AI Hiring Tools May Trigger Federal Consumer Protection Law, California Lawsuit Shows
A California lawsuit filed in January against AI recruiting platform Eightfold has exposed a compliance risk most employers haven't considered: When software scores, ranks, or filters job candidates using certain data, federal consumer protection law may already apply.
The Fair Credit Reporting Act (FCRA) requires disclosure, accuracy, and specific procedures when consumer report information influences employment decisions. The question for employers is whether their AI hiring tools function as consumer reporting agencies under that law-and most don't have an answer.
The Scale Problem
More than 95% of U.S. employers conduct pre-employment background checks, with an increasing share using automated systems to process that information at scale. Resumes are parsed automatically, candidates are scored and ranked, and lower-rated applicants are screened out before any human reviews their application.
That operational speed is exactly where compliance risk grows. When decisions happen at scale with limited human review, isolated mistakes become systems. And system failures are what class action lawsuits target.
The Eightfold complaint alleges the platform scraped personal data on over a billion workers, assigned each applicant a scored ranking, and filtered candidates before any human review-all without the disclosures the FCRA requires. Eightfold denies the allegations. The case remains pending.
What Triggers FCRA Obligations
The legal framework hasn't changed. Hiring decisions have always carried legal consequences, regardless of whether a human or AI makes them.
Under the FCRA, the core rule is simple: If consumer report data influences an employment decision, FCRA obligations can attach. The label the software vendor uses doesn't matter. What matters is what the system does.
Many AI hiring platforms do more than organize applicants. They ingest employment history, education, online profiles, public records, and third-party data, then convert it into match scores, rankings, flags, or predicted fit assessments. That functional step-assembling and evaluating data to produce an output that affects eligibility-is what triggers FCRA territory.
The question for employers is straightforward: Does your tool assemble or evaluate consumer report-related information for employment purposes and produce an output that affects hiring decisions? If yes, FCRA obligations apply faster than most organizations realize.
Accuracy at Scale
The FCRA requires employers and vendors to follow reasonable procedures to ensure maximum possible accuracy of consumer reports. Automation doesn't relax that standard. At scale, it often undermines it.
Common errors compound: mixed files (someone else's record attributed to the applicant), stale information, incomplete context, or overly aggressive matching. AI amplifies these issues because it produces clean outputs-a score, a ranking, a recommendation-that feel authoritative and hide upstream errors.
Speed makes it worse. If a tool screens someone out instantly, the system can create the exact harm the FCRA is designed to prevent: an adverse decision based on information the individual never saw and couldn't correct.
What Employers Should Do Now
Before deploying any tool that scores, ranks, or filters candidates using third-party data, conduct a vendor review to assess whether that tool's outputs could qualify as consumer reports under the FCRA. If the answer is yes or maybe, standard FCRA obligations apply.
Those obligations include:
- Written disclosure to applicants explaining that a consumer report will be used
- Authorization from candidates before the report is obtained
- A clear adverse action process that gives candidates the chance to see and dispute information used against them
Vendor contracts should address accuracy obligations explicitly. Compliance teams should pressure-test what happens when the system gets something wrong and how quickly it can be corrected.
The Eightfold case is an early signal, not an isolated event. Employers best positioned to avoid the next lawsuit are the ones treating this as an operational question to solve now, not a legal problem to manage later.
For more on how AI affects your organization, see AI for Legal and AI for Human Resources.
Your membership also unlocks:
