Disclosure: HireGen is our own product. This guide is general information, not legal advice. Laws change often; confirm anything you rely on with employment counsel.
Short answer: There is no single US hiring law. In 2026, 31 jurisdictions (30 states and the District of Columbia) have at least one state-level rule on pay ranges, salary history, criminal-record questions, AI screening or E-Verify. A recruitment CRM must apply the right rules by job location, send and log required notices, keep a human in AI decisions, and retain records for up to four years.
Key takeaways
- Pay ranges in job postings are required in 14 states and DC. Virginia, Maine and Connecticut joined between July and October 2026.
- Salary history questions are banned for private employers in 19 states and DC.
- Criminal-record questions on applications are restricted for private employers in 15 states and DC.
- AI hiring rules are in force in California, Illinois, Texas, New Jersey and New York City. Colorado’s amended law starts on January 1, 2027.
- E-Verify is mandatory for some or all private employers in 10 states.
- Record retention runs from one year federally to four years in California.
California, Colorado, Illinois, Maryland and New Jersey each have four of the five law types tracked here. Twenty states have none at state level, though federal anti-discrimination law, the federal Form I-9 process and many city ordinances still apply there.
Hiring laws by state: the summary table
The table lists every state with at least one of the five law types. “Yes” means a statewide rule covering private employers was in force on October 9, 2026. Thresholds and exceptions are covered in the sections that follow.
| State | Pay range in job postings | Salary history ban | Fair chance (criminal record) | AI hiring rule | E-Verify mandate |
|---|---|---|---|---|---|
| Alabama | – | Yes | – | – | All employers |
| Arizona | – | – | – | – | All employers |
| California | Yes | Yes | Yes | Yes | – |
| Colorado | Yes | Yes | Yes | From Jan 1, 2027 | – |
| Connecticut | Yes | Yes | Yes | – | – |
| Delaware | From Sept 26, 2027 | Yes | – | – | – |
| District of Columbia | Yes | Yes | Yes | – | – |
| Florida | – | – | – | – | 25+ employees |
| Georgia | – | – | – | – | More than 10 |
| Hawaii | Yes | Yes | Yes | – | – |
| Illinois | Yes | Yes | Yes | Yes | – |
| Louisiana | – | – | – | – | Yes, check statute |
| Maine | Yes | Yes | Yes | – | – |
| Maryland | Yes | Yes | Yes | Facial recognition only | – |
| Massachusetts | Yes | Yes | Yes | – | – |
| Minnesota | Yes | Yes | Yes | – | – |
| Mississippi | – | – | – | – | All employers |
| Nevada | On request | Yes | – | – | – |
| New Jersey | Yes | Yes | Yes | Yes | – |
| New Mexico | – | – | Yes | – | – |
| New York | Yes | Yes | – | New York City only | – |
| North Carolina | – | – | – | – | 25+ employees |
| Oregon | – | Yes | Yes | – | – |
| Rhode Island | On request | Yes | Yes | – | – |
| South Carolina | – | – | – | – | All employers |
| Tennessee | – | – | – | – | Yes, by headcount |
| Texas | – | – | – | Yes (intent-based) | – |
| Utah | – | – | – | – | 150+ employees |
| Vermont | Yes | Yes | Yes | – | – |
| Virginia | Yes | Yes | – | – | – |
| Washington | Yes | Yes | Yes | – | – |
States with none of the five at state level: Alaska, Arkansas, Idaho, Indiana, Iowa, Kansas, Kentucky, Michigan, Missouri, Montana, Nebraska, New Hampshire, North Dakota, Ohio, Oklahoma, Pennsylvania, South Dakota, West Virginia, Wisconsin, Wyoming. Cities and counties in several of these have their own rules. Sources are linked in each section and under Resources.
AI hiring laws by state
If your CRM ranks, scores or screens candidates, these are the rules that apply to that feature. They are also the rules changing fastest.
