Mobley v. Workday: Redefining Employer Liability

By Robert Mather, Founder & CEO, MyEmployment

The Legal Earthquake HR and Compliance Leaders Can’t Ignore

In May 2025, a California federal judge certified what could become the largest employment discrimination class action in U.S. history. Mobley v. Workday isn’t just about AI bias—it redefines who is legally responsible when companies outsource employment decisions.

Judge Rita Lin ruled that when vendors participate in employment decision-making, they become agents of the employer. And when agents act, their principals—the employers—share liability.

That precedent reaches well beyond hiring software. It touches every vendor involved in HR functions, including employment verification, where third-party systems routinely decide when and how to release employee data.

How This Creates Hidden Risk in Verification

Most HR leaders assume employment verification is a low-risk administrative task. It isn’t.

Traditional vendors routinely decide:

Whether a verifier’s authorization is sufficient.
Whether the request fits the scope of consent.
What information to release and when.

That judgment is precisely what created liability in Mobley. When a vendor exercises discretion instead of following direct instructions, it forms an agency relationship. Employers then share responsibility for every decision.

Here’s how the employment verification chain typically unfolds:

An employer hires a thid party verification company to answer incoming queries about current or former employees employment information.
The verifier requests the employment verification from the employer ( usually through the employer third party agent)
A verifier (lender, landlord, background-check company) certifies it has an employee release or sends a signed release.
The verification vendor accepts that certification or document at face value and releases the data—without confirming with the employee.

If the authorization is invalid, expired, or misused, data still flows. The employee never knows unless an adverse action is uncovered ( job denied, housing denied, loan denied etc) , and the employer may share in the legal class action fallout.

Why Indemnification Won’t Save You

Many organizations assume strong contracts protect them. They don’t.

Indemnification clauses only decide who pays after you lose. They don’t prevent being named, sued, or dragged through discovery. Under agency theory, both employer and vendor appear as co-defendants.

That means the cost of outsourcing may now include the risk of massive class action litigation.

The Solution: Eliminate Vendor Decision-Making

The Mobley ruling draws a bright legal line: participation equals liability.

The only way to remove that exposure is to remove vendor discretion altogether.

MyEmployment’s employee-controlled verification model does exactly that.

Instead of the vendor interpreting authorizations, each employee, if they wish, receives a real-time notification whenever a verifier requests data. The employee reviews the requester, purpose, and data scope—then taps “approve” or “deny.”

If approved, the data releases instantly, and the system records a complete audit trail: timestamp, requester identity, and authorization.

The vendor makes no judgment, interprets nothing, and simply executes the employee’s instruction.

No discretion = no agency = no shared liability.

Why This Matters Legally and Practically

Judge Lin wrote that Workday’s system was liable because it didn’t “implement employer criteria in a rote way.” It participated in the decision.

Traditional verification vendors do the same: they decide whether to trust a certification, how to read a release, and what to disclose.

Employee-controlled verification flips that logic. The employee—not the vendor—decides. That removes the decision-making layer that creates agency liability.

At the same time, the process becomes faster and more transparent:

- FCRA compliance: Each release is tied to a specific permissible purpose.
- CPRA/state privacy readiness: Each approval is informed, specific, and revocable.
- Speed: Employees approve legitimate requests within minutes.
- Savings: Organizations cut verification costs 40–50% by paying only for completed transactions.
- Trust: Employees see and control every access to their data.

What HR and Legal Teams Should Do Now

1. Review your vendor’s authority.
Ask if your verification provider ever decides whether authorizations are valid, interprets scope, or releases data without employee confirmation. If yes, you may have an agency relationship under Mobley.

2. Audit existing authorizations.
Verify whether they meet current privacy and data-use standards. Verification release forms or authorizations must follow strict State and Federal laws. Ask you vendor to show you the actual verification forms used by firms accessing your employee data

3. Bring in legal counsel.
The Mobley precedent created joint liability for vendor actions. Your general counsel should evaluate whether your contracts or workflows expose you.

4. Transition to real-time employee approval.
Employee-controlled verification removes vendor judgment and provides a defensible compliance record for every disclosure.

5. Frame the change as trust and transparency.
Employees appreciate control over their data. Positioning this as a privacy and accountability initiative helps adoption and reinforces culture.

The Bigger Picture

Mobley v. Workday didn’t only redefine liability—it shifted expectations. Outsourcing sensitive HR functions without oversight is no longer defensible.

The next wave of class actions will not stop with hiring software. They’ll target every employer whose vendors make independent decisions about employment data.

Real-time, employee-controlled verification isn’t a “nice-to-have.” It’s the legal architecture for a post-Mobley era.

Legal and Liability Disclaimer

The information provided by Robert Mather and MyEmployment is for informational and educational purposes only and should not be construed as legal advice.
No attorney-client relationship is created by reading or relying on this material.
Organizations should consult qualified legal counsel regarding their own policies, vendor relationships, and compliance obligations under applicable laws, including but not limited to the FCRA, CPRA, and related privacy regulations. References to public court cases or companies—including Mobley v. Workday, or any other entity—are based solely on publicly available information.
MyEmployment and its representatives make no claims or implications about the legality, intent, or conduct of any specific organization or party.
All commentary reflects general industry observations and should not be interpreted as factual assertions or legal conclusions about any ongoing or past litigation.

MyEmployment, its affiliates, and authors disclaim all warranties, express or implied, and shall not be liable for any loss or damage arising from reliance on this information.

Frequently Asked Questions

1. Does Mobley only affect AI hiring?
No. The legal principle applies to any vendor making employment-related decisions, including verification providers.

2. Can stronger contracts protect us?
No. Indemnification determines financial responsibility after liability attaches. It doesn’t prevent being sued.

3. How does employee approval eliminate risk?
Employees—not vendors—decide whether data is released. Vendors execute instructions, not interpretations, which breaks the agency link.

4. What if an employee denies a legitimate request?
Approvals usually happen within minutes. If denied, the process pauses until the employee authorizes. The record shows the employer acted correctly.

5. Is this slower than traditional verification?
It’s faster. Mobile notifications let employees approve around the clock instead of waiting for manual HR or vendor review.

6. Does it meet privacy and FCRA standards?
Yes. Each transaction documents specific, time-bound, informed permission—meeting or exceeding federal and state requirements.

Bottom Line

If your vendor exercises judgment about employee data, you share its liability.
MyEmployment replaces that structure with direct employee permission—removing vendor discretion, eliminating agency, and restoring compliance clarity.
In short: when employees control their data, employers control their risk.

Mobley v. Workday: The Court Case That Just Redefined Employer Liability