Ban the Box Laws: A Small Business Compliance Guide

The first time ban the box came up for me, it was not in a compliance review. It was a hiring manager forwarding me an application form she had downloaded from our own careers page, with a note that said something like: is this still allowed? The form had a checkbox near the bottom asking whether the applicant had ever been convicted of a crime. Nobody had touched that PDF in three years. It had been legal when it was written and it was not legal anymore, in at least two of the states where we were hiring.

That is how this issue actually shows up for small businesses. Not as a policy debate about criminal justice reform, but as a form nobody updated, a phone screen where a manager asked a question they should not have asked, or a remote hire in a state whose rules nobody thought to check. The laws themselves are not especially complicated. Keeping track of which ones apply to you is the hard part, and it gets harder every legislative session.

Most articles on this topic are written by background check vendors selling screening services, or by advocacy organizations writing for job seekers. Both are useful and neither is quite what a small business owner needs.

This guide covers what these laws actually require of you as an employer: which states have them, how low the employee thresholds go, when you can legally ask about criminal history, how to run a defensible assessment when a record comes back, and how to keep a small hiring process compliant without hiring a compliance officer. I built FirstHR for businesses in exactly that position, where the person handling HR is also the person running the company.

What Ban the Box Actually Means

The plainest way to understand these laws: they change the order of operations in hiring. They do not create a protected class, they do not prohibit criminal background checks, and they do not require you to hire anyone. They move the criminal history question from the front of the process to somewhere further back, on the theory that a candidate who has already demonstrated they can do the job gets a fairer hearing than a stack of applications sorted by checkbox.

Three things follow from that framing, and each one trips up employers who have not read the actual statute. First, the checkbox is a symbol, not the whole rule. Removing it from the PDF while a hiring manager still asks the question in a phone screen is a violation in most jurisdictions, because the laws regulate the inquiry rather than the format.

Second, the permitted stage varies. Some states let you ask once you invite someone to interview; others make you wait for a conditional offer. Third, several states pair the timing rule with additional obligations, and those additional obligations are usually where the real compliance work lives.

What these laws do not do is worth stating just as plainly. You can still run a criminal background check. You can still decline to hire someone based on a conviction that is genuinely relevant to the job. You can still exclude candidates outright for positions where a background check is legally mandated, such as roles involving children, healthcare, law enforcement, or certain financial services.

Where These Laws Came From

The National Employment Law Project traces the movement to organizing work by All of Us or None, a group of formerly incarcerated people and their families, which pushed the first ban-the-box campaigns in the early 2000s. Hawaii had moved earlier, restricting when employers could consider conviction records back in the late 1990s. The idea spread first through city ordinances, then to state legislatures, and eventually to federal hiring.

The pace picked up substantially once the movement reached state legislatures. Early policies covered only public sector employers, on the reasoning that government could set an example without imposing obligations on private business. That line held for a while and then it did not. California, Illinois, and others extended their rules to private employers, and once a few large states did it, the model spread. The federal government adopted the approach for its own hiring and for federal contractors filling positions tied to their contracts.

This history matters for one practical reason: the legal landscape is still moving. A guide written two years ago is out of date in several states. Philadelphia, Washington State, and Virginia all made changes in 2026. If you set up a compliant process and never revisited it, there is a reasonable chance it is no longer compliant somewhere in your footprint.

Ban the Box vs Fair Chance vs Federal Guidance

These three terms get used interchangeably and they are not the same thing. Understanding the difference tells you how much work compliance actually requires in a given state.

The distinction that matters most for a small employer: in a state with a bare ban-the-box rule, compliance can be as simple as fixing your employment application form and training your interviewers. In a state with a comprehensive fair chance act, you also need a documented assessment process and specific written notices at specific points. Those are very different amounts of work, and the first step is knowing which category your state falls into.

Federal anti-discrimination guidance sits underneath both. Even in a state with no ban-the-box law at all, a blanket policy of rejecting every applicant with a conviction can create legal exposure if it produces a disparate impact.

Which Fair Chance Act Do You Mean?

Fair chance employment is the umbrella term. A Fair Chance Act is a specific statute, and several different ones carry that name, which is why searching for it returns answers that contradict each other. The federal one reaches federal agencies and their contractors. California and New York City each have their own, and both reach small private employers.

The California Fair Chance Act took effect January 1, 2018 and covers employers with five or more employees. It prohibits asking a candidate about conviction history before a job offer, and an employer who wants to withdraw an offer over a record has to complete an individualized assessment and notify the candidate of the preliminary decision in writing before making it final.

