The Consumer Financial Protection Bureau (CFPB) has issued new guidance clarifying that employers must comply with the Fair Credit Reporting Act (FCRA) when using third-party background dossiers and algorithmic scoring systems for employment decisions.
In Circular 2024-06, released October 24, 2024, the CFPB emphasizes that the rise of worker monitoring technology and AI-driven assessment tools has created new forms of “consumer reports” that fall under FCRA regulation. These modern tools include systems that track sales interactions, driving habits, task completion times, messaging patterns, meeting attendance and even keystroke frequency.
The guidance explains that when employers use such reports for hiring, promotion, reassignment or retention decisions, they must follow FCRA requirements. This includes obtaining worker permission before procuring reports, providing notices before taking adverse actions and limiting report usage to permissible purposes under the law.
Similarly, companies that create these monitoring and scoring systems may qualify as “consumer reporting agencies” under FCRA if they assemble or evaluate consumer information to produce reports for employers. This includes firms that develop algorithms using worker data to generate performance scores or risk assessments.
Notably, the CFPB clarifies that software providers could be considered consumer reporting agencies if they take an active role in providing ongoing services or if their software assembles or evaluates worker information to produce employment-related reports. This represents an evolution from earlier regulatory guidance that didn’t anticipate modern AI and algorithmic assessment tools.
The circular underscores that FCRA provides important worker protections, including the right to access their files, dispute inaccurate information and receive notice of adverse actions. It also places strict limits on sharing worker data and reporting outdated negative information.
This guidance serves as a reminder that employment screening tools, whether traditional background checks or cutting-edge AI systems, must comply with longstanding consumer protection laws. As workplace surveillance technology continues to evolve, employers and technology vendors should carefully evaluate their FCRA obligations.
Employers using these tools should ensure their practices align with FCRA requirements, while technology providers should assess whether their services qualify them as consumer reporting agencies subject to FCRA regulation.