Employee monitoring laws California: what applies

Where workers' representatives exist, and in line with national law and practice, inform and consult them before electronic surveillance of how workers act at work is brought in.

Before or when it collects personal information, a business that controls that collection must tell consumers which categories it will collect, including any sensitive categories, why each is collected or used, whether each is sold or shared, and how long each category will be kept (or the criteria that set the period). It may not later gather new categories, or put existing data to purposes incompatible with those it announced, without first giving a fresh notice. A third party that controls collection may meet this by a prominent notice on its website homepage, and must give the notice at the location when it collects on premises (1798.100(b)).

The notice at collection must be easy to read, accessible and available where the consumer meets it at or before the point data is taken: near web form fields, on app download and settings pages, on paper forms, by signage or orally for in-person or phone collection. It lists categories collected (including sensitive ones), purposes, whether each is sold or shared, retention periods, a link to the opt-out notice where data is sold or shared, and a link to the privacy policy. If the notice is not given, the business may not collect. Where a third party controls collection on another business's site or premises, both must give notice, and a registered data broker that does not collect directly need not give one if it meets the conditions of the section.

Before any monitoring starts, workers should learn why it is done, when it runs, how it works (methods and techniques) and which data it gathers, and the employer must keep the intrusion on workers' privacy as small as possible.

Workers and their representatives should be told about every data collection process, the rules governing it and their rights.

Covert monitoring should be allowed only where national law permits it or where there are reasonable grounds to suspect a crime or other grave misconduct.

An employer must not arrange, order or permit any audio or video capture of a worker who is inside a restroom, a locker room, or a room set aside for staff to change clothes, unless a court order allows it. The ban is on causing the recording, so it reaches cameras and microphones installed by contractors, landlords or security vendors at the employer's request, and recording functions of access-control or monitoring systems that capture those rooms.

Any recording that breaches the section is off limits to the employer for every purpose: not for discipline, not for investigations, not for litigation, not for security review. The section applies to private and public employers alike, except the federal government. The practical control is a rule that any footage or audio discovered to come from a protected room is quarantined and destroyed, not viewed or relied on.

Unless a court order directs otherwise, an employer must not point any surveillance tool at workers inside a bathroom on the work premises. This widens section 435 from recording to every form of tool-based monitoring (geolocation, badges that log movement inside the room, wearables, time-tracking) and covers bathrooms whether or not they are also locker or changing rooms. One-time entry and exit checks of a bathroom from a surveillance tool remain allowed. Existing federal or state requirements to use a tool are preserved, and operations under federal statutes, regulations or binding contracts for aircraft development or national security, military, space or defence products are carved out to the extent the tool is reasonably necessary to comply.

Workers may set aside any surveillance tool they carry or wear before entering a bathroom at work, except where federal or state law requires them to stay reachable through meal and rest breaks. The employer is not in breach where an employee voluntarily brings a tool in, or where a policy requires a tool such as a badge or personal alarm to be carried for identification or safety or to open a locked or secured bathroom, provided the tool neither detects nor records audio or video and has no physically embedded or attached artificial intelligence. The duties take effect on 1 January 2027.

A person may not, intentionally and without the consent of all parties to a confidential communication, use an electronic amplifying or recording device to eavesdrop on or record it, whether the parties are together in person or talking by telegraph, telephone or another device (radio excepted). Penalty: a fine of up to 2,500 dollars per violation, up to one year in county jail or state prison, or both; up to 10,000 dollars per violation after a prior conviction under ss. 631, 632, 632.5, 632.6, 632.7 or 636.

A person may not, without the consent of all parties, intercept or receive and intentionally record, or help to intercept or receive and record, a communication transmitted between two cellular radio telephones, a cellular and a landline telephone, two cordless telephones, a cordless and a landline telephone, or a cordless and a cellular telephone. Unlike s. 632, the communication need not be confidential. Penalty: a fine of up to 2,500 dollars, up to one year in county jail or state prison, or both; up to 10,000 dollars after a prior conviction under ss. 631, 632, 632.5, 632.6 or 636.

A person must not, by any machine, instrument or contrivance or in any other manner, intentionally tap or make any unauthorized physical, electrical, acoustic, inductive or other connection with a telegraph or telephone wire, line, cable or instrument, including one of an internal telephonic communication system. Penalty: a fine of up to 2,500 dollars, up to one year in county jail or imprisonment under s. 1170(h), or both; up to 10,000 dollars after a prior conviction under ss. 631, 632, 632.5, 632.6, 632.7 or 636.

A person must not use, or try to use, in any manner or for any purpose, or communicate in any way, any information obtained by tapping or by reading communications in transit in breach of 631(a).