| Jurisdiction | In force | What it requires | What the CRM must do |
|---|---|---|---|
| New York City (Local Law 144) | July 5, 2023 | A bias audit within the past year, a public summary of it, and notice to candidates at least 10 business days before the tool is used. Covers employers and employment agencies. | Send and time-stamp the notice; export selection data for the audit; offer an alternative process. |
| California (Civil Rights Council regulations) | October 1, 2025 | Automated-decision systems that disadvantage people by protected traits can violate state anti-discrimination law. Some automated assessments count as unlawful medical inquiries. Records, including automated-decision data, kept four years. | Keep scores, inputs and outcomes for four years; support bias testing. |
| New Jersey (disparate impact rules) | December 15, 2025 | Automated employment decision tools must be evaluated for disparate impact on protected groups, according to K&L Gates. | Report outcomes by group so impact can be tested. |
| Illinois (HB 3773) | January 1, 2026 | Bars AI use that has a discriminatory effect, bans ZIP code as a proxy for a protected class, and requires notice when AI is used. Detailed notice rules were still in draft when last reported; the draft calls for notice in job postings and four-year retention. | Add an AI notice to postings; exclude ZIP code from scoring; log notices. |
| Texas (Responsible AI Governance Act) | January 1, 2026 | Prohibits AI built or used with intent to discriminate. Duties on private employers are limited. | Document what each AI feature is for. |
| Colorado (AI Act as amended in 2026) | January 1, 2027 | Clear notice before use; notice within 30 days of an adverse decision; a route to correct data and request human review; records kept at least three years. Enforced by the attorney general, with penalties up to $20,000 per violation. | Pre-use notice, a 30-day adverse-decision workflow, a human review queue, three-year retention. |
Two narrower laws matter if you use video interviews. Illinois requires notice, an explanation and consent before AI analyzes a video interview, and Maryland requires a signed waiver before facial recognition is used in an interview.
Federal position: Executive Order 14365, signed on December 11, 2025, directs the Department of Justice to challenge state AI laws. It did not repeal any, and the law firms we reviewed advise employers to keep complying. Federal anti-discrimination law applies to AI tools in every state.
Pay transparency laws by state
These laws require a good-faith pay range in the job posting itself. Several also require a description of benefits.
| State | In force since | Employer size | Benefits in posting? |
|---|---|---|---|
| Colorado | January 1, 2021 | 1+ employee in state | Yes |
| California | January 1, 2023 | 15+ | Pay scale only |
| Washington | January 1, 2023 | 15+ | Yes |
| New York | September 17, 2023 | 4+ | No |
| Hawaii | January 1, 2024 | 50+ | No |
| District of Columbia | Mid-2024 | 1+ | Health benefits, before first interview |
| Maryland | October 1, 2024 | All | Yes |
| Illinois | January 1, 2025 | 15+ | Yes |
| Minnesota | January 1, 2025 | 30+ | Yes |
| New Jersey | June 1, 2025 | 10+ | Yes |
| Vermont | July 1, 2025 | 5+ | Not stated |
| Massachusetts | October 29, 2025 | 25+ | Not stated |
| Virginia | July 1, 2026 | All | Not stated |
| Maine | July 29, 2026 | 10+ | Not stated |
| Connecticut | October 1, 2026 | All | Yes |
| Delaware | September 26, 2027 (scheduled) | 26+ | Yes |
Sources: SixFifty, Sequoia and Hunton. Nevada and Rhode Island require disclosure during the process or on request. Several cities have their own rules.
What the CRM must do: make minimum pay, maximum pay and benefits required fields on the job record, refuse to publish a posting without them where the law applies, and carry the range through to every job board feed. Virginia allows 15 business days to correct a posting after written notice, so the CRM should also let you fix and republish quickly.
Salary history bans
According to HR Dive’s tracker, updated in April 2026, statewide bans covering private employers exist in Alabama, California, Colorado, Connecticut, Delaware, Hawaii, Illinois, Maine, Maryland, Massachusetts, Minnesota, Nevada, New Jersey, New York, Oregon, Rhode Island, Vermont, Virginia (from July 1, 2026) and Washington, plus the District of Columbia.
What the CRM must do: remove “current salary” and “previous salary” from application forms and screening scripts for those locations, and replace them with “salary expectation”. If a candidate volunteers the figure, some states limit how it may be used, so do not store it in a field that feeds matching or offer calculations.
Fair chance hiring (ban the box)
The National Employment Law Project lists 15 states that stop private employers asking about conviction history on job applications: California, Colorado, Connecticut, Hawaii, Illinois, Maine, Maryland, Massachusetts, Minnesota, New Jersey, New Mexico, Oregon, Rhode Island, Vermont and Washington. The District of Columbia and more than 20 cities and counties, including New York City, apply similar rules to private employers.
The strictest laws control timing as well. California’s Fair Chance Act covers employers with five or more employees and generally bars conviction questions until after a conditional job offer.
