The third quarter of 2025 revealed a hard truth: compliance is no longer reactive, it must be proactive, documented, and defensible. Legal obligations now extend beyond the “what” and into the “how” and “why” behind employment decisions.
getty
Employers entered the third quarter of 2025 facing a familiar challenge: keeping up with accelerating legal change. This quarter delivered not only new legal requirements, but also deeper operational risks. From tightened fair chance protections in Philadelphia and Washington to expanded salary disclosure mandates in Massachusetts and Cleveland, employers were forced to reexamine how they evaluate candidates, structure compensation, and manage workplace risk.
At the same time, state lawmakers doubled down on regulating AI in employment, clarified cannabis testing restrictions, and added new layers to I-9 and E-Verify procedures. What was once a series of policy updates has become a coordinated shift in how compliance must be integrated into hiring workflows.
Below is your Q3 2025 Compliance Playbook. Each development may require operational changes in the way employers hire, vet, and retain talent.
Criminal History Reform: Timing, Transparency, and Protected StatusPhiladelphia’s Ban the Box Amendment
Beginning January 6, 2026, Philadelphia employers must implement new lookback periods and procedural protections when using criminal history in hiring. Misdemeanor convictions are limited to a four-year lookback window, and summary offenses are excluded altogether. Expunged and sealed records must not be considered even if reported.
The amended ordinance also requires employers to issue a written notice before taking any adverse action based on a criminal record. That notice must include a summary of rights under the Philadelphia Fair Criminal Record Screening Standards Ordinance, a statement that the employer will consider evidence of error, rehabilitation, or mitigation, and instructions for submitting that information. Employers must then provide the applicant ten business days to respond before finalizing the decision.
Perhaps most notably, the ordinance establishes a rebuttable presumption of retaliation if adverse action follows within 90 days of a candidate asserting their rights under the law. Employers should revise workflows now to avoid risk in 2026.
Washington State’s Overhaul of the Fair Chance Act
Washington’s amended law, effective July 1, 2026 for larger employers (and January 1, 2027 for smaller ones), transforms both the timing and substance of criminal history evaluations. Employers must now wait until after a conditional offer to conduct background checks, and arrests or juvenile convictions can no longer be used. When a conviction is considered, a written individualized assessment must accompany any disqualification, and candidates must receive a two-business-day window to respond.
Protections also extend to current employees. Any disciplinary action based on criminal history must be justified and well-documented. These changes require retraining, updated documentation, and revised background screening sequences.
California’s Enforcement Surge
California’s Fair Chance Act remains unchanged on paper, but enforcement tells a different story. The Civil Rights Department (CRD) has adopted an applicant-favorable approach, scrutinizing not just the process but also the outcome of hiring decisions. Employers must ensure individualized assessments are well-reasoned, well-documented, and compliant with state law.
California Labor Code § 432.7 also bars discipline for arrests not leading to conviction. That includes pending charges. While employers may investigate underlying conduct, any adverse action must be based on policy violations and not the arrest itself.
Minneapolis Adds ‘Justice-Impacted Status’ as a Protected Class
As of August 1, 2025, Minneapolis expanded its civil rights ordinance to prohibit discrimination based on a broad category of “justice-impacted status.” This includes arrests, charges, convictions, probation, and incarceration regardless of outcome or timing.
Employers must now apply a six-factor individualized assessment when evaluating any criminal history. Blanket exclusions are no longer legally defensible.
Pay Transparency and Salary History BansMassachusetts
Starting October 29, 2025, Massachusetts employers with 25 or more employees must disclose salary ranges in all job postings, promotions, and internal transfers. Those with 100+ employees also face demographic pay data reporting obligations. Noncompliance carries penalties up to $25,000 per violation, though a two-year grace period exists for correcting posting defects.
Cleveland
Effective October 27, 2025, Cleveland’s new ordinance prohibits salary history inquiries and mandates salary ranges in all job postings. The ordinance covers part-time and temporary roles and applies to employers with 15 or more workers. Employers must maintain documentation supporting posted ranges. Violations carry penalties of up to $5,000, and only one 90-day cure window is allowed.
Vermont
As of July 1, 2025, Vermont requires employers with at least five employees (including one in Vermont) to disclose good-faith pay ranges in all job postings. Commission-based and tipped roles require additional disclosures. Employers hiring remote workers in Vermont must also comply.
Washington State
Washington’s SB 5408, effective July 27, 2025, refines its Equal Pay and Opportunities Act. Employers now have five business days to fix noncompliant postings after receiving written notice, may disclose a fixed wage instead of a range in certain cases, and are shielded from liability for outdated third-party listings, so long as they act promptly once alerted.
In September, the Washington Supreme Court added new urgency. In Branson v. Washington Fine Wine & Spirits LLC, the Court ruled that any person who applies to a job posting is an “applicant” under state law, regardless of qualifications or genuine interest. This broad interpretation increases the risk of opportunistic lawsuits and places more pressure on employers to maintain airtight postings and actively monitor vendor activity.
Delaware
Starting in 2027, Delaware’s new pay transparency law will require employers with 26 or more employees to include salary ranges and a general description of benefits in job postings for positions located in Delaware, as well as non-international remote roles offered by Delaware-based employers. Now is the time for employers to begin aligning pay bands and documentation practices in preparation.
