Ban the Box Laws: A Small Business Compliance Guide

The first time ban the box came up for me, it was not in a compliance review. It was a hiring manager forwarding me an application form she had downloaded from our own careers page, with a note that said something like: is this still allowed? The form had a checkbox near the bottom asking whether the applicant had ever been convicted of a crime. Nobody had touched that PDF in three years. It had been legal when it was written and it was not legal anymore, in at least two of the states where we were hiring.

That is how this issue actually shows up for small businesses. Not as a policy debate about criminal justice reform, but as a form nobody updated, a phone screen where a manager asked a question they should not have asked, or a remote hire in a state whose rules nobody thought to check. The laws themselves are not especially complicated. Keeping track of which ones apply to you is the hard part, and it gets harder every legislative session.

Most articles on this topic are written by background check vendors selling screening services, or by advocacy organizations writing for job seekers. Both are useful and neither is quite what a business owner with 20 employees needs. This guide covers what these laws actually require of you as an employer: which states have them, how low the employee thresholds go, when you can legally ask about criminal history, how to run a defensible assessment when a record comes back, and how to keep a small hiring process compliant without hiring a compliance officer. I built FirstHR for businesses in exactly that position, where the person handling HR is also the person running the company.

What Ban the Box Actually Means

The plainest way to understand these laws: they change the order of operations in hiring. They do not create a protected class, they do not prohibit criminal background checks, and they do not require you to hire anyone. They move the criminal history question from the front of the process to somewhere further back, on the theory that a candidate who has already demonstrated they can do the job gets a fairer hearing than a stack of applications sorted by checkbox.

Three things follow from that framing, and each one trips up employers who have not read the actual statute. First, the checkbox is a symbol, not the whole rule. Removing it from the PDF while a hiring manager still asks the question in a phone screen is a violation in most jurisdictions, because the laws regulate the inquiry rather than the format. Second, the permitted stage varies. Some states let you ask once you invite someone to interview; others make you wait for a conditional offer. Third, several states pair the timing rule with additional obligations, and those additional obligations are usually where the real compliance work lives.

What these laws do not do is worth stating just as plainly. You can still run a criminal background check. You can still decline to hire someone based on a conviction that is genuinely relevant to the job. You can still exclude candidates outright for positions where a background check is legally mandated, such as roles involving children, healthcare, law enforcement, or certain financial services. The background check guide covers the screening process itself in more depth.

Where These Laws Came From

The movement traces back to organizing work by All of Us or None, a group of formerly incarcerated people and their families, which pushed the first ban-the-box campaigns in the early 2000s. Hawaii had moved earlier, restricting when employers could consider conviction records back in the late 1990s. The idea spread first through city ordinances, then to state legislatures, and eventually to federal hiring.

The pace picked up substantially over the last decade. Early policies covered only public sector employers, on the reasoning that government could set an example without imposing obligations on private business. That line held for a while and then it did not. California, Illinois, and others extended their rules to private employers, and once a few large states did it, the model spread. The federal government adopted the approach for its own hiring and for contractors acting on its behalf.

This history matters for one practical reason: the legal landscape is still moving. A guide written two years ago is out of date in several states. Texas passed its first statewide private-sector rule in 2025. Philadelphia, Washington State, and Virginia all made changes in 2026. If you set up a compliant process and never revisited it, there is a reasonable chance it is no longer compliant somewhere in your footprint. The employment law overview covers the broader set of rules that shift on a similar cadence.

Ban the Box vs Fair Chance vs Federal Guidance

These three terms get used interchangeably and they are not the same thing. Understanding the difference tells you how much work compliance actually requires in a given state.

The distinction that matters most for a small employer: in a state with a bare ban-the-box rule, compliance can be as simple as fixing your application form and training your interviewers. In a state with a comprehensive fair chance act, you also need a documented assessment process and specific written notices at specific points. Those are very different amounts of work, and the first step is knowing which category your state falls into.

