If you’re a business owner, you may have noticed the ads in a spam folder or on the corner of your favorite page on a browser: apps and websites that offer to do background checks, some with lurid headlines like, “Find sex offenders in your neighborhood.” Technology has made getting information on a person’s past as simple as clicking a mouse. It’s also made it a lot easier for business owners screening job candidates to run afoul of employment law without even knowing it.

For employers—especially smaller firms without a human resources department—quick, cheap and easy background checks can be tempting. One can find out whether a prospective employee has a conviction for a crime, then check their social media pages to see if they might say anything that would embarrass your company, and no one will be able to claim you didn’t perform due diligence.

However, using online background checks can also mean big trouble for employers—and potentially big legal bills. The legal issues can result from two sets of laws: the Fair Credit Reporting Act (FCRA) and various antidiscrimination statutes.

The FCRA covers more than just credit reports, because it applies to any company that is a “reporting agency”—that means anyone who supplies information that could be used that way even if it is gleaned from public records. The law was also written to cover reports about a person’s “character, general reputation, personal characteristics, or mode of living” that could be used to make any decisions about either credit or employment.

“Anytime you do a background check to make an employment decision, it falls under those laws,” said Donna Ballman, a Florida-based attorney specializing in employment law and the author of “Stand Up for Yourself Without Getting Fired.”

Background checks were once limited to people working in specific professions—with children, for example, or law enforcement. But as the Internet grew and companies became more concerned about workplace violence and liability, background checks started to appear even in relatively menial jobs. It’s now almost a given that there’s a check box on an application that asks, “Have you ever been convicted of a crime?”

The Society for Human Resource Management says about 69 percent of employers use criminal background checks to screen applicants. Sixty-two percent do the checks when an offer is made; 32 percent do so after the interview; another 4 percent when an application is filled out.

Ballman said sometimes an employer will discover information they weren’t seeking but which can have serious repercussions—for example, going through a social media site, one might see a picture of an applicant in a wheelchair. A physically handicapped employee is in a protected class, which means there are grounds for an antidiscrimination suit if they can show their handicap might have influenced the hiring decision. The same applies to race and gender and can even involve less obvious characteristics, including age.

The Equal Employment Opportunity Commission issued guidelines in April 2012 to help employers decide whether a background check is relevant and legal. The agency has three criteria: the nature of the offense, the amount of time since it occurred and the nature of the job.

The FCRA states that candidates should be told that they are having a background check conducted and that they must approve it. In addition, employers must provide a way for the candidate to challenge the information that a background report produces.

A dozen states have “ban the box” legislation on the books—Illinois is the latest—which in some cases prohibits employers from looking at arrest and conviction records until a job offer is made. The reason: The EEOC states that making an inquiry into convictions a condition of a job offer has a disproportionate impact on minorities. (Note, however, that the legislation doesn’t apply to jobs where criminal background checks are required by law.)

There’s also the question of relevancy. A conviction for embezzlement is probably relevant when hiring a chief financial officer or accountant. A drunk driving conviction is a harder case to make if the employee won’t be driving, Ballman said.

Part of the problem is simple ignorance of the law, said W. Barry Nixon, executive director of the National Institute for Prevention of Workplace Violence. “Sometimes I get calls from smaller companies. They say, ‘I heard of this FCRA, and I’m not doing any credit checks’—they kind of dismiss something that really does apply to them,” he said.

“Most of these sites out there are just data providers,” Catherine Aldrich, vice president of operations at HireRight. “They are just looking to sell data. There is absolutely a huge difference between them and a background check that is FCRA compliant,” Aldrich said. GoodHire offers a mobile app that connects to its subscription service.

A cheat sheet for legal stalking

Nixon said it is important to look into an employee’s background in many cases. The trick is to make sure that it’s a supplement to other kinds of job candidate screening, isn’t overly broad in scope and that the information is accurate.

In order to be compliant with the FCRA and antidiscrimination laws, there are a few best practices that every employer can follow—whether you use a simple app or website or a screening company. Here are some of the dos and don’ts:
•Always tell the interviewee that you plan to run a background check, then be sure to get their written consent.
•Give the prospective employee a chance to challenge any negative information.
•Don’t go snooping through social media profiles. There’s too great a chance you see information that is prejudicial; if the person isn’t hired, that could be grounds for a lawsuit, even if the hiring party says they didn’t consider it.
•Don’t ask for social media passwords or to “friend” someone so you can see their social media feeds.
•Make sure the information is demonstrably relevant to the job at hand.

Even big companies can get into trouble if they don’t follow these relatively simple rules. Pepsi Beverages settled a lawsuit filed by the EEOC for $3.13 million because the company was using any arrests at all as a screen for employment. As a result, people who were arrested but not convicted were denied permanent jobs. Such cases aren’t always won—a similar suit against BMW was dismissed.

Stalking the stalkers

Another important point: While technology offers employers a fine way to screen candidates and narrow down the interviews, it’s important that the initial screening doesn’t have a disproportionate impact on people in certain classes. Doing cursory checks on white applicants while digging deep into minority applicants counts here.

Read More › The government track to a million-dollar business

The Federal Trade Commission has been increasing its focus on the issue. The agency took notice of three app developers in 2012 when it sent warning letters to InfoPay, Intelligator and eVerify, noting that a disclaimer doesn’t remove liability for how the app is used.

In April the FTC settled with two data brokers, Instant Checkmate and InfoTrack Information Services. Instant Checkmate offered a Web service that was geared to people who wanted to check on a potential dating partner, but it was also being marketed to landlords and employers, the FTC said. That would out it under the purview of the FCRA. Instant Checkmate didn’t have procedures in place to ensure that those using its reports had a reason to access them or to make sure the information was accurate.

Nixon noted that if you’re worried about “negligent hiring”—hiring an employee who is dangerous or might create liability—it’s best to use traditional tools and not depend too much on technology. Don’t think that running an online check is a one-step process. Nixon said there’s a difference between a cursory scrape of public data and an effective—and relevant—background check.

“Something is necessary, but companies that use it … as a checkmark … Those are the ones that end up in court,” Nixon said.

—By Jesse Emspak, special to CNBC.com