Background Check Authorization Form: The 2026 FCRA Rules Most Templates Miss (Free Template)

Written by

Helena Kozlova in

Legal Content Specialist, AI Lawyer

~10 min read · Updated June 2026

Fact-checked by

Kamal Tserakhau in

Legal Team Lead · AI Lawyer

Reviewed for accuracy · Verified June 2026

An FCRA-compliant background check packet shown as two documents: page one a standalone disclosure stating a consumer report may be obtained with nothing else on the page, page two a separate authorization with applicant details, state free-copy checkbox, and an e-signature stamp, kept apart from the job application — A compliant screening packet is two documents, not one: a standalone disclosure with nothing else on the page, and a separate signed authorization. The moment anything extra creeps into the disclosure, the packet becomes a class-action exhibit.

A background check authorization form is the written consent the federal Fair Credit Reporting Act requires before an employer, landlord, or organization orders a consumer report on someone. About 96 percent of employers screen candidates, so the form itself is routine. What is not routine is the legal landscape around it: automatic record-sealing laws now cover 14 states plus DC, two more switch on in 2026, and federal regulators have told screening companies to stop reporting sealed records at all. Most free templates were written before any of that.

The short answer

Federal law requires two things before the check: a clear disclosure that a consumer report may be obtained, in a standalone document containing nothing else, and the person's written or e-signed authorization. Strip out liability waivers and extra language, attach the current CFPB Summary of Rights (the version required since March 2024, not the older PDF most templates still bundle), and add state notices where they apply. New in 2024 to 2026: clean-slate laws automatically seal old convictions in 14 states plus DC, with Illinois live on January 16, 2026 and Virginia following July 1, 2026, and a CFPB advisory opinion says screening companies must not report sealed or expunged records. Decide on a candidate only after the two-step adverse-action process.

This article is general information for a U.S. audience, not legal advice. Screening law layers federal, state, and city rules, and the penalties are class-action shaped. Have counsel or your screening provider confirm your packet for the states where you hire or rent.

Need a compliant screening packet today? AI Lawyer drafts the standalone disclosure and the separate authorization from a few questions, with the state-notice slots and the copy-request checkbox built in. Free to try, no credit card.

Draft my form →

96%of employers run some form of background screening

$1.8MHome Depot's settlement over a disclosure with extra language

14 + DCstates with clean-slate sealing laws; Illinois joins Jan 16, 2026

7 yearsFCRA reporting limit for arrests that did not end in conviction

Is a background check authorization form legally required?

Yes, whenever the check is run through a consumer reporting agency, which covers virtually every commercial screening service. FCRA section 604(b)(2) requires the employer to disclose, in a clear and conspicuous standalone document, that a consumer report may be obtained, and to get the person's written authorization before procuring the report. Running the check without both steps exposes you to statutory damages, attorney's fees, and class actions, and the same duo is standard practice for tenant and volunteer screening.

The rule covers more than criminal history. A consumer report includes credit, eviction records, driving records, employment and education verification, and anything else a screening company assembles about a person.

Two roles matter in every dispute. The screening company is the consumer reporting agency, responsible for the report's accuracy. You are the user of the report, responsible for the disclosure, the authorization, and what you do with the results. The form is your half of the bargain.

Download the free Background Check Authorization Form Template or build a customized packet with the AI Generator, then have counsel confirm the state notices for where you operate.

Why must the disclosure be a standalone document?

Because the statute says so, and courts read it literally. The disclosure must consist solely of the disclosure: no liability waivers, no at-will language, no state notices mixed in, no job-application text around it. Home Depot paid $1.8 million to settle a class action over a disclosure that included a liability waiver, and that fact pattern repeats every year against employers who reuse pre-FCRA-litigation templates.

