Texas Data, Privacy & AI

Social Media Screening and the FCRA

When an employer hires a third party to compile social media or other online information about an applicant or employee, the Fair Credit Reporting Act (FCRA) can apply. It requires a standalone disclosure, written authorization, and a two-step adverse action process. This guide walks through the workflow.

What the law requires

An employer may look at public online information itself, but the practice carries risk: it can reveal protected characteristics, lead to inconsistent decisions, and produce inaccurate records. Demanding personal account credentials is especially intrusive and rarely necessary.

The FCRA applies when a third party that assembles or evaluates information for a fee, a consumer reporting agency, prepares a report used for an employment decision. An employer reviewing public content itself is not obtaining a consumer report, though it must still avoid acting on protected characteristics it sees. When the FCRA applies, the employer must:

  • Before obtaining the report, give the person a clear written disclosure in a document that consists solely of the disclosure, and obtain the person's written authorization (15 U.S.C. 1681b(b)(2)).
  • Before taking adverse action based in whole or part on the report, give the person a copy of the report and the federal summary of FCRA rights (15 U.S.C. 1681b(b)(3)). The FTC and EEOC advise giving the person a chance to review the report and explain any errors before deciding.
  • After deciding to take adverse action, send a notice that names the consumer reporting agency, states that the agency did not make the decision, and explains the person's right to a free copy of the report and to dispute its accuracy (15 U.S.C. 1681m(a)).

Related topics

Sources and legal update

Current through October 12, 2026.

This material is for general information and is not legal advice. Law and enforcement practice change. Consult counsel about specific facts.