Compliance · 16 min read

Ban the box and fair chance hiring

Ban the box is a name for the first generation of these laws. The third generation does not care when you ask, it cares what you did with the answer. This is the structure, and the notice that keeps getting confused with the one next to it.

Two layers, and only one of them is uniform

The FCRA is a procedural statute and it applies everywhere in the country to the same standard. It says: get a disclosure and an authorization, and before you act on the report, send the applicant a copy and their rights. Its duties are about sequence and paperwork.

Fair chance law is the opposite in every respect. It is state and local, so it exists in some places and not others. It is substantive, so it does not just govern the order of the steps, it governs what you are allowed to conclude from the record. And it moves, because a city council can amend it in an afternoon.

The two layers answer different questions. The FCRA asks whether the applicant got a fair chance to see and correct the report. Fair chance law asks whether the record is a lawful reason to deny them the job at all. An employer can satisfy the first completely and still fail the second, which is the failure mode that produces most of the claims in this area.

Three generations of the same idea

The name on these laws is ban the box, and the name describes only what the first of them did. Getting the generations straight explains almost every surprise an employer meets.

The first generation: remove the question

The original laws did one thing. They required employers to take the criminal history question off the initial application, so that an applicant was not screened out before a human being had looked at anything else. Some applied to public employers only, some to private employers above a size threshold.

An employer who complies with this and nothing else has complied with the first generation and is exposed under the third. That is the whole trap. The box is the visible part of the law and the least of it.

The second generation: delay the question

The next wave moved the point at which the question could be asked. Rather than removing it, these laws push it later, most commonly to after a conditional offer of employment has been made. A smaller group pushes it to the finalist stage, which is earlier in the process than a conditional offer.

The practical consequence is that the background check itself moves. If you may not ask about criminal history until after a conditional offer, ordering the check before the offer is the same violation by a different route, and consent to run the check should be deferred to the same point.

The third generation: prescribe what you do with the answer

The current wave is not about timing at all. These laws accept that an employer will learn about the record and then regulate what happens next. Typically they require the employer to carry out an individualized assessment against factors the law specifies, to put that assessment in writing, to send the applicant the assessment along with the record it rests on, to hold the position open for a defined period while the applicant responds, and then to take the response into account before deciding.

At that point the law is no longer regulating a form. It is regulating a decision, and it is doing so in a way an employer can fail even with immaculate paperwork.

The two notices that get confused

This is the single most expensive misunderstanding in the subject, and it survives because the two documents are usually sent at the same moment, to the same person, about the same decision.

The pre-adverse action notice comes from the FCRA, at §1681b(b)(3). It is triggered by an intention to take adverse action based in whole or in part on a consumer report. It must contain a copy of the report and a written description of the consumer's rights. Its purpose is to let the applicant see the report and correct it.

A fair chance notice comes from state or local law. It is triggered by an intention to withdraw a conditional offer or take adverse action based on a criminal record. It must contain the specific record being relied on and, in the third-generation jurisdictions, the written individualized assessment. Its purpose is to let the applicant respond to the reasoning, not just to the data.

Those are different triggers, different contents and different purposes. The FCRA provision says nothing about an assessment, and a fair chance ordinance says nothing about the Summary of Consumer Rights. Each is aimed at a different failure: the federal notice at an inaccurate report, the local one at a reflexive decision.

The error is treating one as a substitute for the other, and it is stated openly in the better vendor guidance in this field as a warning, which tells you how often it happens. The mistake usually looks like an employer in a third-generation city who sends a textbook FCRA pre-adverse notice containing the report and the rights summary and considers the job done. The federal duty is discharged. The local one has not been touched, because nothing in the packet explains why this record disqualifies this person from this job.

The relief is that the two can be combined, because FTC staff confirmed in 1997 that the two federal notices may be merged into one document where both sets of content are present. The same logic extends to the local layer: a single communication can carry the report, the rights summary, the record relied on, the assessment and the response window. What it cannot do is carry only one statute's contents and be treated as satisfying the other.

The clock is the longer of two clocks

The federal waiting period is a convention rather than a deadline, which is set out at length in the adverse action article. A state or local response window is the opposite: it is written down, it has a number in it, and failing to honor it is a violation on its own.