New York City sets its threshold at four employees, and the owner counts toward that total. Per the city's Commission on Human Rights, the employer waits for the conditional offer, runs a fair chance analysis of the record, then gives the applicant a copy of that analysis along with the criminal history it relied on and at least five business days to respond.

The lesson for a small employer is to read the statute rather than the name. Where a jurisdiction has an act called fair chance, the timing rule is usually the smallest part of it, and the assessment, the notice, and the response window are where the work actually sits.

Which States Have Ban the Box Laws

Research from the National Employment Law Project (October 2021) documents 37 states with some form of ban-the-box or fair-chance policy, plus the District of Columbia and more than 150 cities and counties. The critical distinction for a private business is whether the rule reaches private employers or covers only government hiring.

Fifteen states have mandated the removal of conviction history questions from job applications for private employers: California, Colorado, Connecticut, Hawaii, Illinois, Maine, Maryland, Massachusetts, Minnesota, New Jersey, New Mexico, Oregon, Rhode Island, Vermont, and Washington. The District of Columbia also covers private employers. Texas is frequently added to that list in error; its 2025 bills never made it out of committee, so nothing statewide reaches a private employer there.

The remaining states with policies apply them to public sector employers, state agencies, or public contractors. If you are a private business with no government contracts operating solely in one of those states, the state rule may not reach you, but a city ordinance still might. Local ordinances are the most commonly missed layer, because business owners check the state law, find nothing, and stop looking.

Employee Thresholds: Small Does Not Mean Exempt

The single most common assumption I hear from small business owners is that these laws are aimed at large employers. The thresholds say otherwise. Several states cover businesses well under 20 employees, and a few have no minimum at all.

Read that table with your own headcount in mind. An eleven-person business in the District of Columbia is covered, and in Hawaii a two-person business is. A fourteen-person business in Illinois is outside the timing rule, but hires one more person and becomes covered mid-year without anyone noticing the change.

Obligations that flip as you grow go unnoticed at a small company, because nobody is watching the headcount for compliance triggers.

The statutes themselves are short. The District of Columbia writes its threshold as more than 10 employees, which is the 11-employee line. The Illinois Department of Labor states the trigger rather than a number: no inquiry until the applicant has been determined qualified and notified of an interview, or until a conditional offer if there is no interview.

The practical response is to build the compliant process now, before the threshold matters. The cost of removing a checkbox and training two managers is close to zero. The cost of discovering you crossed a threshold eighteen months ago and have been non-compliant since is considerably higher. This is the same logic that applies to the other headcount-triggered obligations that arrive as a business grows past 15, 20, and 50 employees.

The Federal Law and Who It Covers

There is a federal ban-the-box law, but it is narrower than most people assume. The Fair Chance to Compete for Jobs Act of 2019 was signed into law on December 20, 2019 as part of the National Defense Authorization Act. It bars federal agencies from asking applicants about criminal history before a conditional offer, and 41 U.S.C. 4714 extends the rule to federal contractors hiring for contract work.

The Office of Personnel Management issued final implementing regulations that took effect on October 2, 2023. Those regulations govern when a hiring agency or a contractor acting on its behalf can request background information, and they establish a complaint process for applicants who believe the timing rule was violated. The final rule text is published in the Federal Register.

What this means for a typical small business: if you have no federal contracts, this law does not apply to you. Your obligations come from state law, city ordinance, and the generally applicable federal rules on discrimination and consumer reporting.

Federal contractors are the exception. If you do hold or are pursuing federal contracts, the conditional-offer trigger applies to hiring for positions related to work under the contract, and it is worth building that into your process before you bid rather than after you win.

When You Can Legally Ask About Criminal History

The hiring process has four rough stages, and the jurisdiction determines which one unlocks the inquiry. Here is how the timing generally works.

Two things about this sequence are worth emphasizing for small employers. First, the stage that matters is when you ask the question or run the check, not when you make the final decision. An employer who runs a background check at the application stage and only considers it after the interview has still violated the timing rule in most jurisdictions.

Second, the conditional offer is the safe universal answer. If you hire in one state and you know its rule cold, follow that rule. If you hire in three states or have any remote employees, waiting for the conditional offer everywhere satisfies the strictest requirement and eliminates the need for anyone to remember which rule applies to which posting. Building the condition into your standard offer letter is what makes that trigger automatic rather than remembered.

Recent Changes Worth Knowing About

This is a legislatively active area, and three new rules took effect in 2026. The fourth entry is the one most guides get wrong.

Philadelphia

Philadelphia moved first, and its ordinance is one of the more demanding in the country. Per the Philadelphia Commission on Human Relations, amendments to the Fair Criminal Records Screening Standards Ordinance were enacted October 8, 2025 and took effect January 6, 2026.

