No. Not if you're using a background check company to run the report. Federal law requires you to tell the candidate in writing, and get their written okay, before you pull anything. That's not a best practice. It's the law, and it's one of the most enforced parts of it.
Let's start with why, then get into exactly what "telling them" actually has to look like. It's more specific than most employers expect.
A background check can cost someone a job. Sometimes fairly, sometimes over a mistake on a report that isn't even theirs. Congress decided people deserve to know a report is being pulled on them, and get a real chance to catch an error before it costs them anything.
So the law doesn't just say "tell them somehow." It spells out exactly what counts as telling them. Vague notice doesn't satisfy it. Neither does notice buried where nobody reads it.
This comes from the Fair Credit Reporting Act, or FCRA, the federal law that governs background checks run by outside companies. Three things have to happen, in this order, every time:
Skip a step, or do them out of order, and you're already in violation. It doesn't matter if the candidate would have said yes anyway.
Here's the detail that trips up more employers than anything else in this article. The disclosure can't be a paragraph inside your job application. It can't share a page with your at-will statement, your drug policy, or a liability waiver. It has to be its own document, saying nothing else.
Regulators call this the standalone disclosure requirement, and it's exactly what it sounds like. One document. One purpose. Nothing extra mixed in.
I've seen employers try to save paper by folding the disclosure into page four of a ten-page application packet. I get why. It feels efficient. It's also exactly the kind of thing FCRA lawsuits are built on.
I want to be straight with you about the stakes here, without handing you a number I can't back up. This exact requirement, the standalone disclosure rule, is behind more FCRA lawsuits than almost anything else in the statute.
It's a favorite target for class actions, because the violation is easy to prove. Either the document stood alone or it didn't.
FCRA also allows statutory damages for a willful violation, meaning you don't always need to show the candidate was actually harmed. And these cases tend to affect every candidate you ever screened the same way, which is exactly what turns one bad form into a class action.
That part's not optional, and it's not the kind of mistake you fix after the fact. Get your disclosure and authorization forms reviewed before you use them, not after someone's lawyer finds them.
Here's where a lot of employers get confused, and it's a fair thing to be confused about. FCRA doesn't regulate background checks in general. It regulates reports put together by a consumer reporting agency, a CRA, a company in the business of compiling this information for you.
So if you personally call a candidate's former manager and ask how they did, that's not a consumer report. You're not a CRA. FCRA's disclosure and authorization rules generally don't apply to that call the same way.
So to say that again a different way: it's the act of hiring an outside company to run the report that triggers FCRA's paperwork requirements. Doing the legwork yourself, informally, mostly sits outside that system.
Mostly. Not entirely. Some states have their own rules about telling a candidate you're checking references, separate from anything FCRA requires.
And you're still on the hook for what you do with what you learn. Using a reference call to screen out candidates in a way that hits one group harder than another is still a real legal problem, just a different one than FCRA covers.
| Question | CRA background check | You call a reference yourself |
|---|---|---|
| Covered by FCRA | Yes | Generally no |
| Standalone written disclosure required | Yes, before you pull anything | Not under FCRA |
| Candidate's written authorization required | Yes | Not under FCRA |
| Other laws can still apply | Yes, state law on top of FCRA | Yes, state notice or discrimination rules |
That part's fine to relax on if you're doing the calling yourself. It's not fine to relax on the moment a third-party company gets involved.
If you use a background check company, and most employers do, treat the disclosure and authorization step as non-negotiable. Standalone document. Plain language. Signed before anything gets pulled. No exceptions for a candidate you're in a hurry to hire.
If you're just calling a former supervisor yourself, you have more room. But "more room" isn't "no rules." Ask about job performance, not protected characteristics, and be consistent about who you check and what you ask them.
When the two overlap, say you run a formal check and also call references yourself, both sets of rules apply to their own piece of the process. One doesn't excuse the other.
Laws like this get amended more than people expect, and a few states layer extra notice requirements on top of FCRA's federal floor. Check your state's current rule, or run your forms past a lawyer, before you lean on anything written here as your final word.