So the two clocks run together and the longer one governs. Where a jurisdiction gives the applicant five business days to respond, five business days is the floor regardless of what you would otherwise have done. Several jurisdictions add time on top when the applicant disputes the accuracy of the record rather than simply responding to it, which produces a second, longer window that only opens if the applicant does something.

Two operating rules follow, and they are not complicated.

• Run the clock from receipt, not from sending. Several jurisdictions say so expressly, and it is the safer reading everywhere else, because what a court will ask is when the applicant had the notice.
• Take the longest window that applies. If two jurisdictions both reach the decision, apply whichever gives the applicant more time. The marginal cost is a few days. The alternative is arguing afterwards about which law governed, which is a worse position than simply having waited.

One staleness warning, because it illustrates why this page carries structure rather than a list. The most-cited response window in the country is frequently quoted at a figure that was correct before a well-known amendment raised it. Writers copy writers, the old number stays in circulation, and an employer following a careful-looking secondary source can be a day short. Read the current instrument, or read a source that dates its claims.

The assessment, and the tension built into it

The individualized assessment is the substantive heart of the third generation, and its ancestry is worth knowing because it explains the factors.

The framework comes from the EEOC's 2012 enforcement guidance, which builds on a 1975 Eighth Circuit decision, Green v. Missouri Pacific Railroad. The court there held that excluding anyone with a conviction from employment could not be justified without reference to three things: the nature and gravity of the offense, the time that had passed since the offense or the completion of the sentence, and the nature of the job being sought. The EEOC adopted that as nature, time and nature, and added the requirement that the employer give the applicant an opportunity to explain the circumstances.

State law has largely copied it. California's version phrases the test as whether the conviction has a direct and adverse relationship with the specific duties of the job, and lists four factors rather than three by splitting the time element into time since the offense and time since the sentence was completed. New York's Correction Law Article 23-A uses an eight-factor test and permits denial only where there is a direct relationship between the record and the job, or an unreasonable risk to property or to the safety of people.

Different lists, same shape. An employer with a defensible process in one of these jurisdictions generally has one that can be adapted to the others, because the questions being asked are the same questions.

The tension nobody writes about

Here is the part that makes this genuinely difficult, and it is where employers who have done everything right still get into trouble.

A matrix is the obvious way to make these decisions consistent. Define which offenses disqualify which roles, apply it uniformly, and you have solved consistency, speed and auditability at once. It is also exactly what supports the argument that the individualized assessment was a formality, because a decision that the matrix already made is not an assessment. The more complete the matrix, the stronger that argument becomes.

The way through is to separate the two functions rather than choose between them. A matrix is good at triage: it identifies which records are clearly irrelevant to the role and which clearly are not. It should not decide the outcome. The written assessment is where the decision is made, it should be able to reach either result, and it should record what the applicant said and what difference it made. Where a jurisdiction requires the assessment in writing, that record is the defense.

Deciding which jurisdiction's law applies

This is the problem that gets worse as hiring gets more distributed, and there is no single answer written down anywhere. What follows is the structure of the question rather than a rule, because the honest position is that jurisdictions differ on what connects them to a hire.

Some laws attach to where the applicant lives. Some attach to where the job is performed. Some attach to where the employer is located or does business. Some do two of those and some do all three. The same hire can therefore be covered by nobody, by one jurisdiction, or by two with different windows and different notices.

• A remote worker. Residence and work location diverge by definition. Both may reach the decision, and where the employer is established may add a third.
• A candidate who relocates mid-process. The jurisdiction that applied when the process started may not be the one that applies when the decision is made, and there is no clean rule for the changeover.
• A multi-site employer with one hiring system. The system produces one notice and the obligations vary by requisition, which is how a compliant process becomes non-compliant in one location without anyone changing anything.

The practical resolution is the conservative one. Where more than one jurisdiction plausibly applies, apply the longest response window, include every notice that any of them requires, and let the assessment carry the reasoning that the strictest of them asks for. That produces one process that satisfies all of them, at the cost of a slightly longer timeline in the cases where only the loosest one applied. Given that the penalties for getting it wrong include statutory damages and fee-shifting, the trade is not close.

The current position for each state is in the compliance section, which is maintained for the purpose and should be the source you check rather than this page.

The layer that applies even where there is no fair chance law

The obvious reading of this subject is that it applies to employers in certain cities and states, and that an employer elsewhere has nothing to worry about. That reading is wrong, and the reason is Title VII.

