Guides
Background checks: lawful screening and privacy risks
Background checks for employers, contractors, and people being screened: FCRA duties, fair-chance rules, verification steps, and privacy risks.
Background checks can mean two very different activities. One is a defined check, made for a stated purpose, with the subject's knowledge, using sources that can be verified and corrected. The other is quietly assembling a picture of someone who has no idea it is happening.
The first is ordinary and often required. The second is intrusive, frequently inaccurate, and in a number of situations unlawful. This page is about the first, and about the line between them, because that difference has practical consequences for privacy, accuracy, and legal exposure.
What to take away
- If you are an employer, this is regulated, the details differ by country and by state, and the cost of getting it wrong is not theoretical.
- Do not compile a profile on a private individual who has not consented and has no idea it is happening.
- You are generally entitled to know a report is being obtained about you for employment, and to authorize it.
What makes a check legitimate
Three things, together. Missing any one of them and you are doing something else.
A purpose. A specific decision that the check informs: hiring for a defined role, letting a property, engaging a contractor, extending credit, entering a contract. "Curiosity", "due diligence" as a general feeling, and "I want to know who I am dealing with" are not purposes; they are moods.
The subject's knowledge and, where the law requires it, written consent. In US employment screening that uses a third-party consumer reporting agency, federal law requires a standalone disclosure and written authorization before the report is obtained. Other contexts and state and local rules can differ.
Scope tied to the purpose. A check for a driving role looks at driving. A check for a finance role looks at financial conduct. Collecting everything available because it is available is the definition of the thing you are trying not to do.
Add a fourth in practice: a route for the person to see and correct what came back, because these records get things wrong more often than people expect.
Employment screening, done properly
If you are an employer, this is regulated. The details differ by country and by state. The cost of getting it wrong is not theoretical.
Employment screening sequence
- Decide what the role requires, in writing
- Disclose and obtain written authorization
- Use a regulated consumer reporting agency
- Apply results consistently, record reasoning
- If result may cost someone, follow adverse action
What follows is the shape of the process, not legal advice. For US employment screening, the main federal law is the Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq.; state and local requirements may add protections. Check current rules with the relevant regulator or an employment lawyer before you run anything. Start with the EEOC's guidance for employers on background checks.
The sequence in outline:
- Decide what the role actually requires, in writing, before you look at any candidate. Which checks, and why each one is relevant to this job. Doing it in this order is what stops the check from becoming a search for a reason.
- Disclose and obtain written authorization.In the US, where a third-party screening company produces the report, the disclosure that you may obtain it generally has to stand on its own rather than be buried inside an application form, and the candidate has to authorize it.
- Use a screening provider that operates as a regulated consumer reporting agency, not a general search service. This matters because the regulated route carries accuracy obligations and a dispute process; the unregulated one carries neither.
- Apply the results consistently, using criteria set in advance for every candidate for that role, and record the reasoning.
- If the result may cost someone the job, tell them before you decide.The point of a pre-decision notice, with a copy of the report and a statement of their rights, is to give a real opportunity to correct an error, and identity mismatches are common enough that this step earns its keep.
- Give the final notice if you still decline, including how to dispute the report with the agency that produced it.
- Retain and dispose of the data properly.Restrict who can see it, keep it only as long as the purpose and the law require, and destroy it securely. Handling personal data you have collected is its own obligation, and the consumer reporting file most checks draw on, along with the dispute route attached to it, is described by the Consumer Financial Protection Bureau.
On criminal records specifically. The FCRA generally limits reporting of specified non-conviction criminal records to seven years, subject to exceptions; its seven-year limit does not apply to criminal convictions. State and local laws may impose stricter rules. Fair-chance laws also affect when and how employers may consider criminal history; examples include California's Fair Chance Act and New York Correction Law Article 23-A. Where a record can be considered, the defensible approach weighs the nature of the offense, how long ago it was, and its actual relationship to the duties of the job, rather than treating any record as automatically disqualifying. Check the current rules where the job is located.
