I've watched employers do everything right under one law and still get hit under the other. Clean disclosure, signed authorization, every adverse action notice mailed on time. Then an EEOC discrimination charge shows up anyway.
Here's the fix, stated plainly. The Fair Credit Reporting Act, FCRA, governs how you get and use a background check report. Title VII, enforced by the Equal Employment Opportunity Commission, governs whether the decision you made with that report was discriminatory. Two different questions, checked by two different agencies.
Treat them as one compliance checklist and you'll only cover half of it. Here's what each law regulates, where employers assume overlap that isn't there, and how you end up clean under one and exposed under the other.
FCRA asks one question. Did you follow the correct steps to get and use this report? Disclosure, authorization, notice before you turn someone down, notice after. That's the whole job.
Title VII asks something else. Did the way you used what's in that report treat people unfairly, whether you meant to or not? Your paperwork can be perfect and the answer can still be yes.
Different agencies enforce each one. FCRA sits mostly with the FTC and the CFPB, and applicants can sue over it directly. Title VII sits with the EEOC. A clean audit under one means nothing to the other.
That's the fact that clears up most of the confusion I see. The EEOC doesn't enforce the FCRA. The FTC and CFPB don't investigate discrimination. Different rulebooks, different referees.
FCRA covers what happens when you use a third-party company, called a consumer reporting agency, to run a background check. Most screening vendors are one of these.
The law is about process, not content. Before you order a report, you need a standalone written disclosure, nothing else mixed in, plus signed authorization.
If the report pushes you toward turning someone down, send a pre-adverse action notice first, with a copy of the report and a rights summary. Wait. Then, if you're still saying no, send a final adverse action notice.
FCRA doesn't care what's in the report, or whether declining the candidate was fair. It cares whether the candidate got proper notice, gave consent, and had a real chance to dispute something wrong.
One number gets repeated constantly: wait around five business days between the pre-adverse notice and the final one. I'll be straight with you, that's common practice, not a figure written into the statute. Check current guidance before you build a policy on it.
That part's not optional, even the parts that feel like paperwork.
Title VII of the Civil Rights Act bans employment discrimination based on race, color, national origin, sex, and religion. The EEOC enforces it, and in 2012 issued guidance specifically about using criminal records in hiring.
Here's the part that surprises people. The EEOC isn't saying background checks are illegal. It's saying a blanket rule, something like "no felony convictions, ever, for any job," can screen out one group of candidates a lot more than another.
That happens because arrest and conviction rates aren't spread evenly across groups. You don't need to intend discrimination for this to count against you.
What the EEOC wants instead is an individualized look at each case before you exclude someone for their record. Three factors: how serious the offense was, how much time has passed, and how closely it relates to the job. That test goes back decades, to an older court case, and it's still the framework the EEOC points to.
I'd rather be straight with you than sound more certain than I am. The 2012 EEOC guidance is enforcement guidance, not a binding regulation the way a statute is. It's been challenged in court, including litigation from Texas over how it applies to state employers. Read it as a strong compliance signal, not settled law.
One thing employers miss almost every time: this rule covers the employer's decision, not the vendor's report. It applies to information you already had, too.
Three ways I've actually seen this go sideways.
Scenario A, clean paperwork, exposed decision. An employer sends a perfect disclosure, gets signed authorization, mails every notice on schedule. But their policy is "any felony, automatic reject," applied the same way to everyone with no individual review. The paperwork is spotless. The policy is the problem.
Scenario B, careful decision, broken paperwork. An employer does the individualized assessment correctly, weighing severity, time passed, and job relevance. Then they never send the pre-adverse action notice or the rights summary before finalizing the rejection. That's a straight FCRA violation, no matter how fair the underlying call was.
Scenario C, both at once. A disclosure form gets bundled into new-hire paperwork instead of standing alone, which breaks FCRA. The criteria applied to candidates aren't consistent from one to the next, which breaks Title VII. Two mistakes, same stack of paper.
Why does this keep happening? Vendor onboarding materials cover FCRA mechanics in detail, because that touches the vendor's own liability. The EEOC side, the actual decision-making, gets a paragraph if it's lucky.
| Category | FCRA | EEOC / Title VII |
|---|---|---|
| What it governs | Obtaining and using a background report | Whether the resulting decision discriminates |
| Enforcing agency | FTC and CFPB | EEOC |
| Applies to | Employers using a third-party reporting agency | Any employer, report or no report |
| Core obligation | Disclosure, authorization, adverse action notices | Job-related criteria plus individualized assessment |
| Who can sue | The applicant, plus regulators | The applicant, via an EEOC charge first |
| Typical violation | Skipping the pre-adverse action notice | A blanket exclusion policy with no review |
Read it sideways and the pattern is obvious. Every FCRA row is a step you took. Every EEOC row is a judgment you made. Neither substitutes for the other.
Federal law is the floor, not the ceiling. States and cities add their own rules on top of both: ban-the-box or fair-chance ordinances that change when you can ask about criminal history, plus their own consent and disclosure requirements.
I'm not going to list specific states here. That list changes constantly, and a stale snapshot does more harm than good. Getting FCRA and EEOC right at the federal level is necessary, not the whole job, once you're hiring in more than one place.
Check what applies where you're actually hiring. That part doesn't have a shortcut.
These two laws aren't competing for the same moment in your hiring process. They govern different steps, in order.
Step three is the one almost nobody walks you through. Generic FCRA checklists, including some that come straight from screening vendors, skip it entirely, because it isn't the vendor's liability. It's yours.
Does the EEOC enforce the FCRA? No. Separate agencies, separate statutes. A perfect FCRA process doesn't shield you from an EEOC charge.
Can I be FCRA-compliant and still get sued for discrimination? Yes, more often than people expect. See Scenario A above.
Does a clean background check process protect me from an EEOC charge? No. FCRA compliance covers how you got the report, not whether the decision was fair.
Who do I contact for each one? FCRA questions point toward the FTC or CFPB. Discrimination questions point toward the EEOC. Neither replaces an employment lawyer.
Here's the one sentence to keep. FCRA is about how you got and handled the report. EEOC and Title VII are about whether what you did with it was fair. Treat them as one checklist and you'll pass half of it while failing the other.
Getting both sides right, the process and the judgment call, is exactly what a properly run screening program handles by default. That's not a small thing to get right on your own.