In short
- The CCPA's temporary exemption for employee and applicant data expired at the end of 2022. Workers now have the same rights as other consumers.
- Give applicants and employees a notice at collection. CalPrivacy's Tractor Supply decision faulted a failure to tell job applicants about their privacy rights.
- Personnel files must be produced within 30 days and payroll records within 21 days of a request.
- Using AI or automated tools in hiring, pay or discipline now brings Civil Rights Council rules (since October 1, 2025) and CalPrivacy rules (from January 1, 2027).
The CCPA applies to your workforce
The CCPA exemptions for employment-related information and business-to-business communications became inoperative on January 1, 2023 (Civ. Code § 1798.145(m), (n)). The Attorney General's CCPA guidance says they "expired on December 31, 2022." Because a "consumer" is any natural person who is a California resident (§ 1798.140(i)), job applicants, employees, owners, officers and independent contractors can:
- request access to, deletion of, and correction of their personal information;
- limit the use of sensitive personal information used beyond permitted purposes; and
- exercise those rights without retaliation (Civ. Code § 1798.125).
Deletion and access rights have exceptions, including for information you must keep to comply with the law. Employment-law recordkeeping duties still apply.
Notices to applicants and employees
Give a notice at collection at or before the point of collection, covering the categories of personal and sensitive personal information you collect, why, whether you sell or share it, how long you keep each category, and a link to your privacy policy (11 CCR § 7012). For paper onboarding, the notice can be on the form or handed out with it. Without a notice, you may not collect the information.
In September 2025 CalPrivacy fined Tractor Supply $1.35 million in part for failing to tell job applicants about their privacy rights. It was the agency's first decision addressing applicants' privacy rights.
Labor Code record rights
| Record | Employee right | Deadline | Source |
|---|---|---|---|
| Personnel file | Current and former employees may inspect and copy records about their performance, education and training, or grievances. Keep at least 3 years after termination. | 30 calendar days from a written request | Lab. Code § 1198.5 |
| Payroll records | Inspect or copy wage statements and deduction records. Keep at least 3 years. Wage statements may show only the last four digits of an SSN, or an employee ID. | As soon as practicable, no later than 21 calendar days | Lab. Code § 226 |
| Signed documents | A copy of any instrument signed relating to obtaining or holding employment. | On request | Lab. Code § 432 |
Late production of personnel or payroll records carries a $750 penalty (§ 1198.5(k); § 226(f)). Since January 1, 2026, personnel records expressly include education and training records, with specified details (SB 513, 2025).
Things employers may not ask for
- Personal social media: no requiring or requesting usernames or passwords, access in the employer's presence, or disclosure of personal social media, with limited exceptions for misconduct investigations and employer-issued devices (Lab. Code § 980).
- Photos and fingerprints for third parties: requiring an employee or applicant to be photographed or fingerprinted so the images or prints can be given to another employer or third party, where they could be used to the person's detriment, is a misdemeanor (Lab. Code § 1051).
Employee medical information
California's Confidentiality of Medical Information Act has a chapter for employers. An employer that receives medical information must establish procedures to keep it confidential and protect it from unauthorized use and disclosure (Civ. Code § 56.20(a)). It may not use or disclose employee medical information without a signed authorization, except in circumstances the statute lists, such as when compelled by law or to administer benefit plans (§ 56.20(c)). It may not discriminate against an employee who refuses to sign an authorization (§ 56.20(b)). Keep medical information separate from the general personnel file.
Biometrics and monitoring
Biometric information used to identify a person is sensitive personal information (Civ. Code § 1798.140(ae)). The regulations allow using employee biometrics to control access to secure areas without triggering the right to limit, but not keeping them indefinitely or using them for unrelated purposes (11 CCR § 7027(m)).
Using automated processing to infer employees' performance, behavior or location from "systematic observation," such as video, audio, location tracking or biometric identification, requires a risk assessment (11 CCR § 7150(b)(4)). For processing that began before 2026, the assessment is due by December 31, 2027.
Pending legislation: AB 1331, which would limit workplace surveillance tools, passed the Legislature and was presented to the Governor on September 14, 2026. As of this review it has not been signed or vetoed.
AI and automated decisions in employment
| Rule | What it requires | Effective |
|---|---|---|
| Civil Rights Council regulations (2 CCR § 11008.1 and following) | Automated-decision systems that harm applicants or employees based on protected characteristics may violate the Fair Employment and Housing Act. Anti-bias testing is relevant evidence. Keep employment records, including automated-decision data, for at least four years. | October 1, 2025 |
| CalPrivacy ADMT rules (11 CCR §§ 7200–7222) | For hiring, work allocation, pay, promotion, demotion, suspension or termination decisions made by ADMT: a pre-use notice, an opt-out (subject to exceptions), and access rights. | January 1, 2027 |
See Privacy in new products and technology for the ADMT definitions and exceptions.
Checklist
- Notices at collection for applicants, employees and contractors, including retention periods.11 CCR § 7012
- Workforce data included in your CCPA request-handling process.Civ. Code §§ 1798.105–1798.130
- A calendar for personnel files (30 days), payroll records (21 days) and signed documents.Lab. Code §§ 1198.5, 226, 432
- Employee medical information stored separately, under written confidentiality procedures.Civ. Code § 56.20
- No requests for personal social media credentials.Lab. Code § 980
- An inventory of biometric and monitoring tools, with purpose and retention limits.11 CCR § 7027(m)
- Risk assessments for monitoring that infers performance or behavior.11 CCR § 7150(b)(4)
- For AI hiring and HR tools: anti-bias testing, four-year records, and ADMT notices and opt-out paths by January 1, 2027.2 CCR §§ 11009, 11013; 11 CCR §§ 7200–7222
Related guides
- How-toResponding to consumer privacy requestsStep-by-step CCPA request handling: intake methods, the 10-business-day confirmation, the 45-day response, verification standards, and why opt-outs are different.
- Topic guidePrivacy in new products and technologyPrivacy by design under California law: data minimization, dark patterns, CCPA risk assessments, ADMT rules effective 2027, AI transparency laws, and CIPA pixel and session-replay risk.
Official sources
- Civil Code § 1798.145; CCPA guidance (California Attorney General)
- Labor Code § 1198.5, § 226, § 432, § 980, § 1051
- Civil Code §§ 56.20–56.245 (employer duties under the CMIA)
- Automated-decision system regulations (California Civil Rights Department)