What the CRM must do: hide criminal-record questions on applications by location, block background checks until the offer stage where required, and run a documented pre-adverse and final-notice workflow with a waiting period before a candidate is rejected over a record.
Keep every hiring step on one record. HireGen puts jobs, candidates, AI matching and candidate messages in a single system, which is the starting point for any compliance setup.
Start free at HireGen.comE-Verify requirements by state
Every US employer must complete Form I-9. E-Verify, the federal online check, is voluntary federally but mandatory for private employers in these states:
- All private employers: Alabama, Arizona, Mississippi, South Carolina.
- Above a headcount: Florida (25 or more employees), Georgia (more than 10), North Carolina (25 or more), Utah (150 or more), plus Tennessee and Louisiana, where published summaries differ on the detail.
- By industry: Ohio, for nonresidential construction contractors, from March 19, 2026.
California and Illinois go the other way and restrict misuse, including using E-Verify to screen people before a job offer. Sources: Jimerson Birr and Paylocity.
What the CRM must do: flag placements in mandatory states, keep verification strictly after the offer, and store the case result with the placement record.
Texting, biometrics and candidate privacy
- Texting: the federal Telephone Consumer Protection Act carries damages of $500 to $1,500 per violation. Florida limits calls and texts to 8:00 am to 9:00 pm, and Texas added text messages to its telephone solicitation law in 2025, according to Byte Back Law. Whether a recruiting text counts as a solicitation is not always clear, so most agencies treat consent as required.
- Biometrics: Illinois requires written consent before collecting biometric identifiers such as face geometry or voiceprints, which can include video-interview analysis.
- Privacy: the California Consumer Privacy Act covers job applicants of businesses that meet its thresholds, including rights to know and delete.
What the CRM must do: record opt-in consent with a time stamp before the first text, honor opt-outs across every recruiter and number, send only in the candidate’s local daytime hours, and handle access and deletion requests.
Record retention: how long to keep hiring data
The EEOC requires employers to keep personnel and employment records for one year. States add longer periods, and AI laws are adding more.
Maine’s and Delaware’s pay laws also require pay history by role to be kept for three years after employment ends. Privacy law pulls the other way: keep data no longer than you need. The practical answer is a written schedule, applied automatically.
What the CRM must do: set retention by record type and state, keep AI scores and the inputs behind them, pause deletion when there is a legal hold, and delete on schedule after that.
What your recruitment CRM must do: 10 capabilities
| # | Capability | Laws it serves | Ask the vendor |
|---|---|---|---|
| 1 | Structured job location, including remote eligibility | All of them | Can rules switch on by state and city? |
| 2 | Required pay range and benefits fields | Pay transparency | Can publishing be blocked without them? |
| 3 | Application forms that vary by location | Salary history, fair chance | Can one question be hidden for one state? |
| 4 | AI notices with delivery logs | NYC, Illinois, Colorado | Is each notice time-stamped per candidate? |
| 5 | Human review and override of AI rankings | Colorado, California | Can a recruiter see why a score was given? |
| 6 | Outcome reports by demographic group | NYC audits, California, New Jersey | Is EEO data stored apart from the hiring record? |
| 7 | Adverse-decision workflows with deadlines | Colorado, fair chance laws | Are waiting periods and notices tracked? |
| 8 | Texting consent, opt-out and quiet hours | Federal and state texting laws | Does an opt-out apply to all users? |
| 9 | Retention schedules and legal holds | EEOC, California, Colorado | Can retention differ by state? |
| 10 | Audit log and full data export | All of them | Can I export everything, including AI data? |
Few products do all ten out of the box. Ask every vendor on your shortlist, HireGen included, to show each one in a demo and to tell you which plan it is on. For background on the software itself, see what a recruitment CRM is and how AI candidate matching and resume screening work.
Notes for staffing and recruitment agencies
- You are covered directly. New York City’s AI law names employment agencies, and Illinois’s draft rules name agents such as recruiters.
- The client’s location sets the rules. A Texas agency filling a role in Colorado posts under Colorado’s pay range law.
- Remote roles widen the map. A role open to candidates anywhere may fall under several states’ posting rules at once. Vermont’s law, for example, reaches remote roles tied to a Vermont office.
- Your vendor’s AI is your responsibility. Keep its bias testing results and documentation with your own records.
- Write it down. A one-page policy per law type, mapped to CRM settings, is what you will be asked for in a dispute.
