California Privacy Agency Signals Heightened Focus on Workplace Privacy Through Gig Economy Audits

In its latest escalation of scrutiny of workplace privacy, California’s privacy agency, CalPrivacy, announced June 21, 2026 that it will launch formal audits of gig economy companies. The agency said the audits will focus on company compliance with the rights of California residents to access and control their personal information.

In anticipation of these audits, gig economy companies should evaluate their privacy compliance programs, particularly their procedures for receiving, tracking, and responding to data rights requests. Businesses should ensure that systems for submitting such requests function properly, are actively monitored, and trigger administrative processes capable of responding within the California Consumer Privacy Act (CCPA)’s statutory deadlines.

California Consumer Privacy Act and Data Rights

Since 2023, the CCPA has required for-profit businesses with more than $25 million¹ in annual gross revenues that do business in California (“Covered Businesses”) to implement comprehensive privacy programs to protect the personal information of California residents, including job applicants, employees, and independent contractors. Compliance requires posting privacy policies, executing CCPA agreements with vendors, maintaining reasonable data security, and honoring California residents’ requests to exercise data rights. These rights include:

• The right to know
• The right to correct
• The right to delete
• The right to opt out of targeted advertising (“sharing”) and sales of personal data
• The right to opt out of certain uses of automated decisionmaking technology (ADMT), as well as rights to appeal and access information regarding decisions made with ADMT

Covered Businesses must describe these rights in their privacy policies and provide at least two methods to exercise them: generally, a toll-free telephone number and a web form. For the rights to know, correct, and delete personal data and to appeal and access ADMT, the Covered Business must: 

• Securely verify the identity of the requester;
• Confirm receipt of the request within 10 business days; and
• Respond within 45 calendar days, with the option of a 45-day extension in some circumstances.

Requests to opt out must be processed more quickly, generally within 15 business days.

The rights granted by the CCPA are extraordinarily complex. For example, the right to know personal data is not a general right of access to personal data, but instead a right to “specific pieces of personal information.” Regulations and guidance still have not clarified what that means. In addition, each right is subject to numerous statutory and regulatory exceptions, many of which are not clearly defined. Moreover, the CCPA exempts certain categories of data, for example, most, but not all, health data. 

California Remains Unique in Extending Privacy Rights to Workforce Data

Of the more than 25 comprehensive state data privacy laws, the CCPA is unique in applying to workforce personal data. While most state privacy laws are limited to consumer data, the CCPA applies to personal information collected from applicants, employees, and independent contractors. As a result, large gig economy companies may have robust processes for handling consumer personal data but much less control over the personal data of their independent contractors and employees.

Growing Regulatory Attention to Workplace Privacy

The drafters and regulators of the CCPA historically have shown little interest in applying the CCPA to employment. Although the CCPA applied to applicants, employees, and independent contractors from the outset, this seemed more like an after-thought. The language of the statute and the regulations that followed did not address issues specific to the workplace—for example, whether employee privacy notices must be posted publicly or whether the right to “specific pieces of personal information” could apply to employees’ work product. Moreover, CalPrivacy has focused its enforcement almost entirely on the consumer context.  

That trend appears to be changing. Regulations approved in late 2025 introduced extensive new requirements affecting employers, including detailed and documented risk assessment obligations for a variety of common data-processing activities and restrictive requirements governing the use of automated decision-making technologies in employment-related decisions. 

This latest announcement suggests that CalPrivacy has moved into a new phase of workplace privacy enforcement. Regulators may scrutinize all California employers, not just gig economy employers. Moreover, given CalPrivacy’s eight published enforcement actions with fines averaging in the millions, the period in which violations would result only