Background Check Laws by State for Employers
Background check laws by state: FCRA rules that apply everywhere, ban-the-box, credit check limits, lookback periods, and how to build a compliant process.
Background Check Laws by State for Employers
Federal law sets the floor and every state and a growing number of cities build on top of it. Which rules apply to a given candidate depends on where they will actually work, not where your company is registered. Here is the whole stack, and a process you can run without a lawyer on staff.
Background check compliance is not one law. It is a stack of three, and the reason employers get caught out is that the layer which usually governs is the one furthest from their head office. Federal law applies everywhere. State law layers on top. City ordinances frequently go further than their own states.
Which combination applies to a given candidate is determined by where that person will actually perform the work, not by where your company is registered. A business headquartered in Texas hiring someone to work in Los Angeles is subject to California law and a county ordinance for that hire, and to the federal floor alone for a colleague in Dallas. One national policy cannot satisfy both. Our guide to background checks covers what a check contains; this page covers what the law lets you do with it.
Which Laws Apply to You
Three layers, each independent of the others. Complying with one does not discharge the others, and they are not alternatives.
The federal layer splits in two, and conflating them causes real problems. The FCRA governs the process: how you request a report, what you disclose, and what you must do before and after acting on it. Title VII, the ADA, and the ADEA govern the use: whether the way you weigh what you found produces discrimination. You can run a flawless FCRA process and still face an EEOC charge for how you applied the results.
FCRA Rules Everywhere
The Fair Credit Reporting Act applies to any employer using a third-party consumer reporting agency, regardless of size, revenue, or state. There is no small-business exemption. It sets out a sequence, and each step has litigated details.
| Step | What is required | When |
|---|---|---|
| Disclosure | A clear and conspicuous written disclosure in a document consisting solely of that disclosure, with no liability waiver or extraneous material | Before requesting the report |
| Authorization | The candidate's written authorization, which may sit on the same standalone form but not inside other hiring documents | Before requesting the report |
| Certification | Certify to the screening company that you complied and will not misuse the information | When requesting the report |
| Pre-adverse action notice | A complete copy of the report plus a copy of the Summary of Your Rights Under the FCRA | Before any decision based on the report |
| Waiting period | A reasonable period for the person to review and dispute. Not specified in the statute; five business days is the common benchmark | After the pre-adverse notice |
| Adverse action notice | Notice of the decision, the screening company's contact details, a statement that it did not make the decision, and dispute and free-report rights | After the decision |
| Secure disposal | Shred paper and permanently erase electronic files when the information is no longer needed | When retention is no longer justified |
Two steps generate most of the litigation. The standalone disclosure requirement is unforgiving: putting the disclosure inside a job application or an onboarding packet, or adding a liability release to it, has repeatedly supported class claims. And the adverse action sequence is the most litigated part of the process, usually because an employer made the decision first and sent the notices afterwards, which defeats the entire purpose of the pre-adverse step. Our guide to the FCRA covers the detail.
On the use side, the EEOC discourages blanket exclusions and recommends a targeted screen assessed against three factors: the nature and gravity of the offence, the time that has passed since the offence or the completion of the sentence, and the nature of the job held or sought (U.S. EEOC).
Ban-the-Box Basics
Ban-the-box laws restrict when you may ask about criminal history, not whether you may consider it. The name refers to the checkbox on an application asking whether the candidate has ever been convicted.
Roughly 37 states, the District of Columbia, and more than 150 cities and counties have adopted some form of fair chance policy, and more than three quarters of the US population lives in a covered jurisdiction. Only a subset of state laws extend to private employers; many cover public-sector hiring and public contractors only.
| Scope | Typical rule | What it means for your application form |
|---|---|---|
| Private employers covered | No criminal history question until after an initial interview or a conditional offer | Remove the question from the application entirely |
| Public sector and contractors only | Applies to state agencies, and often to businesses contracting with the state | Applies only if you bid for public work; otherwise the federal floor |
| Federal contractors | The federal Fair Chance Act delays inquiry until after a conditional offer | Applies to federal agencies and contractors regardless of state |
| No state law | Federal baseline applies unless a city ordinance reaches the work location | Check the city before assuming nothing applies |
Employer size thresholds differ too. Some laws reach every employer, others start at five, ten, or fifteen employees, and a city may cover the small employers its state law exempts. The practical rule is to remove the question from the application everywhere and set the inquiry point by work location, which is simpler than maintaining several versions of a form. Our ban-the-box guide covers the mechanics, and asking about criminal history at the wrong moment sits close to the wider question of illegal interview questions.