Title VII is a federal statute and it applies everywhere. It does not mention criminal records, so the route in is disparate impact: a screening practice that is neutral on its face but excludes a protected group at a materially higher rate is unlawful unless the employer can show it is job related and consistent with business necessity. Because conviction rates differ sharply by race, a blanket exclusion of anyone with a record is the textbook case, and the EEOC's 2012 guidance says as much.

That guidance is the federal counterpart to the local laws, and it supplies the same two-part defense. The exclusion must be measured against the nature of the offense, the time elapsed and the nature of the job, which is where the factors in the previous section come from. And the employer must give the applicant an opportunity to explain the circumstances before deciding. An employer who does those two things has the beginning of a business necessity defense. An employer who applies a blanket rule has none.

Two consequences follow for an employer with no fair chance ordinance to comply with.

• The obligation is not switched off, it is just harder for a plaintiff to reach. Private suits under Title VII require a charge, a filing and an investigation. But the commission can act on its own initiative, and a pattern of blanket exclusions is the kind of thing that attracts attention without a single complaint.
• A state law requiring a check is not a defense. The guidance is explicit that an employer's compliance with a state law that mandates or permits criminal record screening does not relieve it of its Title VII obligations. The state requirement sets a floor. It does not raise the ceiling.

So the assessment discipline is not a local compliance cost that an employer outside the covered jurisdictions can skip. It is the same reasoning that federal law has required since a 1975 Eighth Circuit case, and it is available as a defense in every state in the country. Employers who adopt it because a city told them to have usually acquired something worth more than the ordinance they were complying with.

What the fair chance layer does not change

Everything federal still applies. The standalone disclosure and the authorization under §1681b(b)(2) are unchanged by any local ordinance. The pre-adverse notice and the report copy under §1681b(b)(3) are unchanged. The final notice naming the screening company and its contact details under §1681m(a) is unchanged, and it is still owed after the decision even where a local law has already required a written assessment beforehand.

The limits on what may be reported are also unchanged, and one of them is worth repeating in this context. An arrest that never became a conviction falls away under the FCRA after seven years, and several states bar arrest-only reporting outright regardless of age. Neither the FCRA nor fair chance law gives an employer a lawful basis for acting on an arrest record standing alone. The mechanics of where those records come from are in the court records article.

Why this page will need re-reading before it needs rewriting

This is the fastest-moving subject on this site and the register records that it carries a review cadence. Municipal ordinances in particular change on the cycle of a city council, which is to say unpredictably, and a jurisdiction that had no fair chance requirement two years ago may have one now.

The structure, though, has been stable for a decade and is likely to stay that way: a delay point, a written assessment, a response window, and a notice that is not the FCRA notice. What changes is which jurisdictions have which of those, and at what numbers. That is why the examples above are labeled as examples, and why the per-jurisdiction position lives in a section built to carry it.

What we do

We build the report side and we build it so the rest is possible. That means a record comes back with its source and its verification date attached, which is what an assessment has to cite. It means the report does not editorialize about what a record means, because a screening company deciding what a conviction signifies is precisely the reflex the third generation exists to prevent.

The policy, the adjudication matrix and the individualized assessment worksheet sit in the screening program toolkit, with the reasoning behind each. The matrix there is deliberately built as triage rather than as a decision, for the reason given above.

Sources

• EEOC Enforcement Guidance No. 915.002, Consideration of Arrest and Conviction Records (2012)
• Green v. Missouri Pacific Railroad Co., 523 F.2d 1290 (8th Cir. 1975)
• New York Correction Law, Article 23-A
• NYC Commission on Human Rights, Fair Chance Act rules and Fair Chance Notice
• California Fair Chance Act, Gov. Code §12952 (AB 1008)
• California Civil Rights Department, criminal history regulations
• Los Angeles County Fair Chance Ordinance for Employers
• National Employment Law Project, ban the box and fair chance policy briefs
• 15 U.S.C. §1681b(b)(2) and (b)(3) (disclosure, authorization, and adverse action)
• 15 U.S.C. §1681m(a) (adverse action notice requirements)
• CFPB, Summary of Consumer Rights, Appendix K to Part 1022

Last reviewed 2026-09-27. Nothing here is legal advice; see the terms of use.