What Is New in 2026 for FCRA and Driver Screening?

In 2026, the Consumer Financial Protection Bureau (CFPB) finalized updated guidance clarifying that algorithmic driver-score products sold by third-party MVR aggregators are consumer reports subject to full FCRA obligations. This closes a loophole some carriers exploited by claiming scored products were not traditional reports. Additionally, several states—including Illinois and Colorado—enacted standalone consumer report transparency laws that require carriers operating in those states to provide state-specific addenda alongside the federal FCRA disclosure. Class-action filings against trucking companies for defective FCRA disclosures rose 34% from 2023 to 2025 according to PACER docket data, making 2026 compliance more urgent than ever.

What Exactly Is the FCRA and Why Does It Apply to MVR Pulls?

The Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.) governs any consumer report obtained from a consumer reporting agency (CRA). When you order an MVR through a third-party vendor—not directly from a state DMV yourself—that vendor qualifies as a CRA, making the report subject to full FCRA obligations including disclosure, authorization, and adverse action procedures.

Many small fleet owners assume the FCRA only covers credit checks. That assumption is expensive. If your screening vendor aggregates MVR data and sells it to employers, they are operating as a CRA. The moment you pay a vendor for a driver's driving history, you have triggered FCRA requirements. Pulling directly from your state DMV portal using the driver's physical license and your own FMCSA credentials may fall outside FCRA, but any intermediary changes the analysis. When in doubt, apply full FCRA protocol—the downside of over-compliance is zero; the downside of under-compliance is $1,000 per violation plus attorney fees.

What Is the Required Consent Process Before Pulling a Driving Record?

Before obtaining any consumer report, 15 U.S.C. § 1681b(b)(2) requires two things: (1) a clear and conspicuous written disclosure in a document that consists solely of the disclosure, and (2) a written authorization from the consumer. Both must happen before the report is requested—not after, not simultaneously with hiring paperwork.

Step 1 — Provide a Standalone Written Disclosure

The disclosure must be a separate document. You cannot bury it in your job application, employee handbook, or onboarding packet. Courts have struck down disclosures that included liability waivers, arbitration clauses, or any employer language beyond the FCRA notice itself. The document should state, in plain language, that the company may obtain a consumer report—which includes driving history—for employment purposes.

Step 2 — Obtain a Signed Written Authorization

The applicant or employee must sign an authorization before you pull the report. Electronic signatures are acceptable under the E-SIGN Act (15 U.S.C. § 7001) provided your workflow meets e-signature authentication standards. Keep signed authorizations on file for a minimum of five years or the duration of employment plus two years, whichever is longer, to align with both FCRA and 49 CFR 391.51 driver qualification file retention requirements.

Step 3 — Annual Re-Authorization for Existing Drivers

FMCSA's 49 CFR 391.25 requires you to pull an MVR for every driver at least once every 12 months. Each annual pull requires its own FCRA disclosure and authorization cycle. A blanket authorization signed at hire does not cover future pulls unless the authorization language specifically and clearly states it covers periodic future reports for ongoing employment—and even then, state laws may require fresh consent annually.

What Happens If You Skip or Botch the Consent Step?

Skipping or using a defective consent form creates both individual and class-action FCRA exposure. Statutory damages run $100 to $1,000 per violation for willful noncompliance under 15 U.S.C. § 1681n. Negligent violations allow actual damages plus attorney fees under 15 U.S.C. § 1681o. In a class action covering 200 drivers, liability can exceed $200,000 before punitive damages or legal fees.

Do State Laws Add Extra Consent Requirements for Trucking Companies?

Yes. Several states layer additional obligations on top of federal FCRA requirements. Small fleets that hire drivers across state lines must track which state's laws apply based on where the driver works, not just where the company is headquartered.

What Should a Compliant FCRA Disclosure Form Include?

A compliant FCRA disclosure for MVR pulls must include the consumer reporting agency's name, a clear statement that a consumer report may be obtained, the permissible purpose (employment), and nothing else. Courts have invalidated forms containing liability releases, at-will employment language, or excessive company branding that distracts from the disclosure's singular purpose.

1. Company name and address (as the employer/end-user)
2. Name and contact information of the CRA or MVR vendor
3. Statement that a consumer report—including motor vehicle records—will be obtained
4. Statement that the report will be used for employment purposes only
5. Applicant's full legal name, date of birth, and driver's license number
6. Applicant's signature and date
7. For annual pulls: explicit language that periodic future reports may be obtained

For a complete list of documents required in your driver files, see our driver qualification file checklist for 2026, which covers every document FMCSA requires alongside your FCRA consent records.

How Does the Adverse Action Process Work After a Bad MVR?