Comparison of two background check consents: one buried inside a job application with a liability waiver, labeled as class-action material citing the 1.8 million dollar Home Depot settlement, and one standalone disclosure with nothing else on the page that complies with FCRA section 604(b)(2) — The same consent, two outcomes. Buried in the application with a waiver attached, the disclosure is a lawsuit. Alone on its own page, it does its job.

The standalone rule produces a packet of two short documents. Document one is the disclosure: a few sentences saying a consumer report may be obtained for employment purposes, and nothing else. Document two is the authorization: the consent sentence, the identifying information the screener needs, the state checkboxes, and the signature.

The authorization page has slightly more freedom than the disclosure page, but the safe habit is minimalism on both. Every sentence a court could call extraneous is a discount on your defense.

One more formatting trap: the disclosure must be clear and conspicuous. Tiny print, dense legalese, or a disclosure screen buried in an online application flow can fail the standard even when the words are right.

What should the authorization form include?

Identification fields the screener needs (full name and aliases, date of birth, Social Security number, current and prior addresses, and driver's license number if driving records are in scope), the consent sentence naming who may obtain the report and for what purpose, the state-specific notices and the free-copy checkbox for California, Minnesota, and Oklahoma residents, and a dated signature, wet or electronic. Attach the current CFPB Summary of Rights, not the 2015 version many templates still bundle.

Section	What it does	Watch out for
Identity fields	Lets the screener match records to the right person	Collect only what the check actually needs
Consent sentence	Names the employer, the screener, and the purpose	Vague "any party" wording invites disputes
Scope	Lists the report types: criminal, credit, driving, verification	Credit checks are restricted or banned for many roles in 11+ states
State notices	Adds disclosures states require on top of the FCRA	California, New York, Washington, Minnesota, Oklahoma lead the list
Free-copy checkbox	CA, MN, OK residents can request a copy of the report	Required checkbox, commonly forgotten
Signature and date	Proves consent before the report was procured	E-signatures are valid with an authentication trail

The Summary of Rights attachment deserves a special check. The CFPB updated the mandatory form, and compliance with the new version has been required since March 20, 2024. A packet that still attaches the older PDF is out of date on its face, which is an easy flag for a plaintiff's lawyer scanning for sloppier problems.

For tenant screening, the same architecture applies with housing purposes in the consent sentence, and city rules like fair-chance housing ordinances may add their own notices.

What changed for background checks in 2024 to 2026?

Two shifts. First, the clean-slate wave: 14 states plus DC now automatically seal eligible conviction records after a waiting period, New York began sealing in November 2024 (three years for eligible misdemeanors, eight for eligible felonies), Illinois switches on January 16, 2026, and Virginia follows on July 1, 2026. Second, a CFPB advisory opinion effective January 2024 says screening companies violate the FCRA's accuracy requirement if they report records that have been sealed, expunged, or otherwise legally restricted, omit disposition information, or report duplicates. Old reports and old assumptions about what a check will show are both wrong now.

Timeline of background screening rule changes from 2024 to 2026: the CFPB advisory opinion barring sealed and expunged records and the updated Summary of Rights in 2024, New York automatic sealing from November 16, 2024, the Illinois clean-slate law effective January 16, 2026, and Virginia record sealing from July 1, 2026 — The screening rulebook moved between 2024 and 2026: a mandatory new Summary of Rights, a CFPB accuracy opinion aimed at sealed records, New York's sealing wave, and clean-slate switch-ons in Illinois and Virginia.

For employers, the practical meaning is that a clean report is no longer proof of a clean history, it is proof of a clean reportable history, which is exactly what the law intends you to use. Decisions should rest on what the report lawfully shows, not on side-channel searches that resurrect sealed records.

The CFPB opinion also tightened arrest reporting: an arrest that never became a conviction falls out of reports seven years after the arrest date, and later events do not restart that clock. If a report you receive shows a bare arrest from 2017, the report itself is suspect.

There is a hiring-side bonus in the same trend. Sealing restores candidates to your applicant pool, and fair-chance laws in a growing list of states and cities already required individualized assessment of records rather than blanket exclusions. A form and process built for 2026 keeps you compliant on both fronts.