Things that turn a lawful check into a liability: running a search yourself instead of using the regulated process because it is faster; browsing a candidate's social media and letting what you see there influence a decision you cannot document; checking one candidate and not the others; and collecting information that reveals characteristics you are not permitted to consider.
Verifying a contractor, a tradesperson, or a professional
This is different work, and most of it is not about the person at all. You are checking credentials and a business, both of which are supposed to be checkable.
Verifying a contractor
- License number checked against issuing register
- Insurance confirmed directly with the insurer
- Business looked up in companies registry
- Real address and real trading history
- References you call yourself, specific questions
- Reviews read for pattern, not score
- The license, with the issuing body.Trade licensing is state- and occupation-specific. Use the official state licensing board lookup and check the license number yourself; for securities professionals, use FINRA BrokerCheck, and for mortgage professionals, use NMLS Consumer Access. Confirm that the name, status, and any disciplinary history match; do not accept a photograph of a certificate.
- Insurance, from the insurer.Ask for the certificate and confirm it directly with the insurance company, including that it is current and covers the work in question.
- The legal entity.Look the business up in the relevant state's official business-entity registry, commonly maintained by the Secretary of State: does it exist, is it in good standing, how long has it been registered, and does the name on the quote match the name that is registered?
- A real address and a real trading history.A registered address that is a mailbox, a website registered last month, and a phone number that only ever goes to voicemail are worth noticing together.
- References you actually call, chosen by you where possible from recent jobs of a similar type, with specific questions: what went wrong, how was it handled, was the final price the quoted price.
- Reviews, read for pattern rather than score.A run of short five-star reviews posted in the same week says less than one detailed complaint and how the business replied to it.
- The paperwork.A written scope, a written price, and a payment schedule that is not front-loaded. A demand for a large cash deposit up front is the most common warning in home improvement work.
- Complaint and disciplinary recordswhere the regulator publishes them, and, where relevant to a large contract, whether the business has judgments or liens against it in the public court record.
None of this requires a report about a private individual. It is a check on a business's claims about itself.
Verifying a company you are about to transact with
Before you pay an invoice
- Registry entry for the company
- Registration or tax number on the invoice
- Verifiable physical address
- Bank details confirmed by calling a number you found yourself
Most importantly, confirm bank details by calling a number you found yourself, never one supplied in the email carrying the invoice. Changed payment details arriving by message are the most expensive fraud pattern in business. No background research substitutes for that call.
The message-level version of the same pattern is in phishing scams. The wider pattern is covered in impersonation scams.
The line, stated plainly
Do not compile a profile on a private individual who has not consented and has no idea it is happening. Not on a date, not on a neighbor, not on an ex, not on someone your relative is seeing, not on a person who annoyed you online.
Legitimate check vs quiet profile
Legitimate check
- Consent
- Subject authorizes
- Lawfulness
- Defined permissible purposes
- Accuracy
- Accuracy obligations, disputes
- Risk to subject
- Bounded use
- What it answers
- Role-relevant criteria
Quiet profile
- Consent
- No idea it happens
- Lawfulness
- Often unlawful
- Accuracy
- Merged and stale records
- Risk to subject
- Machinery of stalking
- What it answers
- Rarely what you wanted
The reasons are practical as well as ethical:
- It is often unlawful.Reports obtained through the regulated route may only be used for defined permissible purposes; personal curiosity is not one, and the general search services that sit outside that regime are not permitted to be used for decisions about employment, housing, or credit at all.
- It is unreliable.These compilations are aggregations of records matched on names and dates of birth. Common names get merged. Middle initials get dropped. Sealed and corrected records persist after they should have gone. People routinely find serious entries that belong to a stranger.
- It is dangerous to the subject.Address history, relatives, and workplace are precisely what is used to locate people who have deliberately made themselves hard to find. This is the machinery of stalking and of domestic abuse, whatever the intention of any individual user.