If you decide not to hire—or to terminate—a driver based on their MVR, 15 U.S.C. § 1681b(b)(3) requires a two-step adverse action process: first a pre-adverse action notice with a copy of the report and Summary of Rights, then a waiting period (typically five business days), and finally a formal adverse action notice if you proceed.

Skipping pre-adverse action notice is its own independent FCRA violation—separate from the disclosure violation. A driver who was not given a chance to dispute errors in their MVR before being denied employment has a clean individual or class-action claim. Document every step with timestamps. For more on building a complete driver screening workflow, read our guide on FMCSA PSP reports and small fleet driver screening.

How Can Small Trucking Companies Build a Bulletproof Consent Workflow?

Small fleets with limited HR staff are the most frequent FCRA defendants because their consent processes are informal, paper-based, or non-existent. A structured digital workflow eliminates the most common failure points: lost paper forms, unsigned documents, and mixed disclosure language. The workflow below takes under ten minutes per applicant when automated.

1. Generate a standalone FCRA disclosure document for every applicant before the MVR is ordered.
2. Deliver the disclosure through a tracked, timestamped e-signature platform.
3. Collect signed authorization before submitting the MVR order to your vendor.
4. Store signed disclosure and authorization in the driver qualification file under 49 CFR 391.51.
5. Set a calendar reminder 11 months after hire for annual re-authorization and MVR pull.
6. If MVR results trigger adverse action, initiate the two-step FCRA adverse action process immediately.
7. Retain all records for five years minimum.

Carriers who use HRForge's trucking HR automation platform can generate FCRA-compliant disclosure forms, collect e-signatures, and automatically schedule annual MVR re-authorization reminders—eliminating the manual gaps where violations occur most often.

Frequently Asked Questions

Does FCRA apply if I pull an MVR directly from the state DMV myself?

If you access the DMV portal directly using your own FMCSA credentials and the driver's physical license—without a third-party vendor aggregating or delivering the data—FCRA generally does not apply because no consumer reporting agency is involved. However, most small fleets use third-party MVR vendors for speed and convenience, which triggers full FCRA obligations. When in doubt, use full FCRA protocol to avoid exposure.

Can I include the FCRA disclosure in my job application to save time?

No. 15 U.S.C. § 1681b(b)(2)(A) explicitly requires the disclosure to be in a document that consists solely of the disclosure. Courts have consistently voided disclosures embedded in applications, even when clearly labeled. The standalone requirement is not a technicality—it is a statutory mandate. Using a combined form is one of the most common reasons trucking companies lose FCRA class-action lawsuits.

How long do I need to keep signed FCRA authorization forms?

The FCRA does not specify a retention period, but best practice is to keep signed authorizations for the duration of employment plus two years after separation to cover the FCRA statute of limitations. This also aligns with 49 CFR 391.51, which requires driver qualification file records to be retained for three years after a driver leaves employment. Store digital copies in your driver qualification file system.

Does the annual FMCSA MVR pull under 49 CFR 391.25 require new FCRA consent each time?

Yes, if you use a third-party CRA for the annual pull. A blanket authorization signed at hire may cover periodic pulls only if the authorization language explicitly states it covers ongoing employment-related reports. Even with broad language, California and several other states require fresh annual consent. The safest practice is to collect a new signed authorization each year before the annual MVR pull.

What is the pre-adverse action notice and how long must I wait before making a final decision?

Before taking adverse action based on a consumer report, you must send the applicant or driver a pre-adverse action notice that includes a copy of their MVR report and the CFPB's Summary of Your Rights Under the FCRA. You must then wait a reasonable time—courts and the FTC have interpreted this as at least five business days—before sending a final adverse action notice if you proceed with the decision.

What penalty could my trucking company face for a class-action FCRA lawsuit over MVR consent?

In a class action, statutory damages of $100 to $1,000 per class member apply under 15 U.S.C. § 1681n for willful violations. A fleet that pulled MVRs on 300 drivers without a proper standalone disclosure could face $300,000 in statutory damages alone, before punitive damages, attorney fees, and court costs. Settlements in trucking FCRA class actions regularly exceed $500,000 for mid-size fleets.

Automate Your FCRA Consent Workflow Before Your Next Driver Hire

HRForge was built specifically for small trucking companies that cannot afford a dedicated HR compliance team but cannot afford an FCRA lawsuit either. The platform generates standalone FCRA-compliant MVR disclosure forms, collects timestamped e-signatures, routes documents to your driver qualification file automatically, and triggers annual re-authorization reminders before your 49 CFR 391.25 deadline hits. Stop relying on paper forms and spreadsheet calendars that leave gaps. Visit HRForge's trucking HR compliance platform to see how small fleets protect themselves from FCRA liability without adding headcount.

This content is for informational purposes only and does not constitute legal or compliance advice.