The substance: an employer may consider a felony conviction or release from custody only within seven years, a misdemeanor only within four, and summary offenses not at all. The individualized assessment is now explicit, the employer has to weigh evidence of rehabilitation, and an adverse action notice has to spell out the basis for the decision and how to respond to it.

Employers with any presence in the city should read the ordinance itself rather than relying on a state-level summary, because the notice and rebuttal steps go well beyond the timing rule.

Pennsylvania has no statewide private-sector ban-the-box law, but the city ordinance is not the only rule there. Statewide, the Criminal History Record Information Act (18 Pa.C.S. 9125) lets an employer weigh felony and misdemeanor convictions only as they relate to the applicant's suitability for the job, and requires written notice when a decision not to hire rests on the record.

Washington State and Virginia

Two more changes reached employers in 2026, one on timing and one on records. Per the Washington Attorney General, the amended Washington Fair Chance Act now requires a conditional offer before any criminal record inquiry, phased in from July 1, 2026 for employers with 15 or more employees and January 1, 2027 for everyone smaller.

Virginia's change is tied to record sealing rather than timing. Its sealing chapter carried a delayed commencement and took effect July 1, 2026.

The employer rule sits in Va. Code 19.2-392.15: private employers that are not subject to federal laws or regulations in the hiring process, along with state and local agencies, may not require an applicant to disclose an arrest, charge, or conviction that has been sealed.

Willfully violating the Virginia rule is a Class 1 misdemeanor for each violation. Clean slate laws like that one catch employers off guard. A record that showed up in a background check two years ago may be legally unavailable now, and reaching for an old report rather than a fresh one is its own problem.

Texas

Texas belongs here for the opposite reason: the change did not happen. Two bills in the 2025 session, House Bill 2466 and its companion House Bill 1191, would have restricted when a private employer could ask about criminal history. Both were referred to a House subcommittee in March 2025 and never came back out.

So Texas still has no statewide private-sector rule, and a good deal of published guidance says otherwise. Austin adopted a fair chance hiring ordinance in 2016 that restricted when certain private employers could ask about a criminal record, but that ordinance is now treated as preempted and unenforced.

The preemption comes from House Bill 2127, which added Section 1.005 to the Texas Labor Code effective September 1, 2023 and voids city and county ordinances in fields the Labor Code occupies. Litigation over the law is ongoing, but for now the obligations a private employer in Texas can count on are the federal ones.

Individualized Assessment: The Part That Actually Protects You

Removing a checkbox is the easy half. The half that determines whether a hiring decision survives a challenge is what you do when a record actually comes back.

Federal enforcement guidance on the consideration of arrest and conviction records identifies three factors for evaluating whether an exclusion is job-related and consistent with business necessity. Several state fair chance laws now require this assessment explicitly, and California requires it, followed by written notice of the preliminary decision, before a conditional offer can be withdrawn.

The reason this framework matters goes beyond compliance box-checking. A blanket exclusion policy, applied to every applicant regardless of offense or role, can produce a disparate impact on protected groups even when there is no discriminatory intent whatsoever.

The individualized assessment is what converts a potentially indefensible blanket rule into a defensible, job-specific decision. The full enforcement guidance covers the analysis in detail.

One additional point that catches employers regularly: arrests are not convictions. An arrest without a conviction is not evidence that the underlying conduct occurred, and several states prohibit considering non-conviction records at all. If your screening surfaces arrest records, you are frequently looking at information you cannot legally use.

The Adverse Action Process

This obligation comes from the federal Fair Credit Reporting Act rather than from any ban-the-box law, which is precisely why employers focused on state timing rules miss it. It applies to every employer that uses a third-party background check service, regardless of headcount or state.

The sequencing here is not optional and the two notices are not interchangeable. Sending only the final notice, or sending both on the same day, defeats the purpose of the waiting period and is a common basis for claims. The FCRA compliance guide covers the disclosure and authorization requirements in more detail.

The Compliance Checklist

Here is the practical sequence for making a small business hiring process compliant. Most of it is a single afternoon of work, and the parts that recur take minutes per quarter.

The item that gets skipped most often is training the people who conduct interviews. It feels less important than fixing the form because the form is a visible artifact and a conversation is not. In practice the conversation is where violations happen, because a manager who has been asking the same screening question for six years does not spontaneously stop asking it because a PDF changed. It belongs on the same list as the other questions you cannot legally ask in an interview.

Multi-State and Remote Hiring

Remote work turned a straightforward compliance question into a complicated one for small employers. When everyone worked in one office in one state, you learned one set of rules. Now a fifteen-person company can easily have employees in six states, and each hire is a jurisdictional decision that rarely gets treated as one.

