a medical exam, but post-2024 EEOC guidance treats marijuana-use inquiries differently in states with off-duty protections.

Age Discrimination in Employment Act (ADEA)

29 U.S.C. §623. Applicable to employers with 20+ employees. Prohibits inquiry into birth date or graduation dates that effectively reveal age, when used to discriminate against applicants 40+.

Pregnancy Discrimination Act (PDA) + Pregnant Workers Fairness Act (PWFA 2023)

42 U.S.C. §2000gg. The 2023 PWFA expanded protections, requiring reasonable accommodations for pregnancy, childbirth, and related conditions. EEOC final regulations took effect June 18, 2024.

Off-duty cannabis protections (a growing number of states)

States restricting employer cannabis-use discrimination include New York (N.Y. Labor Law §201-d), New Jersey (N.J.S.A. 24:6I-52), Connecticut (P.A. 21-1), Montana (M.C.A. §39-2-313), Rhode Island (R.I. Gen. Laws §21-28.11-29), Washington (RCW 49.44.240, effective Jan 1, 2024), California (Cal. Gov. Code §12954, effective Jan 1, 2024), Minnesota (Minn. Stat. §181.938), Nevada (NRS 613.132), Illinois (820 ILCS 55), and DC. Most protect off-duty use only and contain safety-sensitive exceptions.

Common employer overreach: Pre-employment health questionnaires that include family medical history. This violates GINA even when phrased indirectly. CRA vendors that include "medical history" sections in their reports are exposing employers to GINA liability.

If an employer denies, withdraws, or modifies an offer based even in part on a background-check report, you have specific federal rights with statutory deadlines. Move fast, the 60-day free-report window starts at the adverse action.

1. Demand the adverse action notice in writing. Federal law requires it. An oral or vague "we went with another candidate" email is not enough if a consumer report was part of the decision.
2. Identify the CRA. The notice must name the screening company with phone and website.
3. Request your free copy. Contact the CRA within 60 days of adverse action; FCRA §1681j entitles you to a free file disclosure.
4. Review every line. Look for name-collision matches, dismissed/sealed cases shown as convictions, stale records past the 7-year window for non-conviction items.
5. File a dispute with the CRA. Certified mail, return receipt. Identify each item, attach documentation (court dispositions, sealing orders, ID confirming wrong-person matches). FCRA §1681i gives the CRA 30 days to investigate.
6. If the dispute is denied, escalate. File a complaint with the CFPB, the agency forwards your complaint to the company with a 15-day response window.
7. If you suspect discrimination, file an EEOC charge. Strict deadline: 180 days from adverse action (300 in states with parallel agencies).
8. FCRA private right of action. Statute of limitations is 2 years from discovery of violation or 5 years from violation, whichever is earlier. Recoverable: actual damages, statutory $100-$1,000 per willful violation, attorney fees, punitive damages.

Check your own file first: nationwide specialty consumer reporting companies, such as employment and tenant screening companies, must give you your file free once every 12 months on request (15 U.S.C. §1681j). The CFPB keeps a list of consumer reporting companies.

Building a defensible 2026 screening program is mostly about templated workflows and documented assessments. Use this as a self-audit.

Pre-deployment

Written FCRA disclosure on a standalone document (no waivers, no extraneous language).

Separate written authorization signed before any report is ordered.

Vendor diligence: does your CRA carry adequate E&O insurance? Is it accredited by the Professional Background Screening Association?

Written conviction-history policy reflecting EEOC Green-factor individualized assessment.

State-specific addenda for each jurisdiction in which you hire.

During the screen

Order only the report scopes that are job-related (avoid pulling a credit report for non-fiduciary roles in restrictive states).

Document the conditional offer in writing where ban-the-box law requires it.

Limit access to the report to decision-makers with a need to know.

Adverse action workflow

Pre-adverse action notice + copy of report + Summary of Rights.

Reasonable waiting period (FCRA does not specify; FTC informal guidance treats roughly 5 business days as a reasonable benchmark).

Document any individualized assessment conducted.

Final adverse action notice with CRA contact + free-copy + dispute-right language.

Retention

EEOC: 1 year for applications and related records (29 C.F.R. §1602.14); longer if a charge is filed.

FCRA: no specific federal retention rule but Sarbanes-Oxley + state law may apply.

State-specific record-keeping rules in CA, NY, IL, MA, consult counsel.

Compliance program: small employer minimum (1) Standalone disclosure + consent template; (2) PBSA-accredited CRA; (3) two-letter adverse action template; (4) written conviction-history policy referencing EEOC guidance; (5) state-specific addendum library. Five documents. Build them once, defend them forever.

Several pending or recently-enacted laws will reshape employment screening through 2026 and beyond.

Colorado automated decision law: SB26-189 (signed May 14, 2026) replaced the 2024 Colorado AI Act. From January 1, 2027, businesses using automated decision tools in hiring owe applicants notice, an explanation after an adverse outcome and a chance at human review.

California SB 1100: effective Jan 1, 2025. Bans a driver's license requirement in job postings unless the employer reasonably expects the job to require driving and other transport would not be comparable in time or cost. Reaches the screen indirectly by limiting MVR pulls.

Federal contractors: Executive Order 14173 (January 21, 2025) revoked Executive Order 11246. The OFCCP still enforces Section 503 (disability) and VEVRAA (veterans) for federal contractors.

Biometric Information Privacy: IL BIPA litigation continues; TX, WA, NY have parallel statutes; AZ, FL, KY, MD have bills pending. Fingerprint-based clocking-in systems and biometric onboarding are litigation targets.

Clean Slate expansion: New York (effective Nov 16, 2024) and a growing list of other states (including PA, MI, MN, NJ, VA, CT per the Clean Slate Initiative tracker) have automated-sealing laws shrinking the pool of records visible to employers. CA SB 731 made misdemeanor and many felony records auto-sealed after 4 years conviction-free.

Off-duty cannabis: expect 5 to 8 more states to enact protections through 2027.

Reading the trend: Three vectors are tightening simultaneously: less data visible (Clean Slate sealing), less data usable (ban-the-box + credit restrictions + cannabis protections), and more procedural overhead (AI bias audits + individualized assessments). The 2026 employer's screening program looks nothing like the 2016 version.

• FTC, Fair Credit Reporting Act statute (15 U.S.C. §1681 et seq.)
• EEOC, Genetic Information Discrimination (GINA)
• EEOC, Age Discrimination (ADEA)

Last reviewed: June 2026.