Agencies comparing systems can start with recruitment CRM for staffing agencies or HireGen’s staffing software and recruitment CRM pages.
Frequently asked questions
Which US states regulate AI in hiring in 2026?
California, Illinois, Texas and New Jersey have statewide rules in force that reach AI or automated tools in hiring, and New York City requires annual bias audits. Colorado’s amended AI law takes effect on January 1, 2027. Illinois and Maryland also have narrower laws on AI video interviews and facial recognition.
Which states require salary ranges in job postings?
As of October 2026, 14 states and the District of Columbia require pay ranges in job postings: California, Colorado, Connecticut, Hawaii, Illinois, Maine, Maryland, Massachusetts, Minnesota, New Jersey, New York, Vermont, Virginia and Washington. Delaware follows on September 26, 2027. Nevada and Rhode Island require disclosure during the hiring process or on request.
Which states ban asking candidates about salary history?
Nineteen states have statewide salary history bans that cover private employers: Alabama, California, Colorado, Connecticut, Delaware, Hawaii, Illinois, Maine, Maryland, Massachusetts, Minnesota, Nevada, New Jersey, New York, Oregon, Rhode Island, Vermont, Virginia and Washington. The District of Columbia has one too. Details differ, and Alabama’s law works differently from most.
Do hiring laws apply where the candidate is or where my agency is based?
Most state hiring laws follow the job or the candidate, not the recruiter’s office. A rule usually applies when the work is performed in the state, when the candidate lives there, or when a remote role could be filled from there. An agency in one state recruiting for a client in another must follow the client location’s rules.
How long do I need to keep hiring records?
The federal baseline is one year for personnel and employment records. California requires four years, including automated-decision data. Colorado’s AI law requires three years from 2027, and Illinois has proposed four years for AI notices. Many multi-state employers set one schedule at the longest period that applies to them.
Is a staffing agency responsible if its software’s AI is biased?
Generally yes. New York City’s law covers employment agencies as well as employers, Illinois’s proposed rules cover agents such as recruiters, and California’s regulations do not let an employer shift liability to a vendor. Ask every vendor for bias testing results and keep them on file.
Did the federal executive order on AI cancel state AI hiring laws?
No. Executive Order 14365, signed on December 11, 2025, directed the Department of Justice to challenge state AI laws, but it did not repeal any of them. No state AI hiring law had been overturned at the time of the reports we reviewed, so employers should keep complying.
Which states require E-Verify for private employers?
Ten states require some or all private employers to use E-Verify: Alabama, Arizona, Mississippi and South Carolina for all employers, and Florida, Georgia, Louisiana, North Carolina, Tennessee and Utah above a headcount threshold. Ohio added a requirement for nonresidential construction in March 2026.
Can a recruitment CRM make my agency compliant?
No software can do that alone. A recruitment CRM can enforce your rules, such as blocking a posting without a pay range, hiding banned questions, sending notices and keeping records for the right period. Deciding what the rules are for your business still needs a written policy and legal review.
Put your hiring on a system you can audit. HireGen has a free plan and a 30-day trial on paid plans, with no credit card and no setup fees.
Start free at HireGen.comResources
Official sources
- New York City: automated employment decision tools
- California Civil Rights Department: automated-decision regulations
- California Civil Rights Department: Fair Chance Act
- EEOC: recordkeeping requirements
- California Attorney General: California Consumer Privacy Act
- E-Verify
Legal analysis and trackers used for this guide
- Littler: Colorado amends its artificial intelligence law
- K&L Gates: the AI employment landscape in 2026
- Hinshaw: Illinois AI-in-employment regulations
- SixFifty: pay transparency laws by state
- Sequoia: Virginia, Maine, Connecticut and Delaware pay transparency update
- Hunton: state pay transparency laws in 2026
- HR Dive: salary history ban tracker
- National Employment Law Project: ban the box and fair chance hiring
- Jimerson Birr: E-Verify state rules to watch in 2026
- Paylocity: E-Verify mandatory states
- Byte Back Law: state-level TCPA updates
Related guides and tools
- What is a recruitment CRM?
- AI recruitment CRM software guide
- Applicant tracking
- HireGen recruitment CRM
- HireGen pricing
- HireGen Academy: AI recruitment course
This guide summarizes public sources as of October 9, 2026 and is not legal advice. It covers statewide rules for private employers and one city law; many other local ordinances exist. Check current statutes and consult counsel before acting.
