TL;DR

A consumer report is any background check on a candidate or employee obtained through a third-party agency — credit history, criminal records, employment verification. Under the US Fair Credit Reporting Act (FCRA), using one triggers a specific set of legal obligations for employers, and skipping those steps carries real liability.

What Counts as a Consumer Report

A consumer report is broader than most employers expect. Under the FCRA, the definition covers written, oral, or electronic information from a Consumer Reporting Agency (CRA) bearing on a person's character, general reputation, personal characteristics, or mode of living — used for employment purposes. That includes criminal background checks, credit reports, driving records, employment history verification, and reference checks conducted by a third-party firm.

What it does not include: background checks done entirely in-house. If your HR team calls a former employer directly, that is not a consumer report under the FCRA. The moment you hire a vendor to do it, it is.

There is also a subset called the investigative consumer report. This applies when the agency contacts people who know the candidate — former colleagues, neighbors, references — to develop opinions about character and reputation. Investigative consumer reports carry additional disclosure requirements on top of the standard ones.

Why It Matters for Recruitment

The FCRA creates a compliance checklist that must be completed before you can act on a consumer report. Miss a step and you are exposed to individual lawsuits, class actions, and Federal Trade Commission enforcement.

The sequence looks like this. Before you order the report, you must give the candidate a clear standalone disclosure — not buried in an application — that a consumer report may be obtained for employment purposes. You must get written authorization from the candidate.

If you plan to take adverse action — withdrawal of a job offer, termination, demotion — based on what the report says, there is a two-step process. First you send a pre-adverse action notice with a copy of the report and a summary of FCRA rights, then you wait a reasonable period (typically five business days) before sending the final adverse action notice. That waiting period gives the candidate a chance to dispute inaccurate information.

Multiple states and cities add their own requirements on top of the FCRA. California, New York, Illinois, and others have ban-the-box laws, limitations on using credit history for most jobs, and additional candidate notification rights. Compliance is a layered problem.

In Practice

A company in Texas hires a CRA to run background checks on 200 applicants for a warehouse role. The CRA returns a report showing one candidate has a felony conviction from 12 years ago. The company wants to rescind the offer.

Required steps: send the candidate a pre-adverse action letter with the full report and FCRA summary, wait at least five business days, then send the formal adverse action notice identifying the CRA and noting the candidate's right to dispute the report and request a free copy within 60 days. Skipping the pre-adverse action step is one of the most common FCRA violations in class action litigation — and courts have found plaintiffs can sue even if the underlying report was accurate.

Key Facts