The general principle is that the law of the place where the employee physically works governs the hire. A business headquartered in a state with no private-sector rule that hires a remote employee living in California is subject to California's requirements for that hire. This is not intuitive, and it is the single most common gap I see at small multi-state employers.

The recommendation in that third row is worth stating directly, because it is the practical answer for most small businesses: pick the strictest rule that applies to any part of your footprint and use it everywhere.

You give up a small amount of flexibility in your permissive states. In exchange, you get a policy that nobody has to look up, that does not break when you hire in a new state, and that stays compliant when a state tightens its rules. For a company without a compliance function, that trade is almost always worth making.

The first sheet is what you reread each quarter, one row per place someone actually works. The second is the audit that catches the stale form, and it is worth running once against every channel rather than only against the copy you remember editing.

What Happens If You Get It Wrong

Enforcement varies widely by jurisdiction. Some states handle violations through an administrative agency, some allow private lawsuits, and many city ordinances use tiered civil penalties that escalate for repeat violations. The specific dollar amounts differ enough between jurisdictions that any general figure would be misleading.

The more useful way to think about exposure is that the fine is usually not the expensive part. A ban-the-box violation frequently arrives attached to a discrimination claim, because the practice that violated the timing rule is often the same practice that produced a disparate impact. A civil penalty for asking a question too early is one number. A discrimination claim covering a class of applicants is a different order of magnitude, and it comes with legal fees whether or not the claim succeeds.

There is also a documentation dimension. When a claim is filed, the question becomes what you can prove about how the decision was made. An employer with a written policy, dated training records, and a documented individualized assessment for the specific candidate is in a fundamentally different position than one reconstructing its reasoning after the fact.

You Can Still Screen Candidates

The name of the movement suggests otherwise, so it bears repeating: ban-the-box laws do not eliminate background checks. Every one of the fifteen private-sector states permits criminal background screening at the appropriate stage.

What changes is the sequence and the reasoning. You screen after the candidate has demonstrated they are qualified rather than before. You evaluate the specific record against the specific job rather than applying a categorical rule. You document the connection. And you follow the adverse action steps if the report contributes to a decision not to hire, which is one of the few situations where rescinding a conditional job offer is both lawful and expected.

Some positions remain exempt entirely because a background check is legally required: roles involving direct care of children or vulnerable adults, many healthcare positions, law enforcement, and certain financial services roles. If you are hiring for one of those, the mandatory screening requirement generally overrides the timing restriction, though the exact scope of the exception depends on your state.

Common Mistakes That Create Exposure

The failures below show up repeatedly at small businesses. None of them require bad intent; most are the result of a process built once and never revisited.

The pattern connecting these is that compliance here is a process problem rather than a document problem. A perfect application form paired with an untrained hiring manager and no assessment step is not a compliant process. The document is the visible part and the smallest part.

The Business Case, Briefly

This guide is about compliance, and compliance is reason enough to get this right. But there is a hiring argument worth acknowledging, particularly for small businesses in tight labor markets.

An application-stage criminal history filter removes people from your pipeline before anyone evaluates whether they can do the job. For roles that are genuinely hard to fill, that filter is expensive in a way that does not appear on any report, because you never learn who you screened out. Moving the inquiry later keeps those candidates in your applicant pool long enough for their qualifications to be judged first.

The counterargument deserves airing too. Some economists, notably in a 2016 National Bureau of Economic Research working paper, argue that these laws can produce unintended effects, including statistical discrimination when employers lacking individual information fall back on assumptions. That criticism is contested and the research is genuinely mixed. Either way, the laws are on the books in the jurisdictions where they apply, and the compliance obligation does not depend on whether the policy achieves its goals.

For a small business, the honest framing is probably this: you have to comply regardless, so the question is only whether you treat it as pure paperwork or as an occasion to look at whether your screening criteria are actually predicting job performance. Most small businesses have never examined that question, and the answer is often surprising.

How FirstHR Fits

FirstHR handles the operational layer that makes this kind of compliance sustainable: offer letters signed electronically, so the conditional offer is on record before any check runs; document management, so authorizations and notices are stored where you can find them; and structured onboarding, so the paperwork sequence runs the same way for every hire. The platform is built for small businesses where the person managing hiring is also running the company, with flat-fee plans (up to 10 people, or 11 to 50, and larger teams by quote) instead of a per-employee charge.

What no platform can do is tell you which state's rule applies to a specific hire, or make the judgment call about whether a particular conviction is job-related. Those are decisions that need a human and, in close cases, an employment attorney.

Frequently Asked Questions