Permissible purpose is the legal basis that allows a consumer reporting agency (CRA) to furnish a background check in the first place. Under 15 U.S.C. 1681b, a CRA “may furnish a consumer report under the following circumstances and no other,” and for employment purposes that also requires the employer’s certification to the CRA, a standalone written disclosure to the candidate, and the candidate’s written authorization. Without all three pieces in place, there is no lawful basis to run the check, no matter how routine the request feels.
This is not fine print. Permissible purpose is the gate the entire Fair Credit Reporting Act (FCRA) sits behind. The disclosure, the authorization, the adverse action notice, and the dispute rights all exist to support or enforce this one requirement: a report can only be pulled for a reason the law specifically allows, by someone who has proven they have that reason.
What “permissible purpose” means under the statute
The FCRA does not leave permissible purpose open to interpretation. 15 U.S.C. 1681b(a) states that a consumer reporting agency “may furnish a consumer report under the following circumstances and no other,” then lists a closed set of purposes. That phrase, “and no other,” is doing real work. It means the list in the statute is exhaustive, not illustrative. If a request does not fit one of the enumerated purposes, the CRA has no lawful basis to furnish the report, full stop.
The most common purposes an employer or landlord will recognize include a court order or grand jury subpoena, the written instructions of the consumer, a credit transaction, insurance underwriting, a government license or benefit determination, a legitimate business need connected to a transaction the consumer initiated, and, most relevant here, employment purposes under 1681b(a)(3)(B). The table below summarizes the main categories.
| Permissible purpose (15 U.S.C. 1681b(a)) | Typical use case | Extra conditions that apply |
|---|---|---|
| Court order or subpoena | Litigation, grand jury proceedings | None beyond the order itself, per 1681b(a)(1) |
| Written instructions of the consumer | Consumer directs the CRA to send their own file somewhere | Instructions must come from the consumer, per 1681b(a)(2) |
| Credit transaction | Extending, reviewing, or collecting credit | Must relate to that specific consumer’s credit relationship, per 1681b(a)(3)(A) |
| Employment purposes | Hiring, promotion, reassignment, or retention decisions | Employer certification, standalone disclosure, and written authorization required under 1681b(b) |
| Insurance underwriting | Evaluating an insurance application or renewal | Must connect to an actual underwriting decision, per 1681b(a)(3)(C) |
| Government license or benefit | Eligibility determinations tied to financial responsibility | Only where required by law to consider financial status, per 1681b(a)(3)(D) |
| Legitimate business need | A transaction the consumer initiated, or an account review | Limited to transactions the consumer started or existing accounts, per 1681b(a)(3)(F) |
Employment purposes: the extra layer the law adds
Employment is one of the enumerated purposes, but the FCRA treats it as sensitive enough to require more than the general list demands. 15 U.S.C. 1681a defines “employment purposes” broadly, as “a report used for the purpose of evaluating a consumer for employment, promotion, reassignment or retention as an employee.” That wording matters because it covers far more than the moment of hire; it reaches promotion decisions and retention decisions too.
Because employment reports touch someone’s livelihood, 1681b(b) layers on three specific requirements before a CRA may furnish a report for that purpose:
- Employer certification. Under 1681b(b)(1)(A), the employer must certify to the CRA that it has complied with the disclosure requirement, will comply with the adverse action requirement if it applies, and will not use the report in violation of equal employment opportunity law.
- Standalone written disclosure. Under 1681b(b)(2)(A)(i), a “clear and conspicuous disclosure” must be made in writing, in a document that consists solely of that disclosure, stating that a consumer report may be obtained for employment purposes. See our standalone disclosure requirement guide for what that document needs to say.
- Written authorization. Under 1681b(b)(2)(A)(ii), the consumer must authorize the procurement of the report in writing, which can be part of the same disclosure document.
Certification is the piece employers most often overlook, since it happens between employer and CRA rather than with the candidate. When a Reveal employment background check is ordered, that certification is built into account setup, but it remains the employer’s legal representation, not a checkbox.
What happens without permissible purpose
Obtaining or furnishing a report without a permissible purpose is not a paperwork gap the FCRA treats lightly. The statute creates direct civil liability, and the exposure differs depending on whether the violation is willful or negligent.
Under 15 U.S.C. 1681n(a), a person who “willfully fails to comply with any requirement” of the FCRA is liable to the consumer for actual damages “or damages of not less than $100 and not more than $1,000,” whichever is greater in cases involving false pretenses or a knowing lack of permissible purpose, plus “such amount of punitive damages as the court may allow,” and “the costs of the action together with reasonable attorney’s fees.” Willful violations are the exposure that draws the most attention because punitive damages and statutory damages are both on the table, without the consumer having to prove a specific dollar loss.
