California Background Check Authorization Form Requirements

A compliant California background check authorization form requires a signed written consent from the applicant, collected only after the employer has handed over a standalone disclosure document that meets the six content requirements of the Investigative Consumer Reporting Agencies Act (ICRAA). The authorization must also include a checkbox letting the applicant request a free copy of any report the employer obtains, and when credit information is involved, it must identify the specific statutory basis that allows the employer to pull credit for that particular job. Getting any piece of this wrong exposes the employer to statutory damages of $10,000 or more per applicant under California Civil Code 1786.50, plus attorney’s fees.¹

Which California Law Applies

Two statutes govern the paperwork, and which one controls depends on what the employer is ordering. The Consumer Credit Reporting Agencies Act (CCRAA, Civil Code 1785.1 et seq.) covers pure credit-history reports. The Investigative Consumer Reporting Agencies Act (ICRAA, Civil Code 1786 et seq.) covers broader investigative reports touching on character, reputation, personal characteristics, or lifestyle, which includes most standard pre-employment screening involving criminal records, employment verification, and reference interviews.

Order only a credit report and only the CCRAA applies. Order a broader background check and the ICRAA controls. Order both, and both sets of requirements apply. Federal Fair Credit Reporting Act rules run in parallel to whichever California statute is in play.

The Standalone Disclosure That Precedes the Authorization

The authorization cannot be valid unless the disclosure preceding it is valid, so the two documents have to be understood together. Both federal law and California’s ICRAA require the disclosure to appear in a document consisting solely of the disclosure itself.² It cannot ride along inside the job application, sit inside a handbook, or be combined with a liability waiver.

Under the ICRAA, the standalone disclosure for employment-purpose reports must include all of the following:³

A clear statement that an investigative consumer report may be obtained for employment purposes.
The permissible purpose for which the report is being obtained.
An explanation that the report may cover the person’s character, general reputation, personal characteristics, and mode of living.
The name, address, telephone number, and website of the consumer reporting agency conducting the investigation.
A description of the nature and scope of the investigation, including a summary of the consumer’s rights under Civil Code Section 1786.22, which grants the right to inspect files, request copies, bring a companion, and get explanations of coded information.⁴
A notice telling the consumer where to find the screening agency’s privacy practices, including whether personal information will be sent outside the United States.

The “solely of the disclosure” requirement is strict. The Ninth Circuit has held that even seemingly helpful extra language, such as informing applicants of the right to inspect files at the screening agency, counts as extraneous information that breaks the standalone requirement. Anything beyond the required disclosures and short definitional explanations of terms like “consumer report” and “employment purposes” belongs in a separate document.

What the Authorization Form Must Contain

Once the disclosure has been delivered, the employer needs the applicant’s written authorization before actually ordering the report. Federal law allows the authorization to sit on the same page as the disclosure, but the ICRAA treats disclosure and authorization as separate requirements, and most California employers use two documents to be safe.³

The authorization form must include a checkbox that lets the applicant request a free copy of any report the employer obtains. If that box is checked, the employer has three business days from receipt of the report to send a copy to the applicant, and that copy must include the name, address, and phone number of whoever issued it.³ California is flexible on where the checkbox lives; it can appear on the disclosure form or on a separate consent form, so long as the applicant has a way to make the request.

Beyond those specifics, the authorization needs to do what its name says: give clear, unambiguous written consent to obtain the report. A signature line, the applicant’s printed name, and the date are the practical baseline. Vague or conditional language undermines the consent and can turn an authorization dispute into a statutory damages case.

Extra Content When Credit Reports Are Involved

If the employer plans to pull a credit report, a separate content requirement kicks in under the CCRAA. The written notice must identify the specific legal basis under Labor Code Section 1024.5 that authorizes credit information for the particular position, and it must include a checkbox for the applicant to request a copy of the report.⁵

California generally bans the use of credit reports for employment decisions. Credit can only be pulled for positions falling into specific categories, including managerial roles, jobs involving access to trade secrets or confidential proprietary information, and positions with regular access to $10,000 or more in cash during the workday.⁶ The authorization has to tell the applicant which category applies. A generic reference to credit information “may be obtained” is not enough.

Electronic Signatures

Authorizations can be collected electronically. The federal ESIGN Act defines an electronic signature as any electronic sound, symbol, or process executed with the intent to sign a record, and the FTC has confirmed that an electronic signature satisfies the FCRA’s requirement for “written instructions.” For applicants applying remotely by computer, phone, or mail, the FCRA explicitly allows consent to be given electronically.²

To hold up in a dispute, an electronic authorization needs two things. The consent has to be clear and unambiguous, and the electronic record has to be stored in a format that can be retained and accurately reproduced later. An online onboarding platform should log the date, time, and identity of the signer, and the signed document should be retrievable and printable years later.

Timing: You Cannot Ask About Criminal History Yet

One piece of timing changes when the authorization form can even be used. Under California’s Fair Chance Act, any employer with five or more employees is prohibited from asking about or considering an applicant’s conviction history until after making a conditional offer of employment.⁷ That means no criminal-history questions on the application, no felony checkbox, and no running a criminal background check before the conditional offer is on the table. An authorization form that gets signed at the application stage cannot be used to pull criminal records until the conditional offer has been extended.

Even after that offer, certain records cannot be considered at all: arrests that did not lead to conviction, participation in pretrial or posttrial diversion programs, and convictions that have been sealed, dismissed, expunged, or pardoned.⁷

How Long to Keep the Signed Form

Federal EEOC regulations require employers to retain personnel and employment records, including background check documents, for at least one year. For an involuntarily terminated employee, the clock runs from the termination date. If an EEOC charge is filed, all related records must be kept until the charge is fully resolved, including litigation and appeals.⁸

The practical retention window is longer. Holding the signed disclosure, the authorization form, the report itself, and any related notices for at least five years is the safer approach, given that the ICRAA carries a two-year statute of limitations for negligent violations and a longer window for willful ones. An employer that destroyed its authorization records two years after hiring would struggle to defend a later compliance suit.

What a Defective Form Costs

The exposure is per applicant, and that is what turns form problems into class actions. Under the ICRAA, any employer that fails to comply with the disclosure, authorization, or notice requirements is liable for the greater of the consumer’s actual damages or $10,000, plus attorney’s fees and litigation costs.¹ If a court finds the violation was willful or grossly negligent, punitive damages stack on top. An employer that used a defective authorization form across hundreds of applicants can face liability in the millions.

The FCRA creates a separate federal layer with its own statutory damages, attorney’s fees, and punitive damages. Fair Chance Act violations bring enforcement actions from the California Civil Rights Department. Most class actions in this space trace back to a single flawed form used company-wide for years before anyone noticed.

1
California Legislative Information. California Civil Code 1786.50 – Remedies
2
Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports
3
California Legislative Information. California Civil Code 1786.16
4
California Legislative Information. California Civil Code 1786.22
5
California Legislative Information. California Civil Code 1785.20.5
6
California Legislative Information. California Labor Code 1024.5 – Employer Use of Consumer Credit Reports
7
California Legislative Information. California Government Code 12952
8
U.S. Equal Employment Opportunity Commission. Recordkeeping Requirements