The Federal Rule That Can Get You a Copy of Your Hiring Score

What Makes a Vendor's Score a Consumer Report?

A consumer report, under the Fair Credit Reporting Act, is information a consumer reporting agency assembles about a person and furnishes to a third party for use in deciding eligibility for something, including a job. That definition does not mention background checks specifically, and it does not carve out an exemption for a score just because a model produced it instead of a human analyst sitting at a desk.

The CFPB made that connection explicit in a circular issued October 24, 2024, addressed to employers using background dossiers and algorithmic scores: it stated that many background dossiers compiled from databases of public records and employment history are consumer reports under the FCRA, and that other consumer reports may include ones conveying scores that assess a worker's risk level or performance ². The circular itself was withdrawn on May 12, 2025 ³, which matters for what you can point to but not for what the underlying statute says. The FCRA's own text did not change; only the agency's interpretive push on it did.

What actually decides this in a given case is who built the tool. A dossier or score assembled by a third-party vendor and handed to the employer is the kind of thing this rule reaches, whether the vendor calls it a background check, a risk rating, or a fit score. A resume-matching algorithm the employer wrote and runs entirely in-house, with no outside vendor furnishing anything, sits outside the FCRA's definition, whatever the tool does internally and however confident its output looks on the screen.

Ask for the Copy Before You're Rejected On It

Where the report qualifies, the statute is specific about timing: before taking any adverse action based in whole or in part on the report, the employer must give you a copy of the report itself and a written description of your rights under the FCRA ¹. This isn't a courtesy an employer can choose to skip. Adverse action here means a decision that goes against you on the basis of that report, and a rejection is the ordinary case.

The sequence is what makes it useful. The copy reaches you while the decision is still open, so an error in the report can be raised before the rejection is final rather than after the role has gone to someone else. The statute sets no fixed waiting period, so how much time you get in practice varies.

If you were turned down after a vendor-run assessment or background screen and never received anything like this, that gap is worth a direct question to the recruiter or HR contact: ask whether a third-party vendor was used, and if so, request the pre-adverse-action copy and the rights description by name. Ask for the copy first. The report itself usually names the company that furnished it, and that furnisher, not the employer, is the address for disputing a specific inaccuracy once you can see what the inaccuracy is.

A rejected candidate has a related but separate question worth reading alongside this one: what an employer is actually told it owes someone the AI screened out, which covers notice and correction rights that apply even when no vendor consumer report is in the picture at all.

Know Where This Rule Doesn't Reach

The most common case sits outside this rule entirely: an employer's own resume screen, applicant tracking system, or internally built assessment, with no outside consumer reporting agency furnishing anything to anyone. No agency furnished a report, so there is no report the rule can require anyone to hand over, no matter how the tool works internally.

This is the gap that makes the question worth asking rather than assuming either way, since the honest answer depends on who actually produced the material, not on how sophisticated it looks or whether it mentions AI.

Outside a consumer report specifically, a narrower and purely local right exists in New York City. Local Law 144 of 2021, in force there since January 1, 2023, requires an employer that has not already published the material on its website to answer a candidate's or employee's written request, within 30 days, with the type of data collected for an automated employment decision tool, the source of that data, and the employer's data retention policy ⁴. Three items, then: not the model, not your own result, not the weightings. And a violation of that notice duty carries a penalty payable to the city rather than to you, and creates no private claim of its own ⁵. The federal route, where it applies, reaches further: it covers applicants everywhere in the US, hands over the document itself, and has a dispute process behind it.

Nothing here is legal advice, since your situation and your state's own law can add rights on top of the federal floor. Ask the question rather than assuming the answer: was a third party involved, and if so, where's the copy, because that decides which of these two very different regimes you have.

Separate This From a Resume Checker's Score

A vendor score you ran yourself, like an online resume checker that grades your file against a job posting, is a different animal from what this article is about. Nothing furnishes that score to an employer, and you're the only one who ever sees it.

No FCRA request applies here, because no report ever reached anyone making a decision about you. What that kind of self-run score actually measures, and why the number itself is close to meaningless, is its own separate question worth reading.

The FCRA route is about the opposite direction: a report that moved from a vendor to the employer, about you, without your say in when or whether that happened, and without you seeing it first. That's the arrangement worth checking for after a rejection, not a score you generated on your own out of curiosity before you ever applied to anything.

See a sample report >