Key Takeaways:
- The California Privacy Protection Agency is considering new regulations that would clarify how the California Consumer Privacy Act (CCPA) applies to employees, job applicants and independent contractors.
- These regulations may better align the CCPA’s requirements with the ways in which businesses handle data about workers but also risk increasing regulatory burden for employers.
- The Agency has requested pre-rulemaking comments from the public, including to better understand the challenges businesses currently face in providing CCPA rights to workers.
The California Consumer Privacy Act (CCPA) remains uniquely positioned as the only U.S. state comprehensive privacy law that regulates the personal data of employees, job applicants and independent contractors. Since the scope of the CCPA was expanded to this population in January 2023, employers subject to the CCPA have grappled with challenges and ambiguities in applying a consumer privacy law to their workforce.
On April 20, the California Privacy Protection Agency (CalPrivacy or the Agency) initiated preliminary rulemaking focused on employee data, as well as privacy notices and disclosures, under the CCPA. The Agency is specifically exploring whether special regulations should be adopted to detail how the CCPA should apply to personal information about employees, job applicants and independent contractors – perhaps recognizing confusion among both workers and industry. For example, the Agency is soliciting feedback to questions such as: “What challenges do businesses experience when providing job applicants and employees with the ability to exercise their privacy rights? How can the regulations address this issue?”
Potential impacts from this rulemaking may include different or additional requirements for California privacy notices and, as concerns employees, a different set of regulations from those governing consumer personal information. While it is too early to predict specific substantive changes in the rules, if CalPrivacy proceeds with formal rulemaking on employee personal information, it has the potential to better align the CCPA’s requirements with the ways in which businesses handle data about workers. On the other hand, it may also result in additional requirements and regulatory burden for employers.
The rulemaking is currently at an early, pre‑proposal stage in which CalPrivacy is seeking broad input from consumers, employees and businesses on a number of topics. CalPrivacy is accepting preliminary comments through May 20, 2026, after which it may decide whether to advance formal proposed regulations. If the Agency proceeds, draft regulations and a separate public comment period would follow, with final requirements not expected to take effect until sometime in 2027 at the earliest. We are actively monitoring this rulemaking and would be happy to discuss what it could mean for your existing privacy notices, human resources data practices and broader CCPA compliance program. If you would like to discuss strategies relating to the submission of preliminary comments or have any questions, please contact Justin Yedor or Jennifer Mitchell.