Negligent noncompliance carries its own liability under 15 U.S.C. 1681o(a): actual damages sustained by the consumer, plus costs and reasonable attorney’s fees in a successful action. There is no statutory damages floor for negligence, but actual damages and fee-shifting are still real exposure, and a pattern of negligent handling is often what turns into a willfulness argument later.
The CRA itself is not a passive party in this. Under 15 U.S.C. 1681e(a), “every consumer reporting agency shall maintain reasonable procedures designed to avoid violations of section 1681c” and “to limit the furnishing of consumer reports to the purposes listed under section 1681b.” That same section requires the CRA to make “a reasonable effort to verify the identity of a new prospective user and the uses certified by such prospective user prior to furnishing such user a consumer report,” and it bars furnishing a report to anyone the CRA has “reasonable grounds for believing” will not use it for a listed purpose. Permissible purpose is a shared obligation. The employer has to have it, and the CRA has a statutory duty to check for it.
Common employer mistakes
Treating current employees like they need nothing new
Because “employment purposes” under 1681a explicitly includes promotion, reassignment, and retention, not just initial hiring, a screening request tied to an internal move is still an employment purpose under the statute. A federal circular on employment screening notes that employers using consumer reports “both initially when hiring workers and for subsequent employment purposes” must comply with FCRA obligations. Treating a re-screen or promotion check as something that needs no fresh disclosure and authorization is a common gap; confirm your specific process with counsel rather than assuming an original hiring disclosure covers everything that comes later.
Using a report for a purpose it was not obtained for
A report pulled for employment purposes was authorized for that purpose alone. Repurposing it for a lending decision, a tenancy decision, or any use the consumer did not consent to steps outside the certified purpose, exactly the scenario 1681n and 1681o penalize.
Missing the investigative consumer report distinction
Not every consumer report is the same under the statute. 15 U.S.C. 1681a(e) defines an “investigative consumer report” as one where information on “character, general reputation, personal characteristics, or mode of living” comes from personal interviews with neighbors, friends, or associates, rather than from records. When a report fits that definition, 15 U.S.C. 1681d(a) adds its own disclosure, on top of the standard employment disclosure, that must be delivered within three days of the report being requested and must explain the consumer’s right to request more detail about the investigation. Employers who assume every report is a standard consumer report can miss this separate notice obligation.
How this connects to the rest of the process
Permissible purpose only gets a check started lawfully. What happens afterward is governed by its own rules. If the report points toward a negative decision, the employer’s obligations under the adverse action process kick in, including a pre-adverse notice, a copy of the report, the Summary of Rights, and a reasonable waiting period before any final notice. If the candidate believes something in the report is wrong, the dispute process gives them a direct path to the CRA to have it reinvestigated. Because state law can further limit how far back certain records may be reported, it is worth reviewing how the seven year rule varies by state before assuming a report can go back indefinitely. None of these steps substitute for permissible purpose; they sit downstream of it. Reveal’s pricing page outlines plan options for employers building a compliant screening process.
None of this changes the core point: a background check is information that requires human review and an individualized decision, not a verdict, and criminal history alone does not lawfully disqualify a candidate without that review. Permissible purpose determines whether a report can be pulled at all. It says nothing about what a hiring manager should conclude once it exists.
Frequently asked questions
What does “permissible purpose” mean under the FCRA?
It is the legal basis a consumer reporting agency must have before furnishing a background check. Under 15 U.S.C. 1681b(a), a CRA “may furnish a consumer report under the following circumstances and no other,” and the statute lists a closed set of allowed purposes, including employment purposes.
What does an employer need before ordering a background check on a candidate?
Under 15 U.S.C. 1681b(b), the employer must certify to the CRA that it has met its disclosure obligations, provide the candidate a clear and conspicuous standalone written disclosure that a report may be obtained for employment purposes, and get the candidate’s written authorization before the report is procured.
Does an employer need new authorization to screen a current employee?
“Employment purposes” under 15 U.S.C. 1681a covers evaluating someone “for employment, promotion, reassignment or retention as an employee,” which reaches decisions beyond initial hiring. Because the specific disclosure and authorization steps required for a given screening event depend on your process and jurisdiction, confirm your approach with your own employment counsel.
What happens if a company obtains a report without a permissible purpose?
The FCRA creates civil liability. Willful violations can trigger statutory damages of “not less than $100 and not more than $1,000,” punitive damages, and attorney’s fees under 15 U.S.C. 1681n(a). Negligent violations can trigger actual damages and attorney’s fees under 15 U.S.C. 1681o(a).
Related Reading
This article is general information, not legal advice. FCRA requirements and related state and local laws change over time and vary by jurisdiction, and employers should confirm their current obligations with their own counsel before making screening or hiring decisions.
