Credit History in Employment: California Laws & Your Rights

The Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq., establishes the baseline federal framework for consumer reports, including credit reports used in employment decisions. The FCRA requires that before a covered employer obtains a consumer report, it must provide you with clear written notice (separate from other documents) disclosing that it may obtain a consumer report for employment purposes and obtain your written authorization. Employers covered by the FCRA include most private employers with employees, though very small employers and federal government agencies have different obligations.

Under federal law, once an employer obtains your credit report through a consumer reporting agency, they may use it in employment decisions. However, the FCRA does not prohibit using credit reports for employment; it only requires notice, consent, and proper handling. The Equal Employment Opportunity Commission (EEOC) has issued guidance stating that use of credit history in hiring decisions can constitute illegal discrimination if the practice has a disparate impact on protected classes (race, national origin, etc.) or is applied in a discriminatory manner.

Federally, once a negative decision is made based on a consumer report, the employer must provide you with an additional notice of the adverse action, including the name and contact information of the consumer reporting agency and your right to dispute the information. The Consumer Financial Protection Bureau (CFPB) enforces the FCRA. Remedies under the FCRA include actual damages, statutory damages of $100–$1,000 per violation, punitive damages, and attorney fees. The federal baseline is permissive compared to state protections; it focuses on procedural safeguards (notice and consent) rather than restricting when credit reports can be used.

California Labor Code § 432.3 is significantly stricter than federal law. Under this statute, employers are prohibited from obtaining, requesting, or using credit reports, credit information, or credit-based consumer reports unless the job falls within one of three narrow exceptions.

The three permissible exceptions are: (1) positions involving access to confidential company information, (2) positions involving security responsibilities or access to security information, and (3) positions involving direct access to money, negotiable instruments, or valuable property. Even when one of these exceptions applies, the employer must still comply with FCRA notice and consent requirements. California law requires written notice and written authorization before obtaining any credit report.

California's law is substantially more employee-protective than federal law in two ways. First, it restricts *which employers can obtain credit reports at all*, not just how they must handle them. Second, it shifts the burden: an employer claiming an exception must prove the job meets one of the three statutory categories. The federal FCRA, by contrast, permits any covered employer to use credit reports as long as proper notice and consent procedures are followed.

Coverage differs as well. California Labor Code § 432.3 applies to all California employers, regardless of size. The FCRA applies to most private employers but exempts very small employers and has special rules for federal agencies. Additionally, California law provides no exemptions for federal contractors or government employers the way the FCRA does.

Unique to California is the explicit statutory remedy. A violation of Labor Code § 432.3 constitutes a violation of the California Consumer Legal Remedies Act, Civil Code § 1750 et seq. This means you can recover statutory damages of $100–$1,000 per violation, plus actual damages, and the employer must pay your attorney fees and costs. You do not need to prove actual harm; statutory damages are automatic. No comparative federal FCRA provision provides statutory damages in the same amount or structure for violation of consent requirements.

The primary exception to California's credit check prohibition is the three-category test. An employer may obtain a credit report only if the position involves (1) access to confidential company information beyond what is routine for the job, (2) security responsibilities or access to security-related information, or (3) direct access to money, negotiable instruments, or valuable property.

Courts have interpreted these narrowly. "Access to confidential information" does not include routine customer data or employee information unless the role is specifically in compliance, legal, or executive management. "Security responsibilities" means roles like security guards or facility managers, not general employees subject to background checks. "Direct access to money" means tellers, accountants, or financial controllers, not employees in departments that handle money incidentally.

Federal government employers are exempt from California Labor Code § 432.3 to the extent federal law preempts it, but private employers cannot claim this exemption. Positions covered by federal security clearance requirements do not automatically qualify; the job must still meet California's three-category test in substance.

Another exception: if a consumer reporting agency erroneously obtains and provides a credit report, and the employer did not request or authorize it, the employer is not automatically liable—but the employer must still comply with adverse action notice requirements if it uses the information. The employer cannot escape compliance by claiming the agency provided it unsolicited.

