Background Check Laws by State for Employers

I run a small company, and if another founder asked me about background checks, my first warning would be not to assume one screening policy fits every hire. Background check compliance is not one law but a stack of three: federal, state, and city.

Employers get caught out because the layer that usually governs is the one furthest from their head office. This guide takes each layer in turn and ends with a screening process you can run without a lawyer on staff.

Federal law applies everywhere. State law layers on top. City ordinances frequently go further than their own states. Which combination applies to a given candidate is determined by where that person will actually perform the work, not by where your company is registered.

A business headquartered in Texas hiring someone to work in Los Angeles is subject to California law for that hire, plus a city ordinance once it has ten or more employees. A colleague in Dallas gets the federal floor alone. One national policy cannot satisfy both.

Which Laws Apply to You

All three layers can apply to the same hire, and each stands on its own. Complying with one does not discharge the others, and they are not alternatives.

The federal layer splits in two, and conflating them causes real problems. The FCRA governs the process: how you request a report, what you disclose, and what you must do before and after acting on it.

Title VII, the ADA, and the ADEA govern the use: whether the way you weigh what you found produces discrimination. You can run a flawless FCRA process and still face an EEOC charge, a discrimination complaint filed with the Equal Employment Opportunity Commission, for how you applied the results.

FCRA Rules Everywhere

The Fair Credit Reporting Act applies to any employer using a third-party consumer reporting agency (the law's term for a background screening company), regardless of size, revenue, or state. There is no small-business exemption. It sets out a sequence, and each step has litigated details.

Two steps are where the process usually breaks. The standalone disclosure requirement is unforgiving: putting the disclosure inside a job application or an onboarding packet, or adding a liability release to it, has repeatedly supported class action claims.

The adverse action sequence is the other weak point. It usually breaks because an employer made the decision first and sent the notices afterward, which defeats the entire purpose of the pre-adverse step.

The sequence itself is not in dispute, and the Federal Trade Commission sets it out for employers in plain terms: written permission first, then the pre-adverse notice with the report and the Summary of Rights, then the adverse action notice naming the screening company. What employers get wrong here is the order, not the content.

On the use side, the EEOC discourages blanket exclusions and recommends a targeted screen assessed against three factors: the nature and gravity of the offense or conduct, the time that has passed since the offense or the completion of the sentence, and the nature of the job held or sought (U.S. EEOC).

That guidance is still posted, but its footing has shifted. In June 2026 the Justice Department concluded that the EEOC's disparate-impact guidelines under Title VII are unconstitutional (U.S. Department of Justice).

Disparate impact is the theory that a neutral-looking policy can still discriminate when it screens out one protected group at a higher rate. The Justice Department opinion does not have the force of law, and the disparate-impact provision of Title VII itself is unchanged.

Ban-the-Box Basics

Ban-the-box laws restrict when you may ask about criminal history, not whether you may consider it. The name refers to the checkbox on an application asking whether the candidate has ever been convicted.

According to the most recent inventory of these policies from the National Employment Law Project (NELP, October 2021), 37 states, the District of Columbia, and more than 150 cities and counties had adopted some form of fair chance policy. By that count, more than four fifths of the US population lived in a jurisdiction that had banned the box. NELP has not published a newer count, so treat these figures as a 2021 snapshot.

That headline number flatters the coverage, though. Only 15 of those 37 states extended their laws to private employers; the other 22 covered only public-sector hiring, which is why a state appearing on the list tells you nothing on its own about whether it reaches you.

The federal government holds itself to the conditional-offer standard as well. 5 U.S.C. 9202 bars an agency from asking a civil service applicant to disclose criminal history record information before the appointing authority extends a conditional offer. Contractors are covered by a separate section, 41 U.S.C. 4714, which applies the same conditional-offer rule to applicants for positions related to work under a federal contract.

Employer size thresholds differ too. Some laws reach every employer, others start at five, ten, or fifteen employees, and a city may cover the small employers its state law exempts. The practical rule is to remove the question from the application everywhere and set the inquiry point by work location, which is simpler than maintaining several versions of a form.

Restrictions by State

Rather than a grid where most cells say no, here is what actually varies, grouped by the restriction that matters. The lookback table covers the states that cap what a report itself may contain; the pending-charges table after it is a sample, not a complete list.

Start with the states that limit how far back a report may reach, because that is the restriction most likely to be missed by an employer working from federal law alone.

The salary column is where these statutes diverge most, so it pays to read the statutes themselves. California caps convictions at seven years under Civil Code 1786.18 with no salary carve-out, Montana Code 31-3-112 carries no exemption subsection at all, and Colorado deleted its employment exception in 2022.

Most of the states that kept a carve-out set it far below the federal figure. New York lifts the limit at $25,000 under General Business Law 380-j. Kansas Statute 50-704 and RCW 19.182.040 in Washington lift it at $20,000, as do the Massachusetts and New Hampshire statutes.

Maryland Commercial Law 14-1203 matches the federal $75,000. In the states with a lower carve-out, though, a salary well short of the federal bar can still clear the state one.

