Background Screening Laws 2026: Federal, State & Local Rules for Employers
Background screening laws 2026 changed fast, and enforcement grew sharper. This guide walks you from federal FCRA duties down to your state and city rules. It also covers ban-the-box, employment credit-report restrictions, and AI background checks.
Key takeaways
- Federal law sets the floor. Always start with the FCRA and Title VII.
- State and city rules stack on top. The strictest rule usually wins.
- Ban-the-box now covers 37 states and 150-plus localities (NELP).
- New York banned most employment credit checks on April 18, 2026.
- AI background checks face new rules in Illinois, California, and Colorado.
Open an account today. Get immediate access.
Pay as you go, only for what you need. Services provided only for legitimate, credentialed business use. NO setup, minimum or monthly recurring fees for credit card customers.
How to use this guide
Compliance works best in layers. Start federal, then narrow to your state, and finish local. Each layer adds rules; none of them cancel the others.
Important: The background screening disclosure and authorization/release must be provided on a standalone form, separate from the employment application, and must be presented in a clear and conspicuous manner. Most FCRA employment lawsuits start here.
Step 1 — Learn the federal baseline first
Read the federal section below. Every U.S. employer must follow the FCRA and Title VII. The ADA and GINA also limit medical and genetic questions
Step 2 — Master the adverse action sequence
Review the two-step adverse action process. This step deserves your close attention.
Step 3 — Click your state in the map grid
Open the state-by-state directory and select your state. Each state page lists ban-the-box timing, lookback limits, and credit rules. It also flags pending bills.
Step 4 — Layer on city and county ordinances
Check your city next. Philadelphia, San Francisco, and New York City impose extra duties. Local law often controls your actual workflow.
Step 5 — Audit your AI and vendor stack
Read the AI background checks section. Confirm your tools were bias-tested. Document human review of every screening decision.
Step 6 — Run the checklist before you hire
Finish with the compliance checklist. Save it as your internal SOP. Re-audit each quarter, because rules shift often.
Which rule applies when they conflict?
Apply the most protective standard for the applicant. Federal law sets a floor, not a ceiling. State laws rarely preempt stricter city ordinances. New York’s credit-history statute, for instance, expressly preserves stronger local protections (Consumer Financial Services Law Monitor).
What changed in background screening laws 2026
2026 brought real movement, not minor edits. Several states rewrote core hiring rules. AI oversight also moved from proposal to enforcement. The table below summarizes the headline changes.
Federal background screening laws: the baseline
Federal rules apply everywhere. Start here before you read any state page. Four federal frameworks shape almost every screening decision.
1. Fair Credit Reporting Act (FCRA)
The FCRA governs any report you buy from a consumer reporting agency. The FTC enforces it, and the CFPB writes the rules. Technical slips create real liability.
You must meet four core duties. First, screen only for a permissible employment purpose. Second, give a clear, stand-alone written disclosure. Third, get written authorization before ordering the report. Fourth, certify compliance to your screening provider (FTC guidance).
Keep the disclosure clean
We must reiterate that a background check disclosure & authorization cannot sit inside your job application. It cannot include liability waivers. Courts routinely strike those extras down. Use a single-purpose document and nothing more (FTC).
2. Title VII and EEOC guidance on criminal records
Title VII bans practices with an unjustified disparate impact. The EEOC therefore treats blanket criminal exclusions as risky. Instead, apply the three “green factors.”
- Nature and gravity of the offense or conduct.
- Time elapsed since the offense or sentence completion.
- Nature of the job sought or currently held.
Next, run an individualized assessment. Let the candidate explain context first. Then document your business-necessity reasoning in writing (EEOC enforcement guidance).
Arrests deserve special care. An arrest alone proves nothing. The EEOC says an exclusion based solely on an arrest fails the business-necessity test. You may still consider the underlying conduct when it makes someone unfit for the role.
3. ADA and GINA limits
The ADA blocks medical questions before a conditional offer. Afterward, ask only with objective evidence of risk or inability. GINA goes further: employers generally must not request genetic information, including family medical history (FTC and EEOC joint guidance).
4. Regulation V and the CFPB
Regulation V implements the FCRA at 12 CFR Part 1022. It spells out duties for users of consumer reports, furnishers, and agencies. Review it when you build screening policy (CFPB Regulation V).
Adverse action: the two-step process you cannot skip
Adverse action drives most FCRA employment-screening litigation. The process itself is simple. Follow it exactly and in order.