Federal anti-discrimination guidance sits underneath both. Even in a state with no ban-the-box law at all, a blanket policy of rejecting every applicant with a conviction can create legal exposure if it produces a disparate impact. The discrimination claims guide covers how disparate impact analysis works in employment decisions generally.

Which States Have Ban the Box Laws

Research from the National Employment Law Project documents 37 states with some form of ban-the-box or fair-chance policy, plus the District of Columbia and more than 150 cities and counties. The critical distinction for a private business is whether the rule reaches private employers or covers only government hiring.

Fifteen states have mandated the removal of conviction history questions from job applications for private employers: California, Colorado, Connecticut, Hawaii, Illinois, Maine, Maryland, Massachusetts, Minnesota, New Jersey, New Mexico, Oregon, Rhode Island, Vermont, and Washington. The District of Columbia also covers private employers. Texas joined the group of states with statewide private-sector requirements when its law took effect in September 2025.

The remaining states with policies apply them to public sector employers, state agencies, or public contractors. If you are a private business with no government contracts operating solely in one of those states, the state rule may not reach you, but a city ordinance still might. Local ordinances are the most commonly missed layer, because business owners check the state law, find nothing, and stop looking.

Employee Thresholds: Small Does Not Mean Exempt

The single most common assumption I hear from small business owners is that these laws are aimed at large employers. The thresholds say otherwise. Several states cover businesses well under 20 employees, and a few have no minimum at all.

Read that table with your own headcount in mind. A twelve-person business in Hawaii or the District of Columbia is covered. A fourteen-person business in Texas or Illinois is not, but hires one more person and becomes covered mid-year without anyone noticing the change. Threshold-based obligations that flip as you grow are exactly the kind of thing that goes unnoticed at a small company, because nobody is watching the headcount for compliance triggers.

The practical response is to build the compliant process now, before the threshold matters. The cost of removing a checkbox and training two managers is close to zero. The cost of discovering you crossed a threshold eighteen months ago and have been non-compliant since is considerably higher. This is the same logic that applies to the other headcount-triggered obligations that arrive as a business grows past 15, 20, and 50 employees.

The Federal Law and Who It Covers

There is a federal ban-the-box law, but it is narrower than most people assume. The Fair Chance to Compete for Jobs Act of 2019 was signed into law on December 20, 2019 as part of the National Defense Authorization Act. It prohibits federal agencies and federal contractors acting on their behalf from requesting criminal history information before making a conditional offer of employment.

The Office of Personnel Management issued final implementing regulations that took effect on October 2, 2023. Those regulations govern when a hiring agency or a contractor acting on its behalf can request background information, and they establish a complaint process for applicants who believe the timing rule was violated. The final rule text is published in the Federal Register.

What this means for a typical small business: if you have no federal contracts, this law does not apply to you. Your obligations come from state law, city ordinance, and the generally applicable federal rules on discrimination and consumer reporting. If you do hold or are pursuing federal contracts, the conditional-offer trigger applies to hiring done on the government's behalf, and it is worth building that into your process before you bid rather than after you win.

When You Can Legally Ask About Criminal History

The hiring process has four rough stages, and the jurisdiction determines which one unlocks the inquiry. Here is how the timing generally works.

Two things about this sequence are worth emphasizing for small employers. First, the stage that matters is when you ask or when you run the check, not when you make the final decision. An employer who runs a background check at the application stage and only considers it after the interview has still violated the timing rule in most jurisdictions.

Second, the conditional offer is the safe universal answer. If you hire in one state and you know its rule cold, follow that rule. If you hire in three states or have any remote employees, waiting for the conditional offer everywhere satisfies the strictest requirement and eliminates the need for anyone to remember which rule applies to which posting. The hiring process guide covers where this step fits into the overall sequence.

Recent Changes Worth Knowing About

This is a legislatively active area, and several changes landed within the last year that affect employers who previously had no obligations.

