Most background check authorization forms that get challenged in court do not fail because the employer forgot to ask for consent. They fail because the employer asked for consent on a form that was doing too much. A liability waiver tucked under the signature line, a summary of state law crammed into the same paragraph, an extra clause about background checks buried in the job application itself, any of these can turn a routine hiring document into a Fair Credit Reporting Act violation. The rule that trips people up is narrow and specific: the disclosure has to stand alone, and consent has to be informed. Everything else belongs somewhere else.
The standalone disclosure requirement in Section 604(b)
The Fair Credit Reporting Act governs how employers obtain and use background reports through a third party consumer reporting agency. Section 604(b)(2) of the FCRA, codified at 15 U.S.C. 1681b(b)(2), says that before an employer can procure a consumer report for employment purposes, it must give the applicant or employee a clear and conspicuous written disclosure that a consumer report may be obtained. The statute requires that disclosure to appear in a document that consists solely of the disclosure. Nothing else can share the page, not a liability release, not an acknowledgment of at-will employment, not a state law notice, not marketing language about the hiring process. Courts that have looked at cluttered disclosures have generally found that anything extraneous defeats the purpose of the standalone requirement, which is to make sure the applicant actually notices and understands what they are agreeing to.
This is the single most common way employers get sued under the FCRA, and it is entirely avoidable. If your disclosure form has more than one purpose, it does not meet Section 604(b)(2). A separate standalone disclosure requirement writeup walks through the mechanics of building a compliant document if you want the full breakdown.
Written authorization is a separate step
Disclosure and authorization are two different legal acts, even though many employers combine them into one document for convenience. The FCRA requires that the consumer has authorized in writing the procurement of the report. That authorization can live on the same page as the disclosure, which is common practice, but the disclosure content still has to be isolated from anything else, and the authorization language has to make clear what the applicant is agreeing to. A signature line under a vague heading is not enough. The applicant should be able to read the form and know what is being requested, who is requesting it, and what kind of report will result.
Authorization also connects back to why the employer is allowed to pull the report at all. A background check is a consumer report, and consumer reports can only be requested for a permissible purpose under the FCRA. Employment screening is one of the enumerated permissible purposes, but the authorization form is the document that ties that purpose to a specific, identified applicant who agreed to it. The FCRA permissible purpose requirement and the authorization requirement work together, one establishes the legal basis and the other documents consent.
What cannot be on the disclosure or authorization form
The Federal Trade Commission and the Equal Employment Opportunity Commission jointly published guidance for employers on background checks, a useful gut check before finalizing a form. See Background Checks: What Employers Need to Know from the FTC. The list of things that do not belong on a disclosure or authorization form includes:
- A liability waiver or release of claims against the employer or the screening company. Some states prohibit this outright, and even where it is not expressly barred, adding a release muddies the standalone disclosure and invites a challenge.
- Extra disclosures unrelated to the background check itself, such as acknowledgments about drug testing policy, arbitration agreements, or handbook receipt.
- State law notices that are legally required but belong in their own document rather than layered onto the federal disclosure. A few state courts have specifically flagged this kind of bundling as clutter that undercuts the standalone purpose.
- Any language that could be read as attempting to waive the applicant’s rights under the FCRA or under state consumer reporting law.
If your current form has a paragraph explaining your company’s background check philosophy, a line about equal opportunity employment, or a general release of information clause, move it. None of it belongs in the same document as the standalone disclosure.
Electronic signatures
Electronic disclosure and electronic signature are both accepted in practice for background check authorizations, provided the applicant can access, read, and retain the document, and the employer can show the applicant affirmatively agreed rather than defaulted through a pre-checked box or an unclear click-through. The safest approach mirrors how any legally significant electronic consent should work: a clear presentation of the standalone disclosure text, an unambiguous action that constitutes signing, and a retained record of what the applicant saw and agreed to. If your applicant tracking system bundles the disclosure into a scrolling terms of service screen with other onboarding paperwork, that is the same clutter problem as a paper form, just moved online.
Evergreen authorizations and their limits
An evergreen authorization is a single signed authorization intended to cover not just the initial pre-employment report but ongoing or periodic checks throughout employment, things like annual rescreens, promotion-triggered checks, or continuous monitoring. Some employers like these because they avoid asking a current employee to sign a new form every time. The FCRA does not categorically ban evergreen language, and the FTC and EEOC guidance referenced above confirms that a properly worded authorization can cover reports obtained at any time during employment, not just the initial hire.
The limits show up in practice rather than in a bright line rule. The authorization language has to actually say that reports may be procured at any time during employment, not just imply it. If a form only describes a pre-employment screen and the employer later uses that same signature to justify a report three years later for an unrelated purpose, that is a mismatch between what was disclosed and what was done. Evergreen authorizations also do not excuse the employer from state law requirements that call for a fresh authorization or a specific notice before a rescreen, and they do not replace the adverse action process if a later report turns up something that leads to termination. Treat an evergreen clause as a scope statement, not a blank check.
The extra disclosure for investigative consumer reports
Section 606 of the FCRA, at 15 U.S.C. 1681d, adds a separate requirement on top of Section 604(b) for a specific category of report called an investigative consumer report. This is a report that includes information on character, general reputation, personal characteristics, or mode of living, typically gathered through interviews with neighbors, associates, or acquaintances rather than pulled from records. If the background check you are running includes this kind of interview based component, the applicant is entitled to an additional disclosure, made in writing and mailed or otherwise delivered no later than three business days after the report was first requested, explaining that an investigative consumer report may be made, describing its nature and scope, and telling the applicant they have the right to request additional details about the investigation. Most routine employment background checks, criminal record searches, employment verification, education verification, do not trigger Section 606. It becomes relevant mainly when a screening program includes reference interviews or reputation based inquiries as part of the report itself.