Restrictions by State
Rather than a grid where most cells say no, here is what actually varies, grouped by the restriction that matters. Any state not named in the tables below applies the federal baseline for that particular restriction.
Start with the states that limit how far back a report may reach, because that is the restriction most likely to be missed by an employer working from federal law alone.
| State | Lookback limit | Salary exception | Non-conviction records |
|---|---|---|---|
| California | 7 years for convictions | None | Non-convictions may not be reported; pending cases limited |
| Montana | 7 years | None or minimal | Restricted |
| New York | 7 years | Lifted at roughly $25,000 | Non-convictions may not be reported |
| Kansas | 7 years | Lifted at roughly $20,000 | Restricted |
| Colorado | 7 years | Lifted at $75,000 | Restricted, with vulnerable-population carve-outs |
| Maryland | 7 years | Lifted at $75,000 | Restricted |
| Massachusetts | 7 years | Varies | Restricted |
| New Hampshire | 7 years | Varies | Restricted |
| Washington | 7 years | Varies | Restricted |
| Hawaii | 7 years for felonies, 5 for misdemeanours | Not applicable in the same form | Arrests not leading to conviction may not be reported |
| Texas | 7 years by statute, though the provision is disputed | Lifted at $75,000 | Practice generally follows federal law |
Everywhere not listed, the federal position governs, which as explained below is considerably more permissive than most employers assume.
Credit History Limits
About eleven states plus several major cities restrict the use of credit history in hiring. The restrictions almost always operate by exception rather than by flat prohibition: credit may be used where the position falls into a defined category.
| Typical permitted category | What it usually covers |
|---|---|
| Financial responsibility | Roles with authority over money, payments, or company accounts |
| Access to assets | Positions with access to significant cash, inventory, or valuables |
| Fiduciary duty | Roles holding a fiduciary or trust relationship, often with a stated dollar threshold |
| Managerial authority | Positions with authority to set the direction or control of an organisation |
| Required by law | Where another statute or a licensing body requires a credit check for the role |
| Named exempt sectors | Financial institutions, law enforcement, and similar, varying by jurisdiction |
The compliance failure here is running credit as a default on every hire. In a restricted jurisdiction, that is unlawful even where the information would be genuinely relevant, because the exception attaches to the position rather than to the employer. If you use credit checks at all, write down which specific roles require one and the reason, before you need to justify it.
How Far Back Checks Go
This is where the widest and most consequential misunderstanding sits, and several published sources state it incorrectly, so it is worth being precise.
That produces a counterintuitive result. In most states, a conviction from fifteen years ago may lawfully appear on a report, while an arrest from eight years ago that never led to a conviction may not. Employers who believe everything drops off at seven years are wrong in the more permissive direction, and employers in the roughly ten states listed above who assume the federal position applies to them are wrong in the more dangerous direction.
The searches for a ten-year background check usually come from this confusion. A ten-year conviction check is lawful in most states because there is no federal cap on convictions at all. In the states that impose their own seven-year limit on convictions, it is not, regardless of salary in the states with no salary carve-out.
The workable rule is the one screening providers already apply: for each candidate, compare federal law, the law of the state where they will work, and any sector requirement, and apply whichever is most protective of the applicant. That is why a national lookback setting is the wrong shape of solution.
City Rules That Override
A city ordinance can be stricter than its own state law, and in the largest markets it usually is. For a candidate working in one of these places, the local rule is frequently the most restrictive requirement in the entire stack, and it is the one most often missed because employers check the state and stop.
