Employee monitoring law · California
Employees have full CCPA rights since 2023, including deletion and correction.
Serve a notice at collection, and be ready to honour deletion and correction requests from staff.
- Region
- North America
- Instruments
- 3 governing
- Employer duties
- 3 listed
- Last reviewed
- August 22, 2026
California · what the law requires
Notice and proportionality
California is now the most demanding US state for employee data, because the CCPA employee exemption expired on 1 January 2023. Employees and applicants have the right to know, delete, correct, and limit use of sensitive personal information, and employers must give a notice at or before the point of collection that reflects actual practice. CIPA adds all-party consent for recording communications, and Labor Code § 435 bars audio or video recording in restrooms and changing areas.
- Notice at collection, matching realityGiven at or before collection, listing categories collected, purposes, and retention. It has to describe what you actually do.
- Honour employee data rightsAccess, deletion and correction requests from employees now work like consumer requests, with statutory response deadlines.
- State and keep a retention periodCPRA requires disclosing how long each category is kept, or the criteria used to decide.
- Proof Ledger
- Outcomes
- Certificates
- Audit log
- Data access
- Disputes
- Data egress
- Export
- What We See
- Controls
- AKAria K. viewed screenshotsLena M. · 3 capturesScreen capturemacOS · London09:42a91f…4c023d7b…91ee
- JMJon M. exported time reportDesign team · CSVmacOS · Berlin09:313d7b…91ee77c5…0ba4
- SDSara D. opened capture reviewRavi P. · one flagged frameWindows · Manchester09:1877c5…0ba4e208…5f13
- wm_live_7f2… read /v1/deliverablesScoped key · read onlyPublic API · allowlisted IP08:57e208…5f13b64a…2d90
- LMLena M. viewed her own recordWhat We SeemacOS · London08:44b64a…2d901cf9…8e77
- AKAria K. changed capture policyBlur set to alwaysmacOS · London08:261cf9…8e7705d2…ae31
The instruments, and which control answers each duty
- CCPA as amended by CPRA: Cal. Civ. Code § 1798.100 et seq.. Full consumer rights extended to employees and applicants since January 2023: know, delete, correct, opt out, and limit sensitive data use.
- California Invasion of Privacy Act: Cal. Penal Code § 630 et seq.. All-party consent for recording confidential communications: a criminal statute with a private right of action.
- Labor Code § 435: Cal. Lab. Code § 435. Prohibits audio or video recording in restrooms, locker rooms and changing areas.
No product does this part
What you must still do yourself
Compliance is a property of your deployment. These are the steps in California that no vendor can complete on your behalf, and skipping them is what turns a rollout into a finding.
- 1Publish and maintain the notice at collection for employees and applicants.
- 2Build the intake and response workflow for employee rights requests.
- 3Do not record communications without all-party consent. CIPA is criminal and privately enforceable.
- If you get it wrongCPPA and Attorney General penalties up to $2,500 per violation, or $7,500 per intentional violation or violation involving a minor. CIPA carries statutory damages and a private right of action.
Verify the claim
Every control above, on the page that describes it
Sources and review date
Last reviewed August 22, 2026This is a summary of how employee-monitoring rules generally work in this jurisdiction, written to help you scope a rollout and brief your own advisers. It is not legal advice, it is not a substitute for it, and law changes. Verify against the primary sources listed and take local counsel before you deploy.
Nearby jurisdictions
Monitoring law elsewhere in North America
- IllinoisBIPA carries a private right of action. This is the state where monitoring gets sued.
- Canada (federal)Reasonableness is the statutory test, and the OPC applies a four-part necessity analysis.
- OntarioA written electronic monitoring policy is mandatory at 25+ employees, refreshed annually.
- QuebecLaw 25 adds privacy by default, impact assessments and a right to explanation.
- United States (federal)Federal law is permissive; the real constraints are state law and the NLRA.
- New YorkWritten notice on hire, signed acknowledgement, and a posted notice, all three.
Point it at one team for a week.
Create the account, put the agent on a handful of desks, and leave it alone. On Friday you read the week instead of reconstructing it: hours against their projects, focus and idle per person, and the timesheets already filled in.
Free for two seats. No card, and no sales call to sit through.