The FCRA Disclosure and Authorization Form: What Most Employers Get Wrong

The FCRA disclosure form is the cheapest document in the hiring workflow and the most expensive one to get wrong. Every published seven-figure FCRA settlement of the last decade has involved the same fact pattern: the disclosure was not standalone, contained extraneous language, or was bundled with other forms.

The statutory rule

Under 15 U.S.C. §1681b(b)(2)(A), the disclosure that a consumer report may be obtained for employment purposes must be made in a document that consists solely of the disclosure. The Supreme Court declined to limit Spokeo standing for these violations, and the Ninth Circuit's Gilberg v. California Check Cashing line is the controlling guidance: 'solely' means solely.

What 'solely' excludes

• Liability releases or waivers of any kind.
• Statements that the authorization is a continuing one valid for the duration of employment.
• State-specific notices bundled into the same page.
• Application-tracking language, ATS form numbers, branding boilerplate.
• Any 'I have read and understood' language tied to other documents.

What 'solely' permits

• The FCRA disclosure language itself.
• The signature block.
• Minimal identifying information (name, date, address line).
• The candidate's authorization (the FCRA permits authorization on the same form as the disclosure, though many counsel still recommend separating them).

The SafestHires standard

1. Disclosure form is a single standalone document, no liability waivers, no continuing-authorization language, no logos.
2. Authorization is a separate document immediately following the disclosure in the workflow.
3. State-specific notices (California ICRAA, NY Article 23-A, Washington, Maine) are delivered as separate documents with their own e-signature events.
4. Annual external audit by FCRA counsel of the disclosure-authorization package — the artifact every defense brief opens with.