Most employers who run background checks never think about the Fair Credit Reporting Act until something goes wrong. A candidate disputes a denial. A plaintiff’s firm sends a demand letter naming the disclosure form. A class action gets filed over an adverse action notice that went out a day too early. At that point, the question stops being theoretical: what does an FCRA violation actually cost, and who can come after the company for it.
The FCRA governs how employers use consumer reports in hiring, and it builds in its own enforcement mechanism. Consumers can sue directly. Regulators can bring their own actions. And a growing number of states layer additional penalties on top of the federal floor. None of this requires a company to have intended harm. It requires a paperwork mistake that a court decides was avoidable.
Willful vs. Negligent Noncompliance: Two Very Different Exposure Levels
The FCRA splits civil liability into two tracks, and the difference between them is enormous.
Under 15 U.S.C. § 1681n, a person who willfully fails to comply with the Act is liable for actual damages or statutory damages of not less than $100 and not more than $1,000 per violation, whichever is greater, plus any punitive damages a court allows, plus the consumer’s attorney’s fees and costs if the action succeeds. Courts have read “willful” to include reckless disregard of the statute, not just knowing violations, which is why so many class actions are pleaded as willful claims. Punitive damages under this section have no statutory ceiling.
Under 15 U.S.C. § 1681o, negligent noncompliance is narrower. The consumer can recover actual damages sustained as a result of the failure, plus costs and reasonable attorney’s fees if the action succeeds. There is no statutory damages floor and no punitive damages available under this section. A consumer has to show real harm to collect anything meaningful.
| Element | Willful noncompliance (§ 1681n) | Negligent noncompliance (§ 1681o) |
|---|---|---|
| Damages available | Actual damages or $100 to $1,000 statutory damages per violation, whichever is greater | Actual damages only, no statutory floor |
| Punitive damages | Available, no fixed cap | Not available |
| Attorney’s fees | Awarded to prevailing consumer | Awarded to prevailing consumer |
| What triggers it | Knowing violation, or reckless disregard of the statute’s requirements | Ordinary carelessness that a reasonable process would have caught |
| Why it matters to employers | Statutory damages apply even with no proven harm, which is what makes class certification attractive to plaintiffs’ counsel | Lower ceiling, but still exposes the company to fee-shifting |
The practical effect is that a single defective form, used across thousands of applicants, turns a $100 to $1,000 per-person exposure into a multi-million dollar number the moment a court treats the conduct as reckless rather than merely careless.
The Class Action Pattern: Timing and Form Language, Not Intent
Almost none of the large FCRA class actions against employers involve a company that decided to break the law. They involve a form or a workflow that drifted out of compliance and got used at volume before anyone noticed.
The two claims that show up most often are:
- Standalone disclosure violations. The FCRA requires that before an employer procures a consumer report, it give the applicant a clear and conspicuous written disclosure in a document that consists solely of that disclosure. See 15 U.S.C. § 1681b(b)(2)(A). Employers who fold the disclosure into an employment application, a liability waiver, or a summary of rights create a “stand alone” defect that plaintiffs’ firms specifically look for. We cover the mechanics of this in our FCRA standalone disclosure requirement guide.
- Adverse action timing violations. Before taking adverse action based on a report, the employer must give the applicant a copy of the report and a summary of FCRA rights, then wait a reasonable period before finalizing the decision. That two-step sequence comes from 15 U.S.C. § 1681b(b)(3)(A), with the post-decision notice duties set out in 15 U.S.C. § 1681m(a). Employers who send the final rejection before the applicant has had a real chance to respond, or who skip the pre-adverse step entirely, create the fact pattern behind most adverse action suits. Our FCRA adverse action process guide walks through the sequence step by step.
What makes these claims attractive as class actions is that the defect is usually applied uniformly. If one form was missing the standalone requirement, every applicant who signed that form during that period arguably has the same claim, which is exactly the kind of common question that supports class certification.
FTC and CFPB Enforcement Authority
Private lawsuits are not the only exposure. The FCRA is also enforced by federal regulators, separately from any individual consumer’s right to sue.
The Federal Trade Commission has long-standing authority over FCRA compliance for entities outside its scope, and publishes guidance directly aimed at employers on how they may lawfully use background checks in hiring. See the FTC’s guidance on using consumer reports for employment purposes and the agency’s FCRA statute and enforcement page.
The Consumer Financial Protection Bureau holds rulemaking and supervisory authority over the FCRA for many entities through Regulation V, codified at 12 C.F.R. Part 1022. A regulatory inquiry does not require a consumer to have filed a lawsuit first, and it can surface compliance gaps across a company’s entire screening program rather than one applicant’s file.