If you screen in multiple states, make the state-notice section of your authorization modular, because this is the part of the packet that now changes yearly as clean-slate and fair-chance laws phase in.

Can one authorization cover checks during employment?

Federally, yes, if the disclosure says so: the FTC's guidance allows a clearly worded disclosure and authorization to cover reports obtained during employment, not just at hiring. But several states cut against evergreen consent, and California is the leading example, where reinvestigations generally need fresh notice and consent. The clean answer for multistate employers is to state the continuing scope in the original packet and still collect a fresh authorization before any new check on a current employee.

This is also where the old version of this article contradicted itself, and where many templates still do. A blanket promise that one signature covers every future check forever is not safe in every state, and a rule that every single check needs a new form overstates federal law. The accurate position is the layered one above.

Whatever scope you choose, write it in plain words in the disclosure, keep the signed packet for at least five years, and log which version of the form each person signed, the same record-keeping habit that wins ACH and e-sign disputes.

What happens if the report comes back negative?

A two-step adverse-action process, and the steps are mandatory. Before deciding, send the person a pre-adverse-action notice with a copy of the report and the Summary of Rights, then wait a reasonable period, commonly five business days, so they can dispute errors. If you proceed, send the final adverse-action notice with the screener's contact details, a statement that the screener did not make the decision, and the person's dispute and free-report rights.

The five-step compliant screening sequence: standalone disclosure, signed authorization, the background check itself, the pre-adverse-action notice with a copy of the report, and the final decision with the adverse-action notice — The compliant screening sequence from disclosure to decision. Skipping the pre-adverse step is one of the most-litigated FCRA mistakes.

The waiting period is where errors surface: wrong-person matches, records missing dispositions, and, increasingly, records that should have been sealed. Given the CFPB's accuracy opinion, treating a dispute seriously protects you as much as the candidate, because acting on a report the screener should not have produced is a poor place to litigate from.

Fair-chance laws add a layer in many places: jurisdictions like New York City and Los Angeles County require an individualized assessment, in writing, of how a conviction relates to the role before you may withdraw an offer. Check the city, not just the state.

What are the most common mistakes on these forms?

Five repeat offenders: a liability waiver or any extra language inside the disclosure, the outdated Summary of Rights attached, no state notices or free-copy checkbox, an evergreen consent used in a state that requires fresh authorization, and skipping the pre-adverse-action step. Every one of them is cheap to fix in the template and expensive to fix in court.

Mistake	Safer fix	Why it matters
Extra waiver inside the disclosure	Keep the disclosure on its own page and move consent elsewhere	The standalone rule is the classic class-action trigger
Outdated Summary of Rights	Attach the current CFPB form required since March 20, 2024	An old attachment makes the packet visibly stale
Missing state notices or copy checkbox	Add modular notices and the CA, MN, OK free-copy checkbox	State rights travel with the applicant or employee
One signature for every later check	State the continuing scope but collect fresh consent where states require it	California and similar rules cut against one-signature-forever language
Skipping pre-adverse notice	Send the report and Summary of Rights, wait, then send final notice	The two-step adverse-action process is mandatory

A sixth, newer mistake is process rather than paperwork: rejecting a candidate over a record the report should not contain. If a candidate says a conviction was sealed, the right response is to ask the screening company to reinvestigate, not to find the old record on a search engine and use it anyway.

Templates age badly in this area. The form you downloaded in 2022 predates the new Summary of Rights, the CFPB opinion, New York sealing, and the Illinois and Virginia clean-slate laws. Treat the screening packet as a living document with an annual review date.

Frequently asked questions

Do I need a separate authorization for each background check?

Not necessarily under federal law: a disclosure that clearly covers reports during employment can support later checks. Several states require fresh notice or consent for new checks, with California the strictest. The safe multistate practice is one packet at hiring stating the continuing scope, plus a fresh authorization before any later check.