FCRA adverse action sequence for employment screening decisions
Local rules tighten these timelines. In San Francisco, you must acknowledge mitigating evidence within 14 days, and the final decision must issue within 30 days (Scherzer 2026 recap).
Ban-the-box and fair chance hiring in 2026
Ban-the-box does not end criminal background checks. It changes when you may ask. Most laws push the question past the conditional-offer stage.
Coverage keeps widening. Nationwide, 37 states and more than 150 cities and counties have adopted fair-chance policies (National Employment Law Project). Several jurisdictions expanded their rules during 2026.
2026 ban-the-box expansions worth noting
- Washington. The amended Fair Chance Act took effect July 1, 2026. Employers must delay conviction inquiries until after an offer and exclude non-conviction arrests and juvenile records entirely (Washington State Legislature).
- Philadelphia. Amendments landed January 6, 2026. The misdemeanor lookback shrank to four years, and summary offenses are now off-limits (Philadelphia Commission on Human Relations).
- San Francisco. The ordinance now bars out-of-state convictions for conduct that is lawful in California, including reproductive and gender-affirming healthcare.
Practical takeaway
Remove criminal-history questions from every application. Ask only after a conditional offer. This single change satisfies most ban-the-box laws at once and lowers risk quickly.
Clean slate laws change what you can even see
Clean slate statutes seal eligible records automatically. Fourteen states now run automated sealing systems. Virginia’s system launched July 1, 2026, and it seals many low-level offenses (Code of Virginia).
Sealed records stay off-limits, even by accident. Never base a decision on a sealed item that surfaced in a legacy database. Tell Virginia applicants not to disclose sealed matters (Morgan Lewis).
Employment credit report restrictions by state
Credit checks now carry the heaviest state-level restrictions. Eleven states limit them, and New York joined most recently. National employers need role-by-role rules.
New York’s ban took effect April 18, 2026. It makes credit-history use an unlawful discriminatory practice for hiring, pay, and other terms. It also covers labor organizations, employment agencies, and their agents.
What “consumer credit history” covers in New York
The definition runs broad. It includes credit scores, payment history, charged-off debts, collections, credit limits, prior inquiries, bankruptcies, judgments, and liens. It also covers information you obtain directly from the candidate.
Narrow exceptions still exist
- State, federal, or securities self-regulatory rules require the check.
- The role is a police, peace officer, or law-enforcement investigative position.
- The employee must be bonded, or must hold a security clearance.
- The role carries signatory or contracting authority of at least $10,000.
- The role regularly accesses trade secrets or national security information.
- Duties include modifying digital security systems that protect networks or databases.
Document your reasoning before you rely on any exception. Local ordinances survive: New York City’s Stop Credit Discrimination in Employment Act still applies (Consumer Financial Services Law Monitor).
Other restricting states include California, Colorado, Connecticut, Hawaii, Illinois, Maryland, Nevada, Oregon, Vermont, and Washington. Maryland’s Job Applicant Fairness Act, for instance, limits credit use in hiring, firing, and pay decisions (Maryland People’s Law Library).
AI background checks: the fastest-moving area of 2026
AI background checks now sit squarely inside employment law. Regulators no longer wait for legislation; they apply existing discrimination statutes to algorithms. Your vendor stack is your legal exposure.
Illinois: notice plus a ZIP code ban
Public Act 103-0804 took effect January 1, 2026. It bars AI that has the effect of discriminating on protected grounds and prohibits ZIP codes as a proxy for race or national origin. Employers must also notify workers when AI is used (Illinois General Assembly).
California: FEHA now covers automated decision systems
California’s ADS regulations took effect October 1, 2025. They apply to every FEHA-covered employer with five or more employees. Disparate impact alone can create liability, even without intent.
Employers must keep automated-decision data for at least four years. Assessments that reveal a disability may count as an unlawful medical inquiry (California Civil Rights Department).
Colorado: risk assessments for high-risk AI
The Colorado AI Act reaches employers doing business in the state. Its duties begin June 30, 2026. Deployers must use reasonable care against algorithmic discrimination. The attorney general holds exclusive enforcement authority (Colorado General Assembly).
New York City: bias audits and public reporting
Local Law 144 has applied since 2023. Employers may not use an automated employment decision tool without a bias audit from the prior year. Audit results must be public, and candidates need advance notice (NYC Department of Consumer and Worker Protection).
