The CCPA has applied consumer privacy protections to employee data since January 1, 2023, when the employment exemption expired. Covered employers must now provide notices and facilitate employee rights to access, correct, delete, and opt out of data collection, with response mechanisms such as web forms. The current rulemaking follows a July 2023 enforcement sweep by California Attorney General Rob Bonta targeting large employers' compliance gaps.
Employers should monitor this rulemaking closely. The CalPrivacy Agency appears to be tightening standards for employment data handling, drawing on European precedent where privacy violations have triggered multimillion-euro fines. With the May 20 deadline imminent and recent CCPA updates effective January 1, 2026, companies should prepare to revise employee privacy notices and data handling procedures. Submitting comments during this window—particularly on compliance feasibility—may influence final rules.