Cannabis Legalization: A Patchwork of Protections and ProceduresTexas Expands Medical Marijuana Access
Effective September 1, 2025, Texas expanded its Compassionate-Use Program, adding new qualifying conditions and authorizing additional products and dispensaries. However, Texas law continues to offer no workplace protections for medical cannabis users. Employers may maintain zero-tolerance policies, though ADA or state disability laws may be triggered by the underlying conditions.
Minnesota Imposes Procedural Testing Rules
Senate File 2370 adds new protections for registered medical cannabis patients. Employers who rely on state or federal laws to justify adverse action based on a THC-positive drug test must now provide 14 days’ written notice before refusing to hire, terminating, or disciplining a patient. The notice must cite the specific law or benefit at risk; general references to safety concerns are no longer enough.
While most Minnesota employers cannot test for cannabis due to prior restrictions and recreational use protections, those who fall under legal exceptions, such as federal contractors or safety-sensitive employers, must follow the new notice procedures when acting against medical cannabis users.
Iowa Modernizes Drug Testing Protocols
Recent changes allow employers to deliver drug test notices electronically or in person, provided employees consent. Iowa also clarified how employers may designate safety-sensitive roles. Employers should review job descriptions and internal documentation to support these classifications.
AI, Privacy, and Tech: New Obligations, More OversightCalifornia’s CCPA Enforcement Hits Employment Data
In a landmark case, California’s Privacy Protection Agency fined a nationwide retailer $1.35 million for violating the CCPA. The violations stemmed from the collection of job applicant data without adequate notice, consent, or opt-out functionality. The case marks the first major CCPA enforcement action targeting employment-related data.
Maryland’s MODPA
The Maryland Online Data Privacy Act takes effect October 1, 2025. While it excludes HR data, MODPA imposes strict requirements around data minimization, consumer rights, and use of algorithms. Employers collecting consumer or marketing data should evaluate compliance now.
Texas’ AI Governance Law (TRAIGA)
Effective January 1, 2026, Texas’ TRAIGA prohibits intentional discrimination via AI systems but stops short of requiring audits or assessments. It preempts local legislation and grants the Attorney General sole enforcement authority. No private right of action exists, and employers receive a 60-day cure window before enforcement begins.
California’s Dual Track: CRD Rules and SB 7
As of October 1, 2025, the California Civil Rights Department finalized regulations confirming that employers are liable for discriminatory outcomes caused by AI, even when third-party vendors are involved. Employers must retain all records of Automated Decision Systems (ADS) for four years.
SB 7 would have required employers to notify workers when artificial intelligence is used in employment decisions and ensure that adverse actions, such as termination or demotion, made by fully automated systems include meaningful human oversight. The bill emphasized transparency, access to information, and due process. But in his veto message, Governor Newsom criticized the bill for being overly broad, stating that “rather than addressing the specific ways employers misuse this technology, the bill imposes unfocused notification requirements on any business using even the most innocuous tools.”
With SB 7 vetoed, California employers must now look to the CRD’s ADS regulations as the primary source of guidance on AI-related employment practices, especially as enforcement begins and scrutiny around automated decision-making intensifies.
Colorado’s AI Act Delayed, but Not Diminished
Originally scheduled to take effect in February 2026, the Colorado AI Act’s implementation date was delayed to June 30, 2026. The law regulates “high-risk” AI systems in employment and imposes mandatory risk assessments, algorithmic disclosures, and anti-discrimination obligations. Employers must begin preparations now.
I-9 and E-Verify: New Deadlines, New ComplexitiesE-Verify Restored After Shutdown
Following a federal government shutdown, USCIS restored access to E-Verify, and employers had until October 14 to submit backlogged cases. Delays must be documented and justified, especially for federal contractors and employers subject to FAR clauses.
TPS and Parole Work Authorization Uncertainty
Litigation has delayed the termination of Temporary Protected Status (TPS) designations for several countries. Employers must carefully verify Employment Authorization Documents (EADs) tied to parole and TPS categories. Some documents may appear valid while lacking underlying authorization, or vice versa.
New EAD Validity Limits
Under H.R. 1, effective July 22, 2025, EADs tied to parole (C11) and TPS (A12/C19) will be valid for 365 days or until status expires, whichever is shorter. Automatic extensions will also be capped under the new framework.
E-Verify Enhancements
E-Verify’s Status Change Report now includes a “Revoked Document Number” field. Employers must compare that number to the EAD used on Form I-9. If matched, reverification is required. If not, no action is needed.
Visa Holder Vetting
DHS continues to explore a “continuous vetting” program targeting visa holders, including H-1B and L-1 employees. If enacted, employers should prepare for sudden revocations, delays, and increased scrutiny, especially during international travel.
Parting Thoughts
The third quarter of 2025 revealed a hard truth: compliance is no longer reactive, it must be proactive, documented, and defensible. Legal obligations now extend beyond the “what” and into the “how” and “why” behind employment decisions.
Employers should:
Reexamine criminal history screening workflows in light of Philadelphia, Washington, California, and MinneapolisConduct audits of pay transparency and job posting practices across all jurisdictionsSeparate recreational and medical cannabis policies, and confirm testing procedures meet state-specific requirementsInventory AI systems used in hiring and workforce management, and ensure compliance with bias mitigation, notice, and oversight rulesPrepare for increased I-9 scrutiny, immigration document revocations, and E-Verify enhancements
Employers who view compliance as a strategic asset, rather than a box-checking exercise, will be better positioned to reduce risk, increase fairness, and meet the evolving demands of the modern workforce.