On October 24, 2024, the federal Consumer Financial Protection Bureau (CFPB) published a circular cautioning employers about using workplace tracking technology, including AI, under the Fair Credit Reporting Act (FCRA). The CFPB has the primary regulatory and interpretive role regarding the FCRA and shares the enforcement role with the Federal Trade Commission (FTC). The gist of the CFPB’s circular is that employers may need to comply with the FCRA’s employment-related provisions before using such technology. In his prepared written remarks, CFPB Director Rohit Chopra stated: “We are making clear that employers that traffic in data about workers and make decisions – including hiring and firing – using third-party scores based on tracking must adhere to federal protections.”

Most employers are familiar with their obligations under the FCRA when ordering “consumer reports” (e.g., pre-employment background checks). FCRA litigation, including class actions, has been rampant for several years.¹ Now, employers also should be mindful of whether software and other vendors may be providing information, including “dossiers” and algorithmic scores, about employees that implicates the FCRA and corresponding state laws. The FCRA protects both job applicants and employees.

Basics of the FCRA for Employers

Congress enacted the FCRA in the 1970s in recognition of the rapid growth of credit bureaus and to protect individual consumers from the harmful impact of inaccurate credit reports.² The statute’s broad terms reflect its remedial purpose. Congress also put teeth into the statute by giving consumers a private right of action against the credit bureaus (i.e., the right to file a civil lawsuit for damages, including punitive damages, and attorney’s fees and costs).

Despite its origins, the FCRA is not limited to just “credit bureaus” and “credit reports.” The FCRA reaches beyond traditional credit transactions. On the other hand, the FCRA does not govern every scenario where one business gathers information about an individual and shares it with another business for a fee. The FCRA governs the collection, assembly, dissemination, and use of information about an individual in connection with specifically enumerated consumer eligibility transactions, including “employment purposes.”³ Whether the FCRA applies to an exchange of information therefore hinges on the application of statutory terms of art in context, including “consumer reporting agency”⁴ (or “CRA”) and “consumer report.”⁵

The FCRA’s primary requirements for employers may be divided into two categories: (1) requirements that employers must follow before obtaining a consumer report from a CRA, and (2) requirements employers must follow if they intend to take “adverse action” based on a consumer report.⁶ Before an employer may obtain a consumer report from a CRA, typically the employer must make a “clear and conspicuous” written disclosure to the consumer in a “document” that consists “solely” of the disclosure that a consumer report may be obtained.⁷ The applicant or employee must also provide written authorization for the employer to obtain any such report.⁸ Before an employer may take adverse action against an individual based on information contained in a report, typically the employer must provide the individual with a copy of the report and the CFPB’s Summary of FCRA rights (known as the “pre-adverse action notice”).⁹ The employer then must wait to take the adverse action until the individual has had an opportunity to review the report and Summary. If the employer still intends to take the adverse action, the employer must provide the final “adverse action notice.”¹⁰

The CFPB’s Circular

The CFPB’s circular reveals the Bureau’s continued focus on the pervasive use of AI and other tracking technology in the workplace. Summarizing, CFPB Director Chopra remarked: “At the CFPB, we are no stranger to the big business of companies making big money on peoples’ data and the algorithmic scores they create about us.” He added: “If an employer purchases a report that details whether a worker was a steward in a union, utilized family leave, enrolled their spouse and children in benefits programs, was cited for poor performance, or was deemed to be productive, this can raise serious issues about privacy and fairness. And if this information is converted into some sort of score using an opaque algorithm, that makes it even more suspicious.”

Director Chopra provided the following example:

In the healthcare context, consider a nurse required to wear a badge that tracks their movement throughout their shift. A hospital might hire a monitoring company using AI to track metrics like time spent on patient care, by noting each time a nurse enters and exits a patient room. But that could fail to capture the reality and complexity of nursing – missing the time when the nurse is discussing symptoms with a colleague or when answering questions from a patient’s family. If those incomplete data points are transformed into a “performance score” by the tech company, it could create an inaccurate assessment that would affect the nurse’s career. The nurse might miss out on a promotion at the hospital. And if the nurse applies for a new job at a competing hospital that uses the same monitoring and tracking vendor, the nurse might get a lower salary offer – or may not get the job at all – if that vendor is using flawed data.

Director Chopra summarized the obligations that employers may have under the FCRA when ordering and using consumer reports for employment purposes, stating that:

First, workers must consent when employers purchase these reports for use in employment contexts.

Second, if an employer relies on these dossiers to take an adverse action against a worker—such as firing, denial of a promotion, or reassignment—they must provide a detailed explanation to the individual.

Third, when a worker disputes inaccurate, incomplete, or unverifiable information, companies must delete or correct it.

Finally, employers cannot misuse worker reports for illegal purposes, such as selling it on the open market or using it to market financial products to workers.

Takeaways for Employers

Whether the FCRA applies to workforce tracking technology depends on the answers to fact-specific questions, including whether the vendor is a CRA; the nature and source of the information gathered for analysis; the output or report, including whether the output is anonymized; and the employer’s purpose for obtaining the data from the vendor. Education about FCRA basics is key for all employers, including in-house counsel, due to the proliferation of such tracking and scoring technology.

In assessing software and apps, employers must appreciate the CFPB’s broad view of when the FCRA applies. This is illustrated by two examples in the circular. It states that “the developer of a phone app that monitors a transportation worker’s driving activity and provides driving scores to companies for employment purposes” may be a CRA “if the developer obtains or uses data from sources other than an employer receiving the report, including from other employer-customers or public data sources, to generate the scores.” It also states that “a third-party software provider could meet the definition of a consumer reporting agency where it assembles or evaluates consumer information to develop software that produces reports used to evaluate a worker ‘for employment, promotion, reassignment or retention,’ or where the software itself assembles or evaluates information about a worker to produce reports used for those purposes.”