Unions and collective bargaining agreements do not exempt employers from California Labor Code § 432.3, even if a union contract permits credit checks. State law cannot be contracted around. However, if an arbitration clause exists in an employment agreement, you may be required to arbitrate rather than litigate, subject to California arbitration law rules.

Small employers (under 5 employees) are not exempt from Labor Code § 432.3, unlike some other California employment laws. Temp agencies and staffing firms are covered and cannot obtain credit reports for temporary workers unless the temporary job meets the three-category exception. Finally, if the employer obtains a credit score or report but does not use it in an employment decision, a violation may still occur at the moment of obtaining or requesting the report, even if the information is never reviewed.

Step 1: Document and Gather Evidence. Keep a record of every communication from the employer requesting a credit check. This includes emails, job applications with credit-check language, letters from the employer, or notices from consumer reporting agencies. Write down the date, time, and exact words used if the request was verbal. Take a screenshot or photograph of any written request. Request a copy of your credit report from all three major bureaus (Equifax, Experian, TransUnion) using annualcreditreport.com, which is free. Note any hard inquiries on your report; these appear when a company pulls your credit. Document the specific job title and description at the time of the request—establish that your position did not fall into one of the three exceptions (confidential access, security, or direct money access).

Step 2: Attempt Internal Resolution. Send a written email or letter to your employer's HR department stating that you believe the credit check request violates California Labor Code § 432.3 and requesting written explanation of how your position falls into one of the three statutory exceptions. Keep a copy. Give the employer 10–14 business days to respond. If they provide a written justification, review it carefully; if it does not clearly explain how your job involves access to confidential information, security responsibility, or direct money access, you have evidence of violation. Many employers will back down at this stage. Do not sign any authorization for a credit check; any future request without clear exception is a fresh violation.

Step 3: File a Complaint with the California Department of Consumer Affairs or Consumer Complaint Department. California Labor Code § 432.3 violations fall under the Consumer Legal Remedies Act (Civil Code § 1750), overseen by the California Attorney General (AG). You can file a complaint online at the California Attorney General's Consumer Complaint page (oag.ca.gov/consumers) or by phone at 1-800-952-5225. You can also complain to the Consumer Financial Protection Bureau (CFPB) at consumerfinance.gov if the credit report was obtained through a consumer reporting agency, which provides federal enforcement under the FCRA. The CFPB complaint process is online and takes 10 minutes. You are not required to file with an agency before suing privately; California law permits private right of action under the Consumer Legal Remedies Act.

Step 4: Understand the Investigation and Enforcement Process. The California Attorney General will investigate complaints of Labor Code § 432.3 violations and may pursue civil penalties or settlements on behalf of consumers. The CFPB likewise conducts investigations of FCRA violations. However, these agency investigations can take 6–12 months or longer; they are not guaranteed to result in individual compensation. The employer will be contacted and asked to respond. The AG or CFPB may seek injunctive relief (stopping the practice), civil penalties, and restitution, but individual complainants may not receive direct payment from agency enforcement. If the agency takes action, you may be able to join as an interested party or receive notice of settlement; request in writing that you be kept informed.

Step 5: Consult an Employment Law Attorney and Consider a Private Lawsuit. Because statutory damages under the Consumer Legal Remedies Act are $100–$1,000 per violation, most violations involve at least $100 in automatic damages, plus attorney fees, making private litigation economically viable. You do not need to wait for agency resolution. Call an employment law attorney licensed in California immediately after documenting the violation. Many offer free consultations. Bring your documentation, the job description, and your credit reports. An attorney can file a private civil lawsuit in California Superior Court under Labor Code § 432.3 and the Consumer Legal Remedies Act. The statute of limitations is 4 years from the date of violation (not from discovery, in most cases). Your attorney will send a demand letter to the employer; many settle quickly rather than litigate statutory damages claims. If the employer violated the law for multiple employees, a class action may be appropriate; discuss this with your attorney. The employer pays your attorney fees and costs if you prevail, so the initial cost to you is typically minimal or contingent.