- It rarely tells you what you actually wanted to know.People turn to it about someone they already have doubts about. Doubts are enough. You can decline a date, end a conversation, or not do business without producing a dossier.
Do not use people-search or data-broker sites. They are not a shortcut to a regulated check, using them for a hiring or tenancy decision is a legal problem rather than a corner cut, and their data quality does not support the confidence people place in it. This site does not link to them.
Verifying that a person you met online is who they claim (a live video call, a reverse image search on a public profile photo), is a different and legitimate act, and it is covered in catfishing. A privacy checkup covers what a stranger can find about you before any meeting takes place.
If you are the one being checked
- For an employment report from a third-party consumer reporting agency, the FCRA generally requires the employer to give you a standalone disclosure and obtain your written authorization before getting the report.
- If the employer may take adverse action based on the report, you are generally entitled to a copy and the Summary of Your Rights before the decision, followed by an adverse action notice if the decision stands.
- Dispute inaccuracies with the agency that produced the report, in writing, with documents. The agency has an obligation to investigate; the employer cannot fix it for you.
- Mixed files are common.If the report contains someone else's record, say so explicitly and give the identifying details that distinguish you.
- Check what is publicly visible about you before someone else does, not to hide anything, but because an old public post or a wrongly attributed record is easier to address when you know it is there. The visibility side of that is the work in privacy settings.
Specific rights, deadlines, and remedies vary by jurisdiction. For federal consumer-reporting rights, consult the Consumer Financial Protection Bureau and the Federal Trade Commission; for state and local requirements, check the state attorney general, labor agency, or relevant licensing authority.
If you are being checked
- You are entitled to know and authorize
- If it costs you, get a copy and agency name
- Dispute inaccuracies with the agency, in writing
- Mixed files are common, give distinguishing details
- Check what is publicly visible about you
Common questions
Is it legal to look someone up before a first date?
Looking at what someone makes public is ordinary, but a background report or an address-and-relatives profile is different.
A regulated report cannot be used for that, and it can cause real harm if the person has reason to be hard to find. Verify they are who they say they are, and decline the date if you are not satisfied.
Can I use a free search site to check a nanny or a cleaner?
Not for the decision. In the US, there is no single criminal-record check that every household employer can use for every role. Check state law and use an authorized state or occupational channel if one applies. The FBI's Identity History Summary is a personal record-request service, not a universal employer-screening route. Use the legally authorized process, with consent.
How far back do checks go?
It depends on the jurisdiction, the type of record, and sometimes the salary or seniority of the role. The FCRA generally limits reporting of specified non-conviction criminal records to seven years, subject to exceptions, but does not apply that limit to criminal convictions. State and local rules may be stricter, so confirm the requirements where the job is located.
Something wrong is showing up about me. Where do I start?
With the agency that produced the report, not with the company that read it. Ask for your file, identify the specific entries that are wrong, and provide documents. If the entry belongs to a different person with a similar name, say that in those words.
In this guide
- Background check rules: consent, purpose, notice and correctionWhat background check rules require: consent, a stated purpose, notice before a decision, and a way to correct errors, plus where to get local detail.
- Background check examples 2027: ordinary or suspicious?Background check examples 2027 distinguish ordinary job and rental screening from document grabs, fake fees, credential requests and verification links.
- Background Check Risks: Wrong Records and FCRA Dispute StepsBackground check risks for job applicants: six common report errors, the seven-year reporting limit, how to get your file, and the FCRA steps to dispute a wrong report and notify the employer.
- Background checks policy template 2027: what to includeA background checks policy template 2027: the seven questions to answer, the clauses to include, and the FCRA rights that protect the person checked.
- Best background checks tools 2027: how to chooseBest background checks tools 2027: how to tell regulated consumer reports from people-search reports, name the right providers, and avoid buying reassurance.
- Background checks changes, one decision at a timeBackground checks change in three places at once: your own file, the rules where you live, and the scams that borrow the process. Here is how to track each.