New York City, Philadelphia, Chicago and Cook County, San Francisco, and Los Angeles County all maintain fair chance ordinances with their own timing rules, notice requirements, and assessment procedures, several of which impose obligations that go beyond the FCRA sequence rather than merely repeating it. Chicago and Cook County, for example, reach private employers below the size threshold in the Illinois state law.
Several changed recently. Philadelphia expanded its rules at the start of the year, and Washington State amendments phase in by employer size, reaching employers with fifteen or more employees before extending to smaller ones the following year. If you hire into a major metro, check the city and the county, not just the state.
Industry Requirements
Everything above restricts screening. This section is the opposite: in several sectors, regulation requires checks and sometimes mandates disqualification for specific offences, which overrides the general fair chance framework.
| Sector | Typical mandate | Practical note |
|---|---|---|
| Healthcare and long-term care | State-mandated criminal checks, registry and exclusion list screening, often before the first shift | Timing rules can conflict with ban-the-box, and the sector mandate generally prevails |
| Childcare and education | Fingerprint-based checks, child abuse registry checks, disqualifying offence lists | Lists are set by state statute and are not discretionary |
| Transportation | Federal safety-sensitive requirements including drug and alcohol testing and specific lifetime disqualifiers | Overlaps with drug testing obligations rather than replacing them |
| Financial services | Statutory bars on employing individuals with certain convictions | Named in EEOC guidance as a federal restriction the guidance does not preempt |
Where a sector mandate applies, it usually resolves the tension with fair chance timing rules in favour of the mandate, but not always in the way employers expect, and the disqualifying offence list is defined by statute rather than by your risk appetite. These checks also sit alongside separate obligations such as I-9 verification and, where applicable, drug testing, which are different processes with different rules.
Building a Process
For a business without an employment lawyer on staff, the goal is not to memorise fifty state laws. It is to build a process that produces a defensible outcome by default, so that the compliance question is answered by the workflow rather than by whoever is hiring that week.
The second and sixth steps are where small employers most often fail, and both are process failures rather than knowledge failures. Asking too early happens because the question is still sitting on an old application form. A missing assessment happens because the reasoning stayed in someone's head. Both are fixed by where the work happens, not by knowing more law.
Choosing a provider matters more than it looks, since they carry the per-jurisdiction reporting rules for you. Our comparison of background check services covers what to look for.
Where the check sits in the funnel is a related design question rather than purely a legal one, since moving it later reduces the number of candidates you screen and therefore the cost, while moving it earlier surfaces problems sooner. Our guides to pre-employment screening and candidate screening cover the sequencing.
One benefit of running this by policy rather than by instinct is that the same discipline reduces bias in the hiring process generally. A documented, consistently applied screen is both the fair chance answer and the discrimination answer, which is why the two bodies of law point in the same direction here.
On the storage side, FirstHR keeps the signed disclosure and authorization against the candidate record with e-signature and a dated audit trail, holds the notices and the assessment note with them, and keeps the whole file in one place rather than across an inbox and a drive. FirstHR is an onboarding and HR platform, not a consumer reporting agency and not a law firm: it does not run background checks, determine which state law applies, or issue adverse action notices. Applicant tracking is coming soon to FirstHR.
Frequently Asked Questions
Which background check laws apply to a multi-state employer?
All of them, applied per candidate. The Fair Credit Reporting Act applies nationwide to any employer using a third-party screening company, regardless of size, revenue, or state. State and local fair chance laws layer on top of it. The rule that determines which state and local law governs is where the candidate will actually perform the work, not where your company is headquartered or incorporated. A company based in Texas hiring someone who will work in Los Angeles is subject to California state law and the Los Angeles County ordinance for that candidate, and to the federal baseline only for a candidate in Texas. Applying a single national screening policy either over-restricts in permissive states or, far more commonly, under-restricts in strict ones. This is general information, not legal advice.
How far back can an employment background check go?