Texas. House Bill 2466 took effect September 1, 2025, making Texas the first traditionally light-regulation state to adopt a statewide private-sector rule. It applies to private employers with 15 or more employees and to public employers of any size. Employers cannot ask about criminal history on an initial application; the inquiry is permitted once the candidate has been found otherwise qualified and has either been invited to interview or given a conditional offer. Independent contractors and gig workers are outside the law's protections, and positions where criminal history review is required by law, including law enforcement, healthcare, childcare, and financial services, are excepted. The Texas hiring guide covers the state's broader employment requirements.

Philadelphia. The city expanded its fair chance rules in January 2026, including a shortened look-back period for misdemeanor convictions. Philadelphia has one of the more demanding local ordinances in the country, and employers with any presence there should read the ordinance itself rather than relying on a state-level summary.

Washington State and Virginia. Both made changes effective July 2026, with Washington strengthening its fair chance hiring requirements and Virginia's changes tied to record sealing. Clean slate laws, which seal certain records automatically after a period of time, interact with hiring in a way that catches employers off guard: a record that appeared in a background check two years ago may be legally unavailable now, and using an old report is its own problem.

Individualized Assessment: The Part That Actually Protects You

Removing a checkbox is the easy half. The half that determines whether a hiring decision survives a challenge is what you do when a record actually comes back.

Federal enforcement guidance on the consideration of arrest and conviction records identifies three factors for evaluating whether an exclusion is job-related and consistent with business necessity. Several state fair chance laws now require this assessment explicitly, and California requires it in writing before a conditional offer can be withdrawn.

The reason this framework matters goes beyond compliance box-checking. A blanket exclusion policy, applied to every applicant regardless of offense or role, can produce a disparate impact on protected groups even when there is no discriminatory intent whatsoever. The individualized assessment is what converts a potentially indefensible blanket rule into a defensible, job-specific decision. The full enforcement guidance covers the analysis in detail.

One additional point that catches employers regularly: arrests are not convictions. An arrest without a conviction is not evidence that the underlying conduct occurred, and several states prohibit considering non-conviction records at all. If your screening surfaces arrest records, you are frequently looking at information you cannot legally use.

The Adverse Action Process

This obligation comes from the federal Fair Credit Reporting Act rather than from any ban-the-box law, which is precisely why employers focused on state timing rules miss it. It applies to every employer that uses a third-party background check company, regardless of headcount or state.

The sequencing here is not optional and the two notices are not interchangeable. Sending only the final notice, or sending both on the same day, defeats the purpose of the waiting period and is a common basis for claims. The FCRA compliance guide covers the disclosure and authorization requirements in more detail.

The Compliance Checklist

Here is the practical sequence for making a small business hiring process compliant. Most of it is a single afternoon of work, and the parts that recur take minutes per quarter.

The item that gets skipped most often is training the people who conduct interviews. It feels less important than fixing the form because the form is a visible artifact and a conversation is not. In practice the conversation is where violations happen, because a manager who has been asking the same screening question for six years does not spontaneously stop asking it because a PDF changed. The structured interview guide covers how to standardize what interviewers ask, which solves this problem and several others at the same time.

Multi-State and Remote Hiring

Remote work turned a straightforward compliance question into a complicated one for small employers. When everyone worked in one office in one state, you learned one set of rules. Now a fifteen-person company can easily have employees in six states, and each hire is a jurisdictional decision that rarely gets treated as one.

The general principle is that the law of the place where the employee physically works governs the hire. A business headquartered in a state with no private-sector rule that hires a remote employee living in California is subject to California's requirements for that hire. This is not intuitive, and it is the single most common gap I see at small multi-state employers.

The recommendation in that third row is worth stating directly, because it is the practical answer for most small businesses: pick the strictest rule that applies to any part of your footprint and use it everywhere. You give up a small amount of flexibility in your permissive states. In exchange, you get a policy that nobody has to look up, that does not break when you hire in a new state, and that stays compliant when a state tightens its rules. For a company without a compliance function, that trade is almost always worth making.

What Happens If You Get It Wrong

Enforcement varies widely by jurisdiction. Some states handle violations through an administrative agency, some allow private lawsuits, and many city ordinances use tiered civil penalties that escalate for repeat violations. The specific dollar amounts differ enough between jurisdictions that any general figure would be misleading.