State Law Adds a Second, Sometimes Larger, Layer
The FCRA sets a federal floor. States are free to add their own consumer reporting statutes with their own remedies, and some of those state penalties are steeper than the federal ones.
California’s Investigative Consumer Reporting Agencies Act is a clear example. Under California Civil Code § 1786.50, an agency or user that fails to comply is liable for actual damages or, outside of class actions, a flat $10,000, whichever is greater, plus attorney’s fees, plus punitive damages if the violation was grossly negligent or willful. That is ten times the top end of the federal statutory damages figure, on a per-person basis, before punitive damages are even considered.
Other states run their own background check statutes with their own notice timing, form content, or disclosure requirements layered on top of the FCRA. An employer that only builds its process around federal law can still be exposed in any state that has gone further, and state requirements do not always track the federal ones exactly. This is one of the reasons a single, generic screening workflow used everywhere is riskier than it looks.
Where the Failures Actually Happen
Reviewing how these claims arise, the failure points repeat:
- No standalone disclosure, or a disclosure buried in other paperwork. The document has to consist solely of the disclosure. Adding liability waivers, at-will language, or other consents to the same page is the single most common defect.
- No pre-adverse action step, or one that happens too fast. Sending the final adverse action notice the same day as, or before, the pre-adverse notice defeats the purpose of giving the applicant a chance to respond.
- Stale or non-compliant forms. The FCRA’s summary of consumer rights document changes periodically, and a form that was correct a few years ago is not automatically correct now.
- No permissible purpose, or a purpose that does not match how the report is used. A consumer report may only be furnished for a purpose listed in 15 U.S.C. § 1681b, and employment purposes carry their own certification requirements under subsection (b). Running a report on someone who never applied, or for a role the disclosure never described, sits outside that authority.
- Treating the report and the credit reporting agency’s rights summary as optional paperwork. The agency’s rights summary has to reach the applicant, not just exist in a file somewhere.
What a Compliant Process Looks Like End to End
None of this requires exotic legal work. It requires a sequence that gets followed the same way every time:
- Confirm a permissible purpose exists before ordering a report, and use a background check product built around employment screening, such as our employment background check service.
- Provide the standalone disclosure, on its own document, and get written authorization before the report is procured.
- Order the report only after both steps are complete.
- If the results support adverse action, send the pre-adverse notice with a copy of the report and the summary of rights, and give the applicant a genuine opportunity to respond before finalizing anything.
- If the decision stands, send the adverse action notice with the agency’s contact information and the applicant’s dispute and free-copy rights.
- Keep the forms current and keep records of what was sent and when.
Getting this right is also a cost question, not just a compliance question. Screening pricing and turnaround vary by package and volume; our pricing page breaks down what different levels of screening cost so employers can budget for a program that is built correctly the first time, rather than paying for a cheaper process now and a defense later.
Frequently asked questions
What is the difference between willful and negligent FCRA violations?
Willful violations, covered by 15 U.S.C. § 1681n, involve a knowing violation or reckless disregard of the statute’s requirements, and expose the employer to statutory damages of $100 to $1,000 per violation even without proof of actual harm, plus possible punitive damages. Negligent violations, covered by 15 U.S.C. § 1681o, require the consumer to show actual damages, with no statutory floor and no punitive damages available.
How much can an employer be fined for an FCRA violation?
The FCRA does not impose a government fine on employers directly for a single violation. Exposure comes through civil liability to the consumer under 15 U.S.C. §§ 1681n and 1681o, which can include statutory damages, actual damages, punitive damages, and attorney’s fees, and through separate enforcement action by regulators such as the FTC or CFPB. Some states, including California, add their own statutory damages figures on top of the federal amounts.
Can employees or applicants sue employers directly under the FCRA?
Yes. The FCRA creates a private right of action, meaning a consumer can sue an employer directly for willful or negligent noncompliance without waiting for a regulator to act first.
Do state laws add extra penalties beyond the FCRA?
In some states, yes. California’s Investigative Consumer Reporting Agencies Act, for example, allows a consumer to recover actual damages or a flat $10,000 outside of class actions, whichever is greater, plus attorney’s fees and possible punitive damages. State requirements and remedies vary, so employers operating in multiple states should not assume federal compliance alone covers every state’s rules.
What is the most common FCRA mistake that leads to a lawsuit?
The two most common triggers are a standalone disclosure that is not truly standalone, meaning it is combined with other paperwork on the same document, and an adverse action process that skips or rushes the pre-adverse notice step before the applicant has a chance to respond.
This article is general information, not legal advice. FCRA compliance depends on your specific hiring process, the states you operate in, and facts a court would review, so confirm your forms and workflow with qualified employment counsel before relying on them.
