The Summary of Rights is a specific document written and published by the Consumer Financial Protection Bureau. The FCRA requires you to hand a candidate a copy of it, and you can't write your own. You use the government's current wording, not a paraphrase, and not whatever version has been sitting in your HR folder since 2019.
You're required to give it out at one specific point for sure: with your pre-adverse action notice. Most employers also send it earlier, with the initial disclosure, as standard good practice. I'll walk through both.
Strip away the legal name and it's a plain-language handout. One or two pages telling a job candidate what rights they have when someone runs a background check on them. The right to know what's in their file. The right to dispute something that's wrong. The right to a free copy of the report under certain conditions.
The CFPB writes it. Not your background check company, not your lawyer, and not you. That's the whole point. Every candidate in the country gets handed the same government-approved explanation of their rights, worded the same way, no matter who's running the check or what state they're in.
The FCRA is explicit about one moment: before you take adverse action against someone based on a background check, you have to send them a copy of the report along with this summary. That's your pre-adverse action notice. It's not optional, and it's not a courtesy. It's the law giving the candidate a real chance to see what you saw and respond before you make a final call.
Most employers also include it earlier, when they first tell the candidate a background check is coming, alongside the disclosure and authorization form. The law doesn't spell that second step out as tightly as the first one. But it's become standard practice for a good reason. It costs you nothing, and it closes a gap some state laws fill in on their own anyway.
So to say that again a different way: one use is a hard requirement, the other is close to universal practice. Treat both as required and you won't get tripped up by which is which.
Employers try this more than you'd expect. Someone in HR takes the government language, tightens it up, drops in a company logo, and calls it done. It feels efficient. It's also a mistake, because the FCRA doesn't ask you to convey the same ideas in your own words. It requires the CFPB's specific, prescribed text.
This isn't a minor technicality either. When the FTC handed this rulemaking job to the CFPB back in 2012, the wording changed. It changed again later when Congress added new consumer protections. Employers who kept using an old form, even one that used to be correct, ended up out of compliance without doing anything else wrong.
And FCRA lawsuits love exactly this kind of error. A wrong or outdated summary of rights is a paperwork violation that applies identically to every candidate a company screened during that window. That's the profile plaintiff's attorneys look for when they're building a class action. Nobody needs to prove they were actually harmed. The form being wrong is enough on its own.
That part's not optional. Use the current version, every time.
Go straight to the CFPB's own website, consumerfinance.gov, and pull the current Summary of Consumer Rights from there. Don't reuse a PDF sitting in a folder from your last audit. Don't ask your background check company for "the standard one" and assume they've kept it updated either. Check yourself.
The CFPB also publishes a Spanish-language version. If you're communicating with candidates in Spanish anywhere else in your hiring process, use that version for them too. It's a small thing. It's also the kind of small thing that shows up in a complaint if you skip it.
A handful of states layer their own version of this requirement on top of the federal one, with their own state-specific summary of rights. California's the most well-known example. If you hire there, don't assume the federal form alone covers you. Check your state's actual requirement instead of guessing at it.
Nothing happens immediately. That's what makes this easy to get wrong for years without noticing. You don't find out until a candidate complains, a regulator asks for your process during an audit, or a plaintiff's attorney requests copies of everything you sent out over the last two years.
By then it's not one mistake. It's every candidate you processed the same way, and FCRA damages get counted per violation. A form nobody thought twice about turns into the expensive part of a lawsuit, not the background check itself.
I'm not trying to scare you into paralysis here. This is genuinely one of the easiest pieces of FCRA compliance to get right. Download the current form. Use it every time. Done. It's skipping it, or trusting an old copy, that gets people in trouble.