Enforcement scrutiny is rising. A December 2025 state audit found DCWP enforcement lacking (New York State Comptroller). Tighter oversight looks likely.
Five AI guardrails to adopt now
- Inventory every tool that scores, ranks, or filters candidates.
- Demand recent bias-audit documentation from each vendor.
- Keep a human decision-maker in every final call.
- Give clear notice before and after AI use.
- Retain inputs, outputs, and audit records for four years.
The EEOC also tracks algorithmic fairness directly. Review its artificial intelligence resources alongside state rules (EEOC AI resources).
Criminal background checks: what you usually cannot use
Criminal background checks remain lawful nearly everywhere. Several categories are commonly restricted. Review this list before you adjudicate any report.
- Arrests without conviction, in many states.
- Expunged, sealed, or automatically cleared records.
- Juvenile adjudications, especially in Washington.
- Convictions beyond a state or city lookback window.
- Non-conviction dispositions such as dismissals or acquittals.
- Summary offenses, in Philadelphia.
Lookback windows vary sharply. California generally limits reporting to seven years. Philadelphia now allows only four years for misdemeanors. View more information about criminal records lookback in a dedicated section of our employment screening webpage.
Configure your screening packages by jurisdiction, not nationally.
FCRA employment lawsuits: where employers get caught
FCRA employment lawsuits keep arriving in volume. Class settlements regularly reach seven and eight figures. Top FCRA-related class settlements totaled $42.43 million in 2024, $100.15 million in 2023, and $210.11 million in 2022 (Duane Morris Class Action Review).
The triggers repeat themselves, which makes them easier to prevent.
- Disclosure defects. Extra language or embedded waivers break the stand-alone rule.
- Missing pre-adverse notice. Employers deny candidates before sending the report.
- Rushed timelines. Final notices go out within hours, not days.
- Stale adjudication rules. Old lookback settings ignore new local limits.
- Unreviewed vendor output. Nobody checks the algorithm’s recommendation.
Statutory damages run $100 to $1,000 per willful violation. Attorney fees and punitive damages may follow. Small process gaps therefore scale into large exposure across thousands of applicants.
State-by-state background screening laws
Pick your state. Each page covers ban-the-box timing, lookback limits, credit restrictions, drug testing, and salary-history rules. Each page also flags relevant city ordinances.
Tip: Hiring in several states? Open each state page and apply the strictest rule across your workflow.
- Alabama 2026 rules →
- Alaska 2026 rules →
- Arizona 2026 rules →
- Arkansas 2026 rules →
- California 2026 rules →
- Colorado 2026 rules →
- Connecticut 2026 rules →
- Delaware 2026 rules →
- Dist of Columbia 2026 rules →
- Florida 2026 rules →
- Georgia 2026 rules →
- Hawaii 2026 rules →
- Idaho 2026 rules →
- Illinois 2026 rules →
- Indiana 2026 rules →
- Iowa 2026 rules →
- Kansas 2026 rules →
- Kentucky 2026 rules →
- Louisiana 2026 rules →
- Maine 2026 rules →
- Maryland 2026 rules →
- Massachusetts 2026 rules →
- Michigan 2026 rules →
- Minnesota 2026 rules →
- Mississippi 2026 rules →
- Missouri 2026 rules →
- Montana 2026 rules →
- Nebraska 2026 rules →
- Nevada 2026 rules →
- New Hampshire 2026 rules →
- New Jersey 2026 rules →
- New Mexico 2026 rules →
- New York 2026 rules →
- North Carolina 2026 rules →
- North Dakota 2026 rules →
- Ohio 2026 rules →
- Oklahoma 2026 rules →
- Oregon 2026 rules →
- Pennsylvania 2026 rules →
- Rhode Island 2026 rules →
- South Carolina 2026 rules →
- South Dakota 2026 rules →
- Tennessee 2026 rules →
- Texas 2026 rules →
- Utah 2026 rules →
- Vermont 2026 rules →
- Virginia 2026 rules →
- Washington 2026 rules →
- West Virginia 2026 rules →
- Wisconsin 2026 rules →
- Wyoming 2026 rules →
Your 2026 background screening compliance checklist
Use this list as an internal SOP. Revisit it every quarter, because rules change constantly.
- Standardize by role risk. Define packages for entry, financial, and safety-sensitive jobs.
- Apply criteria uniformly. Screen every candidate in a role the same way.
- Isolate the disclosure. Keep it stand-alone, and remove all waivers.
