A compliant California employer background check policy has to do six things in order: deliver standalone disclosures and get written consent, exclude the categories of information state law puts off-limits, hold any criminal history inquiry until after a conditional offer, run a documented individualized assessment before denying anyone based on a conviction, follow the two-step adverse action notice process, and retain and dispose of the records correctly. California layers its Consumer Credit Reporting Agencies Act, Investigative Consumer Reporting Agencies Act, and Fair Chance Act on top of the federal Fair Credit Reporting Act, and the state rules are stricter at nearly every step.
Disclosure and Written Authorization
Before any report is ordered, the applicant must receive a written disclosure and sign a written authorization. Under federal law, the disclosure has to appear in a standalone document, with no application language, no liability waivers, and no additional paragraphs. It must say clearly that a consumer report may be obtained for employment purposes, and the authorization must be signed before the report is pulled.1Office of the Law Revision Counsel. 15 U.S. Code 1681b – Permissible Purposes of Consumer Reports
California adds more. The disclosure and the consent must be separate from the employment application and from any other document, and the disclosure must identify the specific consumer reporting agency that will conduct the search. If the employer orders an investigative consumer report, which involves personal interviews about character or reputation rather than database searches alone, the ICRAA requires additional notice, including informing the applicant of the right to request a description of the scope of the investigation.
If a credit report is part of the screening, the CCRAA requires its own separate written notice. That notice has to explain that a credit report will be used, identify the legal basis for the credit check, and give the applicant a checkbox to receive a free copy of the report.2California Legislative Information. California Civil Code 1785.20.5 Most California employers end up with at least two standalone consent forms: one for the general background check and one for any credit report.
Information the Policy Cannot Consider
Criminal Records That Are Off-Limits
Arrests or detentions that did not lead to a conviction cannot be considered. Neither can participation in a pretrial or post-trial diversion program. Convictions that have been sealed, dismissed, expunged, or otherwise legally cleared must be treated as if they never happened. These prohibitions apply no matter how the information surfaced, whether through a screening report, an internet search, or the applicant volunteering it.
California also caps criminal reporting at seven years. Under Civil Code section 1785.13, a consumer reporting agency cannot include any record of arrest, complaint, or conviction that predates the report by more than seven years from the date of disposition, release, or parole. That reaches further than federal law, which applies its seven-year limit only to non-conviction adverse information.3SHRM. FCRA’s Seven-Year Reporting Window Begins with Charge, Not Dismissal In California, even a serious conviction drops off a background report once seven years have passed since the sentence was completed.
Credit Reports
Labor Code section 1024.5 bars the use of a consumer credit report for hiring unless the job falls into a specific statutory exception. The permitted categories are managerial positions, law enforcement roles, positions with the Department of Justice, jobs requiring access to confidential personal information or financial data, positions with signatory authority over large transactions, and roles where a credit check is required by law.4California Legislative Information. California Labor Code 1024-5 If the job does not fit one of those categories, pulling the credit report violates state law even with the applicant’s consent.
Social Media Credentials
Labor Code section 980 prohibits requiring or requesting that an applicant or employee hand over a username or password for personal social media, access personal social media in the employer’s presence, or connect the employer to any personal account. The policy should limit any social media screening to publicly available content. Public profiles are fair game; anything behind a privacy wall is not.
When You Can Ask About Criminal History
The Fair Chance Act, Government Code section 12952, controls timing. Employers with five or more employees cannot ask about or consider conviction history until a conditional offer of employment has been extended.5California Civil Rights Department. Fair Chance Act: Guidance for California Employers and Job Applicants The job application cannot contain any question about criminal convictions, and no one involved in hiring should be researching the applicant’s criminal background earlier in the process.6California Department of Human Resources. 1211 – Criminal History Background Checks
The timing rule applies regardless of the source. Running a formal background check before the conditional offer is an obvious violation. So is searching the applicant’s name online and finding news coverage of a past conviction. If the applicant volunteers a conviction during an interview, the conversation needs to move on, and that information cannot be weighed until after the conditional offer stage.
The Individualized Assessment
Finding a conviction on a report does not, by itself, justify rescinding an offer. Before denying employment, the employer must conduct an individualized assessment of whether the conviction has a direct and adverse relationship to the specific duties of the position. The assessment weighs three factors:
- The nature and gravity of the offense. A violent felony and a minor theft do not carry the same weight.
- The time that has elapsed since the offense and since the applicant completed the sentence, including any parole or probation.
- The nature of the job, meaning the actual duties and responsibilities of the position offered, not a generic sense of risk.