Hawaii puts its limit on the employer rather than on the report. Under Hawaii Revised Statutes 378-2.5, an employer may consider a conviction only after a conditional offer, and only a felony from the last seven years or a misdemeanor from the last five, not counting time spent incarcerated (Hawaii Civil Rights Commission).

In every state not in the table, the federal rule sets how far back a report may reach, and as the lookback section below explains, it is considerably more permissive than most employers assume.

Which States Restrict Pending Charges and Arrest Records

Almost no state bans a pending charge from a report outright. The restrictions attach to arrests that closed without a conviction, and a case still in front of a court is handled as a separate question, which is why the clean list of prohibited states that employers go looking for does not exist. Six states show how differently the line gets drawn.

Two things follow. A report can lawfully surface a live case across most of the country, so the exposure sits in what you do with it rather than in seeing it. And where a state does restrict closed non-convictions, the restriction usually covers asking, recording, and acting, not only the final decision (Commonwealth of Massachusetts).

The New Background Check Law in Texas

Texas has no statewide ban-the-box statute reaching private employers, and the change that is actually on the books ran the other way. The Texas Regulatory Consistency Act added Labor Code Section 1.005, which voids any municipal or county ordinance regulating a field the Labor Code occupies, meaning one the state regulates itself (Texas Legislature, HB 2127).

Section 1.005 then names hiring practices as one of those occupied fields, which is what makes it bite here. The act took effect September 1, 2023, and the Austin fair chance ordinance is among the casualties.

Bills that would create a statewide rule have been filed and have not become law. The most recent, House Bill 2466 in the 2025 session, was referred to a House subcommittee on March 17, 2025 and went no further (Texas Legislature).

Several widely shared summaries say a statewide Texas rule has already passed, so check any claimed effective date against the legislature record before you redesign an application form around it. The federal floor still applies in full, as does any sector mandate.

Texas does keep a seven-year reporting limit in Business and Commerce Code 20.05, lifted for jobs paying $75,000 or more. The Texas State Law Library notes that sources indicate this limit may not be enforceable because provisions of the FCRA preempt it, meaning the federal law overrides the state one. That is why the lookback table marks it as disputed.

State Criminal History Checks

Every state runs its own criminal history repository, and what an employer can get out of it varies far more than the screening industry lets on. Some states sell a name-based search to anyone with a card. Others release records only to employers a statute names, and only against fingerprints.

That matters for two reasons. First, a state repository holds the records of that state and nothing else, so it is never a substitute for a multi-jurisdiction search. Second, in regulated sectors the state check is often the one the regulator actually requires, which is why the portal name turns up in the licensing paperwork rather than in a screening quote.

The table below samples 26 states across the full range of access models. The rest of the country runs the same split between public name searches and statute-gated fingerprint checks.

Name-based access is the cheap option and the unreliable one. Every agency in the table that sells a name search says the same thing in its own words: a match on name and date of birth does not positively identify anybody, and only fingerprints tie a record to a person. A clean name search is weaker evidence than it feels.

Pulling a record straight from a state agency is also a different transaction from buying a consumer report, and the states attach their own conditions to it. Oregon requires you to tell the person before you request the record, and the state then notifies them.

Iowa and Kansas add conditions of their own. Iowa releases a fuller record when you hold a signed waiver, and Kansas bars making an applicant obtain their own record as a condition of employment.

Credit History Limits

A minority of states, plus several major cities, restrict the use of credit history in hiring. The restrictions almost always operate by exception rather than by flat prohibition: credit may be used where the position falls into a defined category.

Washington shows the shape of the typical statute. Under RCW 19.182.020, an employer may not procure a consumer report for employment purposes where anything in it bears on creditworthiness, credit standing, or credit capacity, unless the information is substantially job related and the reasons are disclosed in writing, or another law requires the check.

The compliance failure here is running credit as a default on every hire. In a restricted jurisdiction, that is unlawful even where the information would be genuinely relevant, because the exception attaches to the position rather than to the employer. If you use credit checks at all, write down which specific roles require one and the reason, before you need to justify it.

How Far Back Checks Go

How far back a check may go depends on the type of record, the salary of the job, and the state. It is also where the widest and most consequential misunderstanding sits, and several published sources state it incorrectly, so it is worth being precise.

That produces a counterintuitive result. In most states, a conviction from fifteen years ago may lawfully appear on a report, while an arrest from eight years ago that never led to a conviction may not.

Employers who believe everything drops off at seven years are wrong in the cautious direction, since the law in most states allows more than they think. Employers in the eleven states in the table above who assume the federal position applies to them are wrong in the more dangerous direction.

The question of which states allow a ten-year background check comes out of this confusion. A ten-year conviction check is lawful in most states because there is no federal cap on convictions at all. In the states that cap convictions at seven years, it is not, unless the salary clears that state's carve-out. Where there is no carve-out, salary never changes the answer.