- Localize the language. Add state-specific notices where required.
- Delay the criminal question. Ask only after a conditional offer.
- Turn off credit by default. Enable it only for qualifying roles.
- Automate adverse action. Trackable letters prove your timing.
- Document individualized assessments. Record the green factors you weighed.
- Audit your AI tools. Collect bias audits and retain records four years.
- Train recruiters annually. Front-line errors drop sharply.
Frequently asked questions about background screening laws
What are the biggest background screening laws 2026 changes?
Four changes stand out. First, New York banned most employment credit checks on April 18, 2026. Second, Washington strengthened its Fair Chance Act on July 1, 2026. Third, Virginia’s Clean Slate sealing began the same day. Finally, Illinois AI rules took effect January 1, 2026.
Do ban-the-box laws eliminate criminal background checks?
No. Ban-the-box laws only change timing. You may still run criminal background checks. However, you must usually wait until after a conditional job offer. Additionally, many jurisdictions require a written individualized assessment before you withdraw that offer.
Which states restrict employment credit reports?
Eleven states now limit credit checks in hiring. They include California, Connecticut, Hawaii, Illinois, Maryland, Nevada, New York, Oregon, Vermont, and Washington. Moreover, cities like New York City and Philadelphia add their own rules. Therefore, check both layers before enabling credit reports.
Are AI background checks legal in 2026?
Yes, but conditions apply. Illinois requires notice and bans ZIP code proxies. California treats automated decision systems as FEHA-covered. Colorado requires risk assessments from June 30, 2026. Additionally, New York City requires an annual bias audit with public results.
What information is prohibited in an employment background check?
Restrictions vary by state. Commonly off-limits items include non-conviction arrests, expunged or sealed records, juvenile adjudications, and convictions outside the lookback window. Furthermore, the ADA and GINA bar most medical and genetic inquiries.
How does the FCRA adverse action process work?
It runs in two stages. First, send a pre-adverse action notice with the report and the FCRA rights summary. Then wait a reasonable period, commonly five business days. Next, review any dispute. Finally, send the adverse action notice with the agency’s contact details.
What penalties apply for FCRA non-compliance?
Willful violations carry statutory damages of $100 to $1,000 each. Additionally, courts may award attorney fees and punitive damages. Class actions therefore magnify the risk quickly. Top FCRA-related class settlements exceeded $100 million in 2023 alone.
How do clean slate laws affect hiring decisions?
Clean slate laws seal eligible records automatically. Consequently, you cannot require disclosure of sealed matters. You also cannot rely on sealed data that appears through an outdated database. Virginia’s system, for example, seals many misdemeanors and non-convictions.
How often do background screening laws change?
Expect two to three significant state or local updates each quarter. Additionally, city ordinances often move faster than state statutes. Therefore, schedule a quarterly policy review. Subscribing to compliance alerts also helps you catch effective dates early.
Do I follow federal, state, or local law when they conflict?
Follow the most protective standard for the applicant. Federal law creates a floor rather than a ceiling. Moreover, state statutes rarely preempt stronger local ordinances. Consequently, build your workflow around the strictest applicable rule in each hiring location.
Authoritative sources and further reading
- Federal Trade Commission — Background Checks: What Employers Need to Know
- U.S. EEOC — Enforcement Guidance on Arrest and Conviction Records under Title VII
- U.S. EEOC — Artificial Intelligence and Algorithmic Fairness resources
- CFPB — 12 CFR Part 1022, Fair Credit Reporting (Regulation V)
- California Civil Rights Department — Automated-Decision System regulations
- Illinois General Assembly — Public Act 103-0804 (AI in employment)
- Colorado General Assembly — SB 24-205, Consumer Protections for Artificial Intelligence
- Washington State Legislature — EHB 1747, Fair Chance Act expansion
- Code of Virginia — Chapter 23.2, Sealing of Criminal History Record Information
- NYC Department of Consumer and Worker Protection — Automated Employment Decision Tools
- New York State Comptroller — Audit of Local Law 144 enforcement
- Philadelphia Commission on Human Relations — Fair Chance Hiring law
- Maryland People’s Law Library — Credit Checks and Job Applicants
- National Employment Law Project — Ban the Box state and local guide
Disclaimer: This guide provides general information only. It does not constitute legal advice. Laws change frequently, and facts drive outcomes. Consult qualified employment counsel before you finalize any screening policy.