The more useful way to think about exposure is that the fine is usually not the expensive part. A ban-the-box violation frequently arrives attached to a discrimination claim, because the practice that violated the timing rule is often the same practice that produced a disparate impact. A civil penalty for asking a question too early is one number. A discrimination claim covering a class of applicants is a different order of magnitude, and it comes with legal fees whether or not the claim succeeds.

There is also a documentation dimension. When a claim is filed, the question becomes what you can prove about how the decision was made. An employer with a written policy, dated training records, and a documented individualized assessment for the specific candidate is in a fundamentally different position than one reconstructing its reasoning after the fact. The complaint process guide covers what to expect if a claim is filed.

You Can Still Screen Candidates

It is worth restating this because the name of the movement suggests otherwise to people encountering it for the first time. Ban-the-box laws do not eliminate background checks. Every one of the fifteen private-sector states permits criminal background screening at the appropriate stage.

What changes is the sequence and the reasoning. You screen after the candidate has demonstrated they are qualified rather than before. You evaluate the specific record against the specific job rather than applying a categorical rule. You document the connection. And you follow the adverse action steps if the report contributes to a decision not to hire.

Some positions remain exempt entirely because a background check is legally required: roles involving direct care of children or vulnerable adults, many healthcare positions, law enforcement, and certain financial services roles. If you are hiring for one of those, the mandatory screening requirement generally overrides the timing restriction, though the exact scope of the exception depends on your state. The pre-employment screening guide covers the full range of checks and where each fits in the process.

Common Mistakes That Create Exposure

The failures below show up repeatedly at small businesses. None of them require bad intent; most are the result of a process built once and never revisited.

The pattern connecting these is that compliance here is a process problem rather than a document problem. A perfect application form paired with an untrained hiring manager and no assessment step is not a compliant process. The document is the visible part and the smallest part. The hiring bias guide covers the broader set of process controls that reduce this category of risk.

The Business Case, Briefly

This guide is about compliance, and compliance is reason enough to get this right. But there is a hiring argument worth acknowledging, particularly for small businesses in tight labor markets.

An application-stage criminal history filter removes people from your pipeline before anyone evaluates whether they can do the job. For roles that are genuinely hard to fill, that filter is expensive in a way that does not appear on any report, because you never learn who you screened out. Employers who have moved the inquiry later in the process frequently report that the candidate pool got meaningfully larger without the quality of hires changing.

The counterargument deserves airing too. Some employers, including some in the background screening industry, argue that these laws can produce unintended effects, including statistical discrimination when employers lacking individual information fall back on assumptions. That criticism is contested and the research is genuinely mixed. Either way, the laws are on the books in the jurisdictions where they apply, and the compliance obligation does not depend on whether the policy achieves its goals.

For a small business, the honest framing is probably this: you have to comply regardless, so the question is only whether you treat it as pure paperwork or as an occasion to look at whether your screening criteria are actually predicting job performance. Most small businesses have never examined that question, and the answer is often surprising.

How FirstHR Fits

FirstHR handles the operational layer that makes this kind of compliance sustainable: standardized application and offer workflows so a stale form cannot survive in three places at once, document management so authorizations and notices are stored where you can find them, and structured onboarding so the paperwork sequence runs the same way for every hire. The platform is built for businesses with 5 to 50 employees where the person managing hiring is also running the company, at flat-fee pricing rather than per-employee pricing that punishes you for growing.

What no platform can do is tell you which state's rule applies to a specific hire, or make the judgment call about whether a particular conviction is job-related. Those are decisions that need a human and, in close cases, an employment attorney. The new hire paperwork guide covers the document sequence that follows once a hiring decision is made, and the onboarding compliance guide covers the federal and state requirements that attach after the offer is accepted.

For businesses hiring their first employee and setting up these processes from scratch, the first hire guide covers the full sequence of obligations that arrive with employee number one.

Frequently Asked Questions