The practical rule is the one screening providers already apply: for each candidate, compare federal law, the law of the state where they will work, and any sector requirement, and apply whichever is most protective of the applicant. That is why a national lookback setting is the wrong shape of solution.

City Rules That Override

A city ordinance can be stricter than its own state law, and in the largest markets it usually is. For a candidate working in one of these places, the local rule is frequently the most restrictive requirement in the entire stack, and it is the one most often missed because employers check the state and stop.

New York City, Philadelphia, Chicago and Cook County, San Francisco, and both the City and the County of Los Angeles maintain fair chance ordinances. Each sets its own timing rules, notice requirements, and assessment procedures, and several impose obligations that go beyond the FCRA sequence rather than merely repeating it.

Some also reach employers their state leaves out. Chicago and Cook County, for example, cover private employers below the size threshold in the Illinois state law.

States keep changing underneath the cities too, and Washington is the current example. The amended Fair Chance Act bars any criminal record inquiry until the employer has both found the applicant otherwise qualified and made an offer conditioned on the record.

The amended rules reached employers with 15 or more employees on July 1, 2026, and reach employers with fewer than 15 on January 1, 2027. An employer taking adverse action on a conviction must also name the record, hold the position open for at least two business days, and put its reasoning in writing.

None of that is visible from a national policy document. If you hire into a major metro, check the city and the county alongside the state, and check them again when a phase-in date passes.

Because the answer differs per location and moves over time, the right form for it is a table with one row per place you actually hire into, filled in from the current source rather than from memory. Build it once for the states and cities you employ people in, record where you read each answer and when, and add a row the first time you hire into somewhere new.

The source and date columns are the ones people leave blank, and they are the reason the sheet is worth keeping. A rule you confirmed eighteen months ago is not a rule you have confirmed.

Re-read the rows for any location where you are about to make an offer, and re-read all of them when you cross an employee-count threshold, since several of these laws switch on at a specific headcount.

Industry Requirements

Everything above restricts screening. This section is the opposite: in several sectors, regulation requires checks and sometimes mandates disqualification for specific offenses, which overrides the general fair chance framework.

Several states run a named program instead of a general duty, and the program is what the regulator audits. Wisconsin is the clearest example. Its Department of Health Services requires regulated entities to run a caregiver background check on employees and contractors at hire, again whenever circumstances change, and at least every four years, through the state record check system.

Where a sector mandate applies, it usually wins over fair chance timing rules, though not always in the way employers expect. The disqualifying offense list is defined by statute, not by your own risk appetite.

Sector checks also sit alongside separate obligations such as I-9 verification and, where applicable, drug testing, which are different processes with different rules.

Building a Process

For a business without an employment lawyer on staff, the goal is not to memorize fifty state laws. It is to build a process that produces a defensible outcome by default, so that the compliance question is answered by the workflow rather than by whoever is hiring that week.

The second and sixth steps are where small employers most often fail, and both are process failures rather than knowledge failures. Asking too early happens because the question is still sitting on an old application form. A missing assessment happens because the reasoning stayed in someone's head. Both are fixed by where the work happens, not by knowing more law.

Choosing a provider matters more than it looks, since the screening company carries the per-jurisdiction reporting rules for you.

What Managed State Compliance Actually Covers

Managed state compliance is the screening company service that applies each jurisdiction's reporting rules to the report itself, whatever label a given vendor puts on it.

In practice, the provider screens what comes back against the law of the place tied to the candidate: sealed and expunged records suppressed, non-convictions withheld where a state bars them, and convictions dropped where a state caps a lookback that federal law leaves open.

What that settles is which records may reach you. It does not settle when you may ask, whether you may act on what you see, or how you record the reasoning.

The inquiry point, the assessment tying a specific record to specific duties, and both adverse action notices stay with you. No setting at a vendor has any view on the checkbox still sitting on your application form.

The filtering also runs off the location entered on the order, which is where it quietly goes wrong. Order a candidate under your head office address and you get the head office rules rather than the ones that govern the work.

Before you rely on a provider, ask three things: which jurisdiction they apply, what they suppress under it, and what happens if the wrong state was entered.

Where the check sits in the funnel is a related design question rather than purely a legal one, since moving it later reduces the number of candidates you screen and therefore the cost, while moving it earlier surfaces problems sooner.

One benefit of running this by policy rather than by instinct is that the same discipline reduces bias in the hiring process generally. A documented, consistently applied screen is both the fair chance answer and the discrimination answer, which is why the two bodies of law point in the same direction here.

On the storage side, FirstHR keeps the signed disclosure and authorization against the candidate record with e-signature and a dated audit trail, holds the notices and the assessment note with them, and keeps the whole file in one place rather than across an inbox and a drive. FirstHR is an onboarding and HR platform, not a consumer reporting agency and not a law firm: it does not run background checks, determine which state law applies, or issue adverse action notices. Applicant tracking is coming soon to FirstHR.

If you fix only two things this week, take the criminal history question off your application form and fill in a row of the screening matrix for every place you hire into now. The rest of the process builds on those two.

Frequently Asked Questions