No, you can't run a background check on someone just because you're curious about them. Federal law requires what's called a permissible purpose, a real, legally recognized reason for pulling that report. Employment is one of the reasons the law lists, but only if you handle it the right way.
This is one of those rules that sounds obvious until you actually bump into it. Let me walk through where it comes from, what counts as a real reason, and what doesn't.
The Fair Credit Reporting Act, FCRA for short, is the federal law behind almost every background check pulled through a third-party company, known as a consumer reporting agency. It's been around since 1970, built originally for credit reports, long before it also covered the kind of check an employer runs today.
One of its core rules is simple to state and easy to get wrong in practice. A consumer reporting agency can't hand your report over to just anyone who asks for it. The requester needs a permissible purpose, one of a short, specific list written into the law itself.
Here's the part that surprises people. Permissible purpose isn't a loose standard where a judge decides what feels reasonable. It's a defined list. If your reason for pulling the report isn't on it, you don't have a permissible purpose. Full stop.
The main reasons the law recognizes: extending credit, underwriting insurance, deciding whether to rent someone a home, a court order or subpoena, the consumer's own written instructions, and employment purposes, meaning hiring, promotion, reassignment, or retention.
| Permissible purpose | Who typically relies on it |
|---|---|
| Employment purposes | Employers hiring, promoting, or reassigning someone |
| Extending credit | Lenders, credit card issuers |
| Underwriting insurance | Insurance companies |
| Tenant screening | Landlords and property managers |
| Court order or subpoena | Anyone responding to a legal order |
| The consumer's own written instructions | The person themselves, requesting their own report be shared |
Curiosity isn't on that list. Neither is "he seemed off in the interview" or "I just want to know more about her before we move forward." I hear both of those from employers more than you'd think, and neither one gets you anywhere near a permissible purpose.
Employment purposes is broad. It covers hiring, sure, but also promotion, reassignment, and even the decision to keep someone on. That range surprises people who assume FCRA only shows up the day you make an offer.
But broad isn't automatic. Having an open position doesn't hand you a permissible purpose by itself. The law requires you to actually tell the candidate you're pulling a report, in its own standalone disclosure, and get their signed authorization before you do it.
Skip that step and the purpose stops being permissible, even though "employment" is technically the right category. So to say that again a different way: employment purposes is the doorway, not the key. The disclosure and the authorization are the key. You need both to actually get through.
Here's a piece employers miss even after disclosure and authorization are both handled correctly. Whatever you told the candidate the report was for, that's the only thing you're actually allowed to use it for.
Say your disclosure describes a criminal background check for a warehouse role. You can't quietly add a credit check because you got curious about their finances partway through. That's a second purpose you never disclosed, and having one legitimate reason doesn't create a second one for free.
That part's not optional. Match the purpose to what you actually disclosed, every time, not just the first time.
Consumer reporting agencies have to ask why you want a report before they hand one over. Reputable ones make you certify your permissible purpose in writing before they'll release anything at all.
If it turns out you didn't actually have one, the exposure isn't small. FCRA lets the candidate sue you directly, and it lets state attorneys general and the FTC get involved too. Obtaining a report under a false purpose is its own separate violation.
Can I run a background check on a current employee, not just a new hire? Yes. Employment purposes covers that too, promotion, reassignment, and retention are all part of the definition. You still need disclosure and authorization for each one, not just the original hire.
Does having a permissible purpose mean I skip getting consent? No. For employment, you need both at once. The permissible purpose category and the candidate's signed authorization aren't substitutes for each other. They're two separate boxes you check at the same time.
What if I just want a general sense of someone before I interview them? Then don't run a formal report through a screening company for that. Pre-interview curiosity has no permissible purpose behind it, no matter how badly you want to know. Save the check for after you actually intend to hire, promote, or retain someone.
One last thing worth saying plainly. This is one of the more stable parts of FCRA. It doesn't shift every legislative session the way state credit-check or ban-the-box rules do. Get the purpose right once, build it into how you run checks, and it holds.