A person must not wilfully, without the consent of all parties to the communication or in any unauthorized manner, read or try to read, or learn the contents or meaning of, any message, report or communication while it is in transit or passing over any wire, line or cable, or being sent from or received at any place in California. For an organisation this reaches tools that capture message content as it passes, such as third-party chat, session replay or call analytics services, where not every party has consented.

A person must not aid, agree with, employ or conspire with any person to unlawfully do, permit or cause any of the acts in 631(a). An organisation that deploys a third party's tool which reads communications in transit can be exposed under this clause as well as the tool provider.

Unless the chapter specifically provides otherwise, no person may intentionally intercept, try to intercept, or procure anyone else to intercept or try to intercept, any wire, oral or electronic communication. For an employer this covers real-time capture of calls, email or messages in transit, keystroke or screen tools that acquire message contents as they are sent, and listening devices, unless an exception (provider, business extension, consent) applies.

A person not acting under color of law may intercept a wire, oral or electronic communication where that person is a party to it or one of the parties has given prior consent, unless the interception is for the purpose of committing a criminal or tortious act against the Constitution or the laws of the United States or any State. Employers commonly obtain the employee's prior consent through a signed monitoring policy; consent must cover the monitoring actually carried out, and state all-party consent laws can still apply.

The prohibition turns on the use of an electronic, mechanical or other device. Telephone or telegraph equipment or facilities, or their components, furnished to the subscriber or user by a provider in the ordinary course of its business and used by the subscriber or user in the ordinary course of its business (or furnished by the subscriber or user to connect to the service and so used), and equipment used by a provider in the ordinary course of its business, are not such a device. An employer's use of its phone system to monitor business calls can fall outside the prohibition where the monitoring is in the ordinary course of business; hearing aids are also excluded.

A business using or disclosing sensitive data beyond what an average consumer expects for the requested goods or services, or the other purposes the regulations allow (11 CCR 7027(m)), must tell consumers so and let them limit use to those purposes. After a request to limit, the business may use the data only for those purposes unless the consumer later consents. Sensitive data handled with no aim of inferring characteristics about the consumer is treated as ordinary personal information.

Gathering, using, keeping and passing on a consumer's data must go no further than needed, and in proportion, for the purpose it was gathered for, or for another disclosed purpose that fits the context of collection. Processing that drifts into purposes incompatible with those is not allowed.

Any business, whatever its size, must carry out a risk assessment before starting processing that the regulation treats as a significant privacy risk: selling or sharing personal information; processing sensitive personal information (other than routine employee administration such as payroll, benefits, work authorisation and legally required accommodation or wage reporting); using ADMT for a significant decision; automated inference about applicants, students, employees or contractors from systematic observation; automated inference from presence at a sensitive location; and processing data intended to train ADMT for significant decisions or facial, emotion or identity recognition technology. The duty applies to processing begun on or after 1 January 2026; processing already under way then must be assessed by 31 December 2027 (7155(b)).

Monitoring that never stops should be allowed only where it is needed for workplace health and safety or to protect property.

Output from electronic surveillance should never be the sole input when a worker's performance is judged.

Keep personal data only as long as the specific purposes of collection justify, unless a worker asks to stay on a candidate list for a set period, national law requires retention, or the employer or worker needs the data for legal proceedings about an existing or former employment relationship.

Unless subsection (c) applies, no person may intentionally access without authorization a facility through which an electronic communication service is provided, or intentionally exceed an authorization to access it, and thereby obtain, alter or prevent authorized access to a wire or electronic communication while it is in electronic storage in that system. Penalties (2701(b)): for commercial advantage, malicious destruction, private gain or in furtherance of a criminal or tortious act, up to 5 years (10 for a repeat); otherwise up to 1 year (5 for a repeat after a prior conviction). For an employer this reaches logging into an employee's personal email, social media or messaging account, for example with a saved password on a work device, without the employee's authorization.

Subsection (a) does not apply to conduct authorized by the person or entity providing the wire or electronic communications service. An employer that provides its own email or messaging service to employees can authorize access to communications stored on that service; the authorization does not extend to services the employer does not provide, such as an employee's personal webmail.

Subsection (a) does not apply to conduct authorized by a user of the service with respect to a communication of, or intended for, that user. Access to an employee's stored messages with that employee's authorization is outside the offense; access to a third party's messages needs that user's authorization or another exception.

5.1 Lawful, fair and employment-related processing. Handle workers' data lawfully and fairly, and solely for reasons that bear directly on the person's job.

Employers should not collect data on a worker's sex life, political, religious or other beliefs, or criminal convictions, except in rare cases where national law permits it and the information bears directly on a decision about the job.

Employers should not collect data on a worker's membership of a workers' organization or trade union activities unless the law or a collective agreement requires or permits it.