Summary of Rights and when it has to go out
The FCRA requires that before an employer takes adverse action based in whole or in part on a consumer report, the applicant must receive a copy of the report and a copy of a written description of their rights under the FCRA. The Consumer Financial Protection Bureau publishes the model version of this document, titled A Summary of Your Rights Under the Fair Credit Reporting Act, and using the current model form is the simplest way to satisfy that requirement. Many employers also include the Summary of Rights alongside the initial disclosure, even though the strict federal trigger point is the pre-adverse action step, because it gives applicants earlier notice of how the process works and reduces confusion if a report does come back with something on it. Whichever point you choose, use the current version of the CFPB form rather than an old one pulled from a template library, since the summary has been updated periodically and an outdated version can undercut your compliance record.
State specific notices layered on top of the federal form
A handful of states add their own consumer reporting statutes on top of the federal FCRA, and those statutes sometimes require separate notices, additional check boxes, or state specific rights language. A few examples at a high level:
- California. The Investigative Consumer Reporting Agencies Act, at California Civil Code Section 1786.16, has a broader definition of investigative consumer report than the federal statute and requires its own disclosure identifying the reporting agency and summarizing the applicant’s rights under state law, in addition to the federal Section 604(b) disclosure.
- New York. General Business Law Section 380-c, viewable at New York General Business Law 380-c, requires written notice and authorization before an investigative consumer report is prepared, and where the report relates to employment, the subject must also receive a copy of the state law governing licensure and employment of people with prior criminal convictions.
- Minnesota. Minnesota’s consumer reporting statute, Chapter 13C, covered at Minnesota Statutes Chapter 13C, sets employment disclosure and adverse action notice rules that run alongside the federal FCRA framework.
- Oklahoma. Oklahoma’s consumer reporting provisions under Title 24 of the state statutes, available through the Oklahoma Legislature’s published Title 24 text, require written notice before a consumer report is requested and a mechanism for the applicant to request a free copy of the report.
- Washington. The Washington Fair Credit Reporting Act, codified at RCW 19.182, mirrors much of the federal FCRA but adds its own scope and reporting agency obligations that employers using Washington applicants need to account for separately from the federal disclosure.
The pattern is the same: the state notice is its own document, and it does not get folded into the federal standalone disclosure. Treat the federal disclosure as untouchable and stack whatever state law requires next to it, not inside it.
What goes where: disclosure, authorization, and state notices
| Content | Where it belongs |
|---|---|
| Statement that a consumer report may be obtained for employment purposes | Standalone federal disclosure (FCRA 604(b)(2)) |
| Applicant’s signed consent to procure the report | Authorization, may share the page with the disclosure |
| Notice of nature and scope of an investigative consumer report | Separate FCRA 606 disclosure, only if interview based reporting is used |
| Summary of consumer rights under the FCRA | Attached document, required no later than the pre-adverse action step |
| Liability waiver or release of claims | Nowhere on the disclosure or authorization form |
| State specific investigative report notice (for example California, New York) | Separate state notice document |
| Box to request a free copy of the report (state specific) | Separate state notice or authorization, per that state’s statute |
| Arbitration clauses, handbook acknowledgments, unrelated policy language | Nowhere near the disclosure or authorization form |
Recordkeeping
Keep the signed disclosure and authorization, the report itself, and any adverse action correspondence in the applicant’s file, separate from personnel files that get broad internal access. Retention periods vary by claim type and by state, so the safer practice is to hold background check paperwork at least as long as the relevant discrimination and consumer reporting statutes of limitations run, longer if your industry has its own recordkeeping mandate. Store records so you can reconstruct, for any applicant, exactly what disclosure they received, when they signed, and which version of the Summary of Rights went with any adverse action notice.
Frequently asked questions
Can the disclosure and authorization be on the same page?
Yes. The FCRA requires the disclosure itself to be a standalone document, meaning it cannot share space with unrelated content like liability waivers or policy acknowledgments, but the authorization signature line is commonly placed on the same page as the disclosure since both relate directly to the background check.
Do we need a new authorization every time we run a report on a current employee?
Not necessarily, if the original authorization clearly states that reports may be obtained at any time during employment, not just for the initial hire. If the original form only described a pre-employment check, running a later report on that same signature is a mismatch that can create liability, and some states require a fresh notice before a rescreen regardless of what the original authorization said.
What happens if our disclosure form included extra language, like a liability release?
That is the most common way employers end up out of compliance with Section 604(b)(2). The fix going forward is to separate the disclosure into its own document immediately. For past applicants, talk to counsel about exposure, since a defective disclosure can affect every report procured using that form.
Is a background check authorization form the same in every state?
No. States like California, New York, Minnesota, Oklahoma, and Washington layer their own consumer reporting statutes on top of the federal FCRA, and several require separate state notices or specific language that the federal form does not cover. An employer hiring across state lines generally needs a base federal disclosure plus state specific notices for any state with its own requirements.
Does an applicant have to sign the authorization on paper?
No. Electronic disclosure and electronic signature are commonly used, as long as the applicant can clearly read the standalone disclosure, take an unambiguous action to agree to it, and the employer retains a record of what was presented and when it was signed.
Reveal Background builds disclosure, authorization, and adverse action workflows into its screening platform, which is one of the things covered on the pricing page for employers evaluating a provider.
Related Reading
This article is general information, not legal advice. Background check disclosure and authorization requirements vary by state and by industry, and forms should be reviewed by qualified legal counsel before use.
