Outside counsel or a background check vendor forwards a compliance alert. The Consumer Financial Protection Bureau has ruled that federal law preempts state background check requirements. The state consent form, the state-specific notice, the state look-back limit your process was built around might not apply anymore. It is tempting to simplify the process and drop the state-specific step.

Do not drop it yet. The agency changed its opinion. The statute it is interpreting did not change, and no court has yet ruled on what this means for the specific state requirement your organization follows.

What the CFPB Actually Did

In June 2022, the CFPB issued an interpretive rule titled "The Fair Credit Reporting Act's Limited Preemption of State Laws." The agency's own announcement of that rule stated plainly: "Preemption under the Fair Credit Reporting Act is narrow and targeted." That reading gave states room to legislate, and over the following three years, many did. Employers responded the way employers usually respond to a patchwork: they built compliance state by state.

In May 2025, the CFPB withdrew that 2022 interpretive rule along with a batch of other guidance documents.

On October 28, 2025, the CFPB issued a replacement. The Federal Register filing for the new rule, titled "Fair Credit Reporting Act; Preemption of State Laws," states its purpose directly: the Bureau is issuing the rule "to clarify that the Fair Credit Reporting Act (FCRA) generally preempts State laws that touch on broad areas of credit reporting, consistent with Congress's intent to create national standards for the credit reporting system." The filing is explicit that it replaces the 2022 rule.

Read those two statements side by side. In 2022, the agency called preemption "narrow and targeted." In 2025, the same agency called it general and broad, covering the same statutory language. That is not a clarification. It is a reversal.

An Interpretive Rule Is Not a Regulation and Not a Verdict

This is the part that gets lost in vendor summaries, so it is worth stating without hedging.

An interpretive rule is the agency's description of how it reads a statute. It does not go through the same rulemaking process as a binding regulation, and it does not repeal, amend, or suspend a single state law. States that passed credit reporting or background check statutes under the 2022 reading still have those statutes on their books today.

Preemption is a legal question, and legal questions about whether federal law displaces state law are settled by courts, not by agency memoranda. The same federal agency has now published two opposing readings of the identical statutory provision within four years. That record does not support treating either reading as final. It supports the opposite conclusion: this question is genuinely unresolved, and it will stay unresolved until a court rules on a real dispute.

The defensible posture has not changed. Comply with whichever requirement, federal or state, is stricter, until a court holds otherwise.

Why This Still Matters for Your Hiring Process

Nothing about the legal obligation has moved, so here is the reason this still deserves attention.

Because vendors and some counsel are reading the same October 2025 rule and reaching a shortcut conclusion: a state requirement no longer applies, so employers can stop following it. Some of that advice will come from people who read only the press coverage, not the filing itself. Some will come from vendors with an interest in simplifying their own compliance workflow across states.

When you hear that claim, whether it applies to a state consent requirement, a state disclosure format, or a state waiting period, ask one question before you change anything: which court held that. Not which agency said it. Which court, in which case, ruled that this specific state requirement is preempted and unenforceable. If the honest answer is that no court has ruled, then what actually happened is that an agency changed its opinion, and the state law is still standing until a judge says otherwise.

What a Defensible Posture Looks Like Right Now

A few practical points, not legal conclusions, and each is worth confirming with counsel who knows your states of operation.

Keep the stricter practice in place. If a state requires a standalone disclosure, a specific waiting period, or a particular notice format, continue following it. Nothing about this rule removes that statute from the books.

Ask counsel a narrow question, not a broad one. "Has any court addressed FCRA preemption of this specific state requirement since October 2025" is a useful question. "Can we drop this requirement now" is the question that gets employers into trouble, because it invites an answer built on an agency opinion rather than a ruling.

Watch for litigation, not press releases. The CFPB pointed most directly at state laws restricting medical debt on credit reports, which makes that area the likely first test of this new reading in court. A ruling there, favorable or not, will tell you more about where this is going than the interpretive rule itself does.

Treat a vendor bulletin as a notice to ask a question, not as legal advice. A background check vendor telling you a state requirement went away is not the same as a court telling you that. Compliance vendors and counsel who track state hiring law continue to report active state and local enforcement activity independent of this preemption question, which is one more reason a federal agency's opinion is not the end of the analysis.

The Bottom Line

The CFPB has now told employers two different things about the same statute in four years. Neither statement is a law, and neither is a court decision. The employer who keeps following the stricter requirement while this works through the courts is the one who will not need to explain a gap in the file later.

Sources: