Employee Background Check Laws in Colorado

The Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq., is the primary federal law governing background checks for employment. The FCRA applies to all employers who use third-party consumer reporting agencies (background check companies) to obtain information about job applicants. Under the FCRA, employers must (1) provide written notice and obtain written consent from the applicant before ordering a background check; (2) provide a copy of the background report to the applicant if adverse action is being considered; (3) provide pre-adverse action notice giving the applicant an opportunity to dispute the information; and (4) provide final adverse action notice after the decision is made.

The Equal Employment Opportunity Commission (EEOC) enforces the FCRA and has issued guidance stating that blanket policies excluding individuals with any criminal history may constitute discrimination under Title VII of the Civil Rights Act of 1964, 42 U.S.C. § 2000e. Employers must evaluate the nature, severity, and age of the conviction and its relevance to the job. Remedies under the FCRA include damages for willful non-compliance, equitable relief, and attorney's fees. The Federal Trade Commission (FTC) also enforces FCRA provisions related to background check company accuracy and procedures.

Colorado strengthens federal FCRA protections through its ban-the-box law (C.R.S. § 24-72-308) and individualized assessment requirement (C.R.S. § 24-72-309). The ban-the-box law applies to all Colorado employers and prohibits them from asking job applicants or advertising materials to disclose information about criminal history on initial job applications, resumes, or employment questionnaires. This means employers cannot ask "Have you ever been convicted of a felony or misdemeanor?" or similar questions until after the applicant has been selected for an interview or conditional job offer has been extended.

Colorado's individualized assessment law (C.R.S. § 24-72-309) requires that if an employer intends to deny employment based on a criminal record, the employer must first conduct an individualized assessment considering: (1) the nature and gravity of the crime; (2) the time elapsed since the conviction or sentence; (3) the nature of the job sought; (4) evidence of rehabilitation; and (5) other relevant factors. This assessment must occur before an adverse employment decision is made and cannot be based on a blanket exclusion policy.

Under Colorado law, employers must also provide adverse action notice within five business days of the decision to deny employment based on background check information. The notice must include: (1) a statement that adverse action has been taken; (2) the name and contact information of the background check company; and (3) information about the applicant's right to dispute the accuracy of the information. Colorado law applies to all employers conducting business in the state, regardless of size, making it broader than the federal FCRA in some respects. The Colorado Department of Regulatory Agencies and the Colorado Attorney General enforce these provisions.

Colorado's ban-the-box law and individualized assessment requirement contain important exceptions and limitations. First, the ban-the-box restrictions do not apply to inquiries required by federal law or regulation, such as background check requirements for positions involving access to firearms, national security clearances, or certain financial institutions. Second, the individualized assessment requirement does not apply to applicants with convictions for violent felonies or sex offenses, though employers must still follow FCRA procedures.

Third, positions in regulated industries such as healthcare, education, childcare, and elder care may have separate statutory requirements or licensing board rules that permit or require background checks at earlier stages of the hiring process. Fourth, the FCRA allows employers to use third-party background check firms, but if the employer conducts background checks internally using publicly available records, some FCRA notice and consent requirements may not apply, though due diligence regarding accuracy is still necessary.

Fifth, employers are not required to hire applicants with criminal records; they may legally deny employment if the criminal history is genuinely relevant to job duties and after conducting the individualized assessment. Sixth, the ban-the-box law does not prohibit asking about criminal history after the applicant has been selected for an interview or a conditional job offer has been extended. Seventh, employers may conduct background checks on current employees for promotion without the same ban-the-box restrictions, though FCRA compliance and individualized assessment principles should still apply.

Step 1 — Document and Gather Evidence: If you believe an employer violated Colorado background check laws, gather and preserve all written communications related to the background check process. Keep copies of: (1) any written notice or lack thereof from the employer about background check authorization; (2) the actual background report obtained by the employer; (3) any adverse action notice received and when it was received; (4) job postings or applications that improperly asked about criminal history; (5) emails or communications showing the employer's hiring decision; (6) any disputes you submitted to the background check company. Record dates, names of people you spoke with, and specific statements made during phone conversations. If the background report contained inaccurate information, obtain a copy of the report and document what information was wrong.

Step 2 — Internal Complaint and Dispute Process: First, contact the background check company directly to dispute any inaccurate information in the report. The company is required under FCRA to investigate within 30 days and provide you written results. Request a corrected report be sent to the employer. Simultaneously, contact the employer's human resources department or hiring manager to challenge the adverse employment decision. Request a written explanation of how the criminal history related to the job duties and what individualized assessment was conducted under C.R.S. § 24-72-309. Ask for a written response within 10 business days. Keep detailed records of these communications.

Step 3 — File with Appropriate Agency: If the background check company violated FCRA procedures or provided inaccurate information, file a complaint with the Federal Trade Commission (FTC) at reportfraud.ftc.gov or by mail to FTC, 600 Pennsylvania Avenue NW, Washington, DC 20580. If the employer violated Colorado's ban-the-box law or individualized assessment requirement, file a complaint with the Colorado Attorney General's Office, Civil Enforcement Section, 1300 Broadway, 10th Floor, Denver, CO 80203, or online at coag.gov. Include: (1) your name, contact information, and job title sought; (2) the employer's name and address; (3) the background check company name (if applicable); (4) dates of the application and adverse action; (5) the specific law violated (citation to C.R.S. § 24-72-308 or § 24-72-309 and/or FCRA sections); (6) copies of all relevant documents; (7) a detailed narrative of what happened. The deadline to file with the Colorado Attorney General varies by specific violation but must generally be filed while the matter is recent; there is no statutory limitation period specified in the law.

Step 4 — Investigation and Administrative Process: Upon receiving your complaint, the Colorado Attorney General's Office (or FTC) will open an investigation. You will be asked to provide additional information and sworn statements. The employer will be contacted and given an opportunity to respond. The investigation typically takes 30 to 120 days depending on complexity. You will receive periodic updates on the investigation status. The FCRA investigation process through the FTC may take longer but generally results in a determination letter. If the agency finds a violation, it may negotiate a settlement with the employer, issue a cease-and-desist order, or refer the matter for enforcement action.

Step 5 — Consult an Attorney: Given the complexity of background check law and the technical requirements of both FCRA and Colorado law, it is strongly recommended to consult an employment law attorney before filing a complaint or immediately after discovering the violation. An attorney can help you determine whether the employer's conduct actually violates law, evaluate the strength of your claim, negotiate directly with the employer for compensation, draft demand letters, represent you before administrative agencies, and pursue civil litigation if necessary. Many employment attorneys work on contingency for background check violations and will handle the case without requiring upfront fees. Look for an attorney licensed in Colorado who specializes in employment discrimination and FCRA violations. Some legal aid organizations may also provide free or low-cost assistance if you qualify.