Whether a piece of information is a “consumer report” is not a matter of common sense. It is a legal question with a specific statutory answer, and the answer determines whether an employer owes an applicant a disclosure, a signed authorization, a pre-adverse action notice, and an adverse action notice before and after a hiring decision. Get the label wrong and the duties that come with it get skipped, which is exactly the kind of gap that produces Fair Credit Reporting Act claims. This article walks through the statutory definition, what falls outside it, how an investigative consumer report differs from an ordinary one, and what the label requires employers to do.
The statutory definition: 15 U.S.C. 1681a(d)
The Fair Credit Reporting Act defines a consumer report in 15 U.S.C. 1681a(d) as any written, oral, or other communication of information by a consumer reporting agency that bears on a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living, and that is used or expected to be used, in whole or in part, to establish the consumer’s eligibility for credit, insurance, employment, or a similar purpose listed in the permissible purpose section of the statute. That last piece is what pulls background checks into the definition. A criminal history search, an employment verification, an education verification, or a credit report ordered for hiring purposes fits squarely inside this definition once it comes from a consumer reporting agency and factors into an employment decision.
Three things have to be true at once for a piece of information to qualify: a consumer reporting agency has to be the source, the information has to relate to the kinds of characteristics the statute lists, and the report has to be used, or reasonably expected to be used, for a purpose the FCRA recognizes as permissible, such as employment screening under 15 U.S.C. 1681b. If any one of those pieces is missing, the communication generally falls outside the statute.
What makes an entity a consumer reporting agency
The label also turns on who is doing the assembling. Section 1681a(f) of the same statute defines a consumer reporting agency as any person or entity that, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer information for the purpose of furnishing consumer reports to third parties. A company that runs background checks as a service, sells the results to employers, and does so as a regular part of its business is a consumer reporting agency. An employer’s own HR staff, gathering information directly and using it only internally, generally is not, because there is no third-party furnishing of reports for a fee. That distinction matters more than it sounds, and it is the reason an in-house reference call and a third-party background check are treated so differently under the statute.
Consumer report vs investigative consumer report
The FCRA also carves out a subcategory called an investigative consumer report, defined in 15 U.S.C. 1681a(e). An investigative consumer report is one in which information on a consumer’s character, general reputation, personal characteristics, or mode of living is obtained through personal interviews with neighbors, friends, associates, or others who know the consumer, rather than pulled from records. Because this kind of report relies on subjective, third-hand impressions rather than documented records, the statute layers an extra disclosure duty on top of the ordinary one. Under 15 U.S.C. 1681d, an employer that plans to order an investigative consumer report must notify the applicant in writing, no later than three days after the report is requested, that such a report may be made, and must describe the nature and scope of the investigation requested. The applicant also has the right to request additional disclosures about the nature and scope of the investigation. Most employment screening today, criminal record searches, verifications, credit reports, does not involve neighbor interviews and does not trigger this additional layer. It shows up more often in executive due diligence or specialized vetting where reputation-based interviews are part of the process.
What is excluded from the definition
Several categories of information sit outside the consumer report definition even though they influence a hiring decision.
- First-party information the employer already holds. Notes from the interview itself, the resume the applicant submitted, or observations an interviewer made are not consumer reports because no consumer reporting agency assembled or furnished them.
- An employer’s own verification calls. When HR staff personally calls a former supervisor or school registrar to confirm dates and titles, without routing that work through a consumer reporting agency, the FCRA generally does not apply to that specific communication, because the entity doing the calling is not a consumer reporting agency under 1681a(f). Some states layer their own notice requirements on reference checks regardless, so this is not a free pass, only an FCRA exclusion.
- Reports limited to transactions or experience between the consumer and the reporting entity. The statute’s exclusions cover certain communications that report only on the reporting party’s own dealings with the consumer.
- Certain internal workplace misconduct investigations. Section 1681a also addresses communications made in connection with an investigation of suspected employee misconduct, compliance violations, or violations of pre-existing written employer policies, which can fall outside the consumer report definition when the investigation is not conducted for credit purposes. This exception is narrow and fact-specific, and it does not eliminate other obligations an employer may have, including under state law or internal policy, so it is worth reviewing with counsel before relying on it.
The Federal Trade Commission’s guidance for employers and the FTC’s background check guidance both walk through these distinctions from the employer’s side and are useful companions to the statutory text.
Why the label triggers disclosure, authorization, and adverse action duties
Once information counts as a consumer report ordered for employment purposes, several duties attach automatically.
Permissible purpose. The employer must have a permissible purpose to obtain the report in the first place, which for hiring means the employer intends to use it in connection with an employment decision. This requirement lives in 15 U.S.C. 1681b and is the legal foundation the rest of the process rests on. Reveal Background’s guide on FCRA permissible purpose covers what qualifies and what does not.