Can the disclosure and authorization be on one page?

Keep them as two documents. The FCRA requires the disclosure to be standalone, consisting solely of the disclosure. Courts have allowed the authorization to share the page in some circuits, but combining them invites exactly the litigation the standalone rule was meant to prevent, and two short pages cost nothing.

Is an electronic signature valid on a background check authorization?

Yes. The FCRA permits electronic disclosure and authorization consistent with the E-SIGN Act. Present the disclosure as its own screen, not a checkbox buried in the application flow, capture a timestamp and the consent text version, and store the record so you can reproduce it if the consent is ever disputed.

What is a clean-slate law and how does it change my background checks?

A clean-slate law automatically seals eligible criminal records after a waiting period without the person filing a petition. Fourteen states plus DC have one, New York's sealing began in November 2024, Illinois takes effect January 16, 2026, and Virginia on July 1, 2026. Sealed records will not appear in compliant reports, and screening companies must not report them under the CFPB's accuracy opinion.

Can I run a credit check on every applicant?

No. Credit checks for employment are banned or sharply limited in more than ten states and several cities, with exceptions for financial and management roles. Where allowed, list credit explicitly in the scope of your disclosure. For tenant screening, credit is standard but fair-housing and fair-chance ordinances may restrict how you use it.

How long should I keep signed authorization forms?

At least five years is the common recommendation, covering the FCRA's statute of limitations, which runs up to five years from the violation. Keep the signed disclosure and authorization, the version of the consent text used, and for electronic signatures the timestamp and authentication data, encrypted and access-controlled.

What if an applicant refuses to sign the authorization?

You cannot run the check, and you may generally decline to proceed with the application if screening is a uniform requirement for the role. Apply the rule consistently and document it, because selective screening is where discrimination claims start. EEOC guidance requires treating similarly situated applicants alike.

Does the form cover volunteers and contractors?

Use it for them, yes. Courts and regulators have treated screening of contractors and volunteers as within the FCRA's employment-purposes framework in many situations, and organizations working with children or vulnerable adults often face separate state screening mandates with their own consent forms. The standalone disclosure plus authorization structure works for all of them.

Sources and references

Fair Credit Reporting Act, 15 U.S.C. §1681b(b)(2) (section 604(b)(2)), the standalone disclosure and written authorization requirements for employment-purpose consumer reports.
CFPB, Fair Credit Reporting; Background Screening, advisory opinion effective January 23, 2024: reasonable procedures must prevent reporting of sealed, expunged, or legally restricted records and duplicates, require disposition information, and cap bare-arrest reporting at seven years.
CFPB updated Summary of Your Rights Under the Fair Credit Reporting Act, mandatory compliance since March 20, 2024.
FTC, Using Consumer Reports: What Employers Need to Know, and FTC staff guidance on disclosures covering reports obtained during employment.
Home Depot background-check disclosure class action settlement of $1.8 million, as reported by Top Class Actions.
New York Clean Slate Act, automatic sealing beginning November 16, 2024: eligible misdemeanors after three years, eligible felonies after eight.
Illinois Clean Slate Act, effective January 16, 2026, and Virginia record-sealing implementation effective July 1, 2026; clean-slate laws live in 14 states plus DC as compiled by iProspectCheck and PBSA-affiliated screening sources, 2026.
PBSA and HR.com employer survey: approximately 96 percent of employers conduct some form of background screening.
EEOC, Background Checks: What Employers Need to Know, on consistent, non-discriminatory use of screening results.

Two clean pages, zero extraneous words Draft a screening packet built for 2026. AI Lawyer generates the standalone disclosure and the separate authorization with current state notices, the free-copy checkbox, and the adverse-action letters to match. Free to start, no credit card required. Start free with AI Lawyer →

AI Lawyer drafting a background check disclosure and authorization packet