License recruiting agency data to AI: the rules
The short answer
Most recruiting agency records describe candidates, not your company, so start there. No buyer page I read names recruiting. Three public rules apply: the Fair Credit Reporting Act, a federal one-year hiring record requirement, and California's privacy law on job applicants.
A recruiting agency holds two kinds of records. Its own operations are one, and the candidates and client employers it works for are the other.
Which companies list recruiting?
None by name, on the pages I read. Mercor's data page lists eight sectors and micro1's page lists six areas, and neither names recruiting. All of it is self-reported. The industry page compares the lists.
Does the Fair Credit Reporting Act reach a recruiting agency?
It can. The FCRA, 15 U.S.C. 1681a(f), defines a consumer reporting agency as a person that, for fees, regularly assembles or evaluates consumer credit information or other information on consumers to furnish consumer reports to third parties. Background-screening firms are the usual example.
Whether an agency's candidate files fall under the definition depends on what it does with them. That's a question for counsel.
How long must hiring records be kept under EEOC rules?
The EEOC rule at 29 CFR 1602.14 says an employer must preserve personnel and employment records, including application forms, for one year from the date the record was made or the personnel action, whichever is later. The period runs until a discrimination charge is finally resolved if one is filed.
The text speaks of records made or kept by an employer. Whether it reaches a recruiting agency's own files, and what a retention duty means for licensing or a deletion request, is for counsel too.
What do California rules add for a recruiting agency's applicant data?
California's privacy law covers job applicants and employees. In its order of 30 Sep 2025, the California Privacy Protection Agency fined Tractor Supply $1.35 million. Law-firm summaries call it the agency's first action over workforce disclosures, and say it faulted the applicant notice for omitting privacy rights.
My reading is that applicant records are personal information in California. See the CCPA page, employee consent and HR records.
Talk to a privacy or commercial lawyer in your state before you sign. Our rights check lists the first questions.
micro1 may pay us a referral fee if a company we introduce goes ahead with it. How we are paid
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