Disclosure and written authorization. Before ordering a consumer report for employment purposes, the employer must provide a clear, standalone disclosure that a report may be obtained, separate from the application itself, and get the applicant’s written authorization before the report is procured.
Pre-adverse action. If the employer is considering not hiring, or otherwise taking an adverse action based in whole or in part on the report, the employer must first give the applicant a copy of the report and a copy of the summary of consumer rights, and allow a reasonable opportunity to respond before the decision becomes final.
Adverse action notice. If the employer proceeds with the adverse decision, 15 U.S.C. 1681m requires a follow-up notice identifying the consumer reporting agency, stating that the agency did not make the decision, and informing the applicant of the right to dispute the report’s accuracy and obtain a free copy. The full sequence is laid out in Reveal Background’s walkthrough of the FCRA adverse action process.
These duties exist because Congress built the FCRA around the idea that a consumer should know when a report about them is being pulled, should be able to see it, and should be able to correct it before it costs them an opportunity. The Consumer Financial Protection Bureau’s Regulation V, which implements the FCRA for most purposes, and its model summary of consumer rights, are the reference points most compliance teams use when building these notices.
Consumer report vs internal reference check vs investigative report
| Feature | Consumer report (via a CRA) | Internal reference check | Investigative consumer report |
|---|---|---|---|
| Who prepares it | A third-party consumer reporting agency that regularly assembles information for a fee | The employer’s own staff, done directly with no consumer reporting agency involved | A third-party consumer reporting agency, built through personal interviews with neighbors, friends, or associates |
| FCRA coverage | Fully covered under 1681a(d) and 1681b | Generally outside the FCRA, though state notice laws may still apply | Fully covered, with the added disclosure duty under 1681d |
| Disclosure and written authorization | Required before ordering the report | Not required under the FCRA | Required, plus a description of the nature and scope of the investigation |
| Pre-adverse and adverse action steps | Required | Not required under the FCRA | Required, same as an ordinary consumer report |
| Typical example | Criminal record search, credit report, employment or education verification purchased from a CRA | An HR manager personally calling a listed reference | A due diligence style report built from interviews about reputation or character |
State add-ons employers should not overlook
The FCRA sets the federal floor, not the ceiling. Several states impose additional requirements on top of it, including separate authorization language, longer windows between a pre-adverse action notice and a final decision, restrictions on what can be considered, or state-specific summaries of rights that must accompany the federal one. Because these rules vary by state and change over time, employers with multi-state hiring should confirm their disclosure and adverse action documents against current state law rather than assuming the federal forms are sufficient everywhere. An employer’s compliance packages should reflect this layering, and it is a fair question to ask any screening provider before signing on.
Building this into a hiring process
The practical takeaway is that the moment an employer orders a background check from an outside company, the FCRA’s full set of duties applies, regardless of what the employer calls the check internally. Treating a criminal history search, a verification, or a credit pull as anything less than a consumer report because it seems routine is one of the more common ways employers end up out of compliance. Building disclosure, authorization, and adverse action steps into the hiring workflow from the start, rather than bolting them on after an applicant complains, is the more defensible approach. Employers evaluating providers can compare how screening packages are structured and priced on Reveal Background’s pricing page.
Frequently asked questions
Does a criminal background check count as a consumer report under the FCRA?
Yes, when it is obtained from a consumer reporting agency and used for an employment decision, a criminal background check meets the definition in 15 U.S.C. 1681a(d) and triggers the full set of disclosure, authorization, and adverse action duties.
Is a reference check my company does in house a consumer report?
Generally not under the FCRA, because the employer is not a consumer reporting agency assembling information for a fee to furnish to third parties. Some states still require notice before reference checks, so this is an FCRA exclusion, not a blanket exemption from every law.
What is the difference between a consumer report and an investigative consumer report?
An investigative consumer report is a specific type of consumer report built from personal interviews with people who know the applicant, such as neighbors or associates, rather than from records. It carries an added disclosure requirement under 15 U.S.C. 1681d describing the nature and scope of the investigation, on top of the standard consumer report disclosure.
Do I need written authorization every time I order a consumer report for hiring?
Yes. The FCRA requires a clear, standalone disclosure and the applicant’s written authorization before a consumer report is procured for employment purposes, separate from the application itself.
What happens if I mislabel a report and skip the required disclosures?
Treating a consumer report as something else and skipping disclosure, authorization, or adverse action steps exposes an employer to FCRA claims. Legal counsel should review any process where the classification of a report is unclear before it goes into production.
Related Reading
This article is general information, not legal advice. FCRA obligations vary by fact pattern and by state, and employers should have legal counsel review their disclosure forms, authorization language, and adverse action process before relying on them.
