What Does FCRA Compliance Require for a Retail Background Check?

By awareretailgroup.com Editorial· Edited by Tom Walsh· Published 2026-10-05

A retailer that uses a consumer report in a hiring decision must follow the Fair Credit Reporting Act. Give the applicant a stand-alone written notice, get written permission before the report is ordered, and follow the pre-adverse and final adverse-action steps before rejecting anyone based on the report. Check state law too, because some states restrict these reports further. Most FCRA exposure comes from skipped steps, not from the screening decision itself.

Why the FCRA sequence is the main exposure

The FTC states that when you use consumer reports for hiring, retention, promotion or reassignment, you must comply with the FCRA (FTC). That makes the procedure, not the screening criterion, the first thing to get right. Procedural claims are where private plaintiffs have the easiest case. The Ninth Circuit held in Syed v. M-I that a prospective employer’s violation is willful when the employer includes terms beyond the disclosure, such as a liability waiver, before procuring a report (Ninth Circuit). The same court says a willful violation can carry statutory damages of $100 to $1,000, plus punitive damages and attorney’s fees (Ninth Circuit). A store operation with one vendor form and no legal review is exposed in exactly that way. Our view: treat the notice sequence as non-negotiable; it is the cheapest exposure to close.

Before the report: notice and written permission

The FTC says the employer must tell the applicant in writing, in a stand-alone format, that a consumer report may be used for employment decisions (FTC). The same notice cannot sit inside the application (FTC). Written permission must come before the report is obtained, and it can be part of that same notice document (FTC). Keep the notice and the applicant’s signed permission on one separate form, filed in the applicant’s hiring record. In a store, that means the hiring coordinator or the district HR partner sends the form, not the store manager at the register. A manager who verbally tells a candidate “we’ll run a check” has not met the requirement.

Before rejecting: the adverse-action sequence

Before a retailer rejects an applicant or takes other adverse action based on a consumer report, it must give the applicant certain notices (FTC). The pre-adverse notice gives the person the opportunity to review the report and say whether it is correct (FTC). The final adverse-action notice must tell the person of the right to dispute information from the consumer reporting company, and to get an additional free report if requested within 60 days (FTC).

The sequence is where an individual store decision becomes a company process. The FTC also says employers must dispose of the report and gathered information securely once they are done with it (FTC). Here is the working order a district HR partner can check against each rejected applicant:

Shredding a paper printout in a store back office is not enough if the file also sits in an unsecured email folder. Investigating a current employee is a separate topic, covered in employee theft investigation rights.

Why screening must be job-related, and where federal enforcement stands

Job-relatedness is a separate risk from the FCRA procedure. The EEOC says employment screens with a racial disparate impact violate Title VII unless the employer can show the screen is job-related and a business necessity (EEOC). The EEOC’s Dollar General lawsuit alleged that the retailer’s broad criminal background check denied employment to African Americans at a significantly higher rate than white applicants (EEOC). Under the resulting consent decree, Dollar General had to hire a criminology consultant to build any new criminal background check it used during the decree (EEOC).

The federal picture has changed, and the sources do not all agree on what it means. The DOJ Office of Legal Counsel opinion says background checks are presumptively job-related, and that business necessity requires only that a practice rationally serves a valid business purpose (DOJ). The EEOC’s 2012 guidance says an arrest alone does not establish criminal conduct, and that a screen without individualized assessment is more likely to violate Title VII (EEOC). That same guidance says it does not have the force of law (EEOC).

Build to the stricter rule. A retailer that runs one national screen on the OLC reading and ignores California’s rule is exposed in every California store. California’s Civil Rights Department says its sample form can be used after a conditional offer and criminal background check to conduct the necessary individualized assessment of the applicant’s criminal history (CRD). In practice, that means the district HR partner runs the assessment after the conditional offer, using the state form, before anyone is rejected. The OLC opinion narrows the federal disparate-impact reading, but it does not change state law, and a private plaintiff can still bring an FCRA claim.

Negligent hiring: why screening still matters

Screening is not only a Title VII question. Florida’s statute says an employer is presumed not to have been negligent in hiring if it conducted a background investigation that revealed nothing showing the employee was unsuitable (Florida Senate). The same statute says that choosing not to conduct the investigation raises no presumption of negligence in hiring (Florida Senate). Read that second sentence carefully. It does not say a company that skips screening is safe. It says the presumption is unavailable, so the employer loses a defense it might have used.

The statute also sets a condition. To satisfy its criminal-background requirement, the employer must request and obtain a check from the state Department of Law Enforcement of the Florida Crime Information Center system (Florida Senate). A private consumer-reporting report alone does not meet that test. A Florida store that relies on a vendor report for the presumption has to add the state check.

Our judgment: scale the screen to the role, especially where internal theft exposure is highest. A cashier with no key access and a regional stock lead with a passkey do not carry the same foreseeable risk, and a uniform screen for everyone is simpler to administer but harder to defend against a negligent-hiring claim for the roles with the most access.

What to do this week

• Pull the background-check consent form and confirm it is a stand-alone document, separate from the application.
• Map each store to its state, and flag California and Florida for the specific steps above.
• Check that every rejected applicant in the last 90 days received both a pre-adverse and a final notice.
• Ask counsel to review the vendor’s forms before the next hiring cycle, not after.
• Set a written disposal date for each closed applicant file.