A blanket rule disqualifying anyone with a felony will not survive scrutiny. Context is the point of the assessment: a decade-old DUI matters to a delivery driver position in a way it does not matter to a desk job. The policy should require whoever conducts the assessment to document the analysis of all three factors in writing. The statute does not expressly require written documentation of the internal analysis, but if the decision is challenged later, that documentation is the best evidence that the process was genuine.
The Two-Step Adverse Action Process
If the assessment points toward denial, California requires a two-step notice process that is more demanding than the federal FCRA procedure. Skipping a step or rushing the clock is one of the most expensive mistakes an employer can make.
Preliminary (Pre-Adverse Action) Notice
Before any final decision, the employer sends a written preliminary notice. It must identify the specific conviction or convictions that form the basis for the potential denial and include a copy of the conviction history report if one was used. The applicant then has at least five business days to respond.7Civil Rights Department (CRD). Fair Chance Act: Criminal History and Employment
During that window the applicant can submit evidence of rehabilitation, explain mitigating circumstances, or challenge the accuracy of the report. If the applicant disputes the accuracy within the initial five business days, they get another five business days to gather and submit supporting evidence, pushing the potential waiting period to ten business days.7Civil Rights Department (CRD). Fair Chance Act: Criminal History and Employment
Reassessment
If the applicant submits anything, the employer must actually reconsider the preliminary decision in light of what was provided. The reassessment is not a formality. Proceeding with denial without engaging meaningfully with strong rehabilitation evidence or a documented error in the report will make the original assessment look pretextual.
Final Adverse Action Notice
Only after the response period has run and the employer has considered any submitted information can the final adverse action notice issue. That notice states that the conditional offer is being rescinded, and it must contain:
- The name, address, and phone number of the consumer reporting agency that supplied the report.
- A statement that the reporting agency did not make the employment decision and cannot explain why it was made.
- Notice of the applicant’s right to dispute the accuracy of the report directly with the reporting agency and to obtain a free copy of the report within 60 days.
- Notice, under California law, of the right to file a complaint with the California Civil Rights Department if the applicant believes the Fair Chance Act was violated.
The final notice must also identify the specific conviction or convictions behind the decision and describe any existing procedure for the applicant to challenge the decision or request reconsideration. A vague denial letter missing any of these elements creates liability under both federal and state law.
Retention and Disposal of Screening Records
California requires employers to keep personnel records, including employment applications and related hiring documents, for at least three years after the personnel action or, for terminated employees, three years after termination. Background check authorization forms and the reports themselves are part of that hiring file and carry the same three-year minimum. The federal EEOC floor is one year from the date the record was made or the personnel action was taken, whichever is later, so California’s longer rule controls for employers in the state.8U.S. Equal Employment Opportunity Commission. Summary of Selected Recordkeeping Obligations in 29 CFR Part 1602 If a discrimination charge is filed, all records related to the charge must be retained until the matter is fully resolved, regardless of how long that takes.
Disposal has its own rule. The federal Disposal Rule requires anyone holding consumer report information to take reasonable measures to prevent unauthorized access when getting rid of it. Acceptable methods include shredding or pulverizing paper and destroying or erasing electronic files so the data cannot be reconstructed.9eCFR. Part 682 – Disposal of Consumer Report Information and Records An employer using a third-party destruction vendor must exercise due diligence in selecting the vendor and monitor compliance with the destruction contract.
What Noncompliance Costs
Financial exposure comes from two directions, and the two can stack in a single lawsuit.
A willful FCRA violation carries statutory damages between $100 and $1,000 per affected applicant, with no requirement to prove actual harm. Punitive damages are available on top, with no statutory cap, and the prevailing applicant recovers attorney fees and costs.10Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance A negligent violation, where the employer tried to comply but got something wrong, allows actual damages plus attorney fees, with no statutory or punitive damages.11Office of the Law Revision Counsel. 15 U.S. Code 1681o – Civil Liability for Negligent Noncompliance Because FCRA claims typically arrive as class actions, a defective standalone disclosure used across every applicant for two years can turn a per-person cap into a very large settlement.
Fair Chance Act violations are enforced through the California Fair Employment and Housing Act. An applicant can file a complaint with the Civil Rights Department, which may investigate, attempt conciliation, or bring a civil action. Available remedies include hiring orders, back pay, compensatory damages for emotional distress, and civil penalties. FCRA claims target the procedural mechanics of the screening process, while FEHA claims target the use of the criminal history itself, so the same hiring decision can produce both if the disclosure was defective and the individualized assessment was mishandled.