It depends on the type of record, the salary, and the state, and the most common misconception is worth correcting first. Under federal law, criminal convictions have no time limit and may be reported indefinitely. The familiar seven-year rule applies to non-conviction information: arrests that did not lead to conviction, civil suits and judgments, paid tax liens, and collection accounts. That seven-year limit is also lifted entirely for positions with an annual salary of $75,000 or more. About ten states then impose their own limits that are stricter than the federal baseline, several of which cap convictions at seven years where federal law does not. Apply whichever rule is most protective of the applicant for that specific candidate. This is general information, not legal advice.
What does the FCRA require before running a background check?
Two things in sequence, and the formatting of the first one has produced a large volume of litigation. First, a clear and conspicuous written disclosure, in a document consisting solely of that disclosure, stating that a consumer report may be obtained for employment purposes. It cannot be buried inside the job application, an offer letter, or an onboarding packet, and it must not carry extraneous material such as a liability waiver. Second, the candidate's written authorization, which may be combined with the disclosure on the same standalone form but still cannot be attached to other hiring documents. You must also certify to the screening company that you have complied and that you will not use the information in violation of equal opportunity law. Failing on the standalone requirement is one of the most common sources of class action exposure.
What is the adverse action process?
A two-step sequence required before and after any decision based even partly on a background report. Before acting, send a pre-adverse action notice that includes a complete copy of the report you relied on and a copy of the Summary of Your Rights Under the Fair Credit Reporting Act, then wait a reasonable period so the person can review it and explain or dispute anything inaccurate. The FCRA does not specify the waiting period, but five business days is the widely used benchmark. After the decision, send the adverse action notice telling the person the decision was based on the report, giving the screening company's name, address, and phone number, stating that the company did not make the decision and cannot explain it, and informing them of the right to dispute the information and to obtain a free copy of the report within sixty days.
Can employers check credit history?
In most states yes, but roughly eleven states plus several major cities restrict it, and the restrictions usually work by exception rather than by outright prohibition. Where a limit applies, the employer generally may not use credit history unless the position falls into a defined category, typically roles with significant financial responsibility, access to substantial assets, fiduciary duties, managerial authority over an organisation, or where a credit check is required by another law. The practical consequence is that a blanket policy of running credit on every hire is unlawful in those jurisdictions even where credit information would be genuinely useful. If you run credit checks at all, define in writing which specific positions require one and why, because that written justification is what the exception turns on.
What is a ban-the-box law?
A law restricting when in the hiring process an employer may ask about criminal history. The name refers to the checkbox on job applications asking whether the applicant has ever been convicted of a crime. These laws typically require removing that question from the application and delaying any criminal history inquiry until after an initial interview or after a conditional offer, and many also require an individualised assessment before denying employment based on a record. Roughly 37 states, the District of Columbia, and more than 150 cities and counties have adopted some form of fair chance policy, with more than three quarters of the US population living in a covered jurisdiction, though only a subset of state laws extend to private employers. The timing rule and the employer size threshold vary substantially between them.
Do background check laws apply to small businesses?
The federal ones do, with no exemption. The FCRA applies to any employer that uses a third-party screening company regardless of headcount, revenue, or state, so a five-person business running its first background check is subject to the same disclosure, authorization, and adverse action requirements as a national employer. The federal anti-discrimination statutes have headcount thresholds, generally fifteen employees for Title VII and the ADA and twenty for the ADEA, but many state fair employment laws reach far smaller employers and some reach employers of any size. State and local fair chance laws vary: some apply at one employee, others set thresholds of five, ten, or fifteen. Check the threshold in each jurisdiction where you hire rather than assuming small means exempt.
Can employers consider pending criminal charges?
It varies by state and it is one of the least uniform areas in this field. Under federal law, records of arrest that did not lead to conviction may generally be reported for seven years, and pending cases are ordinarily reportable, but several states prohibit reporting non-conviction information entirely, several more allow it to be reported while barring employers from asking about it or acting on it unless the matter resulted in conviction, and at least one limits consideration of arrest records to charges substantially related to the job. Separately, EEOC guidance takes the position that an arrest alone does not establish that criminal conduct occurred, so acting on an arrest record carries discrimination exposure independent of state law. Confirm the rule for the candidate's work location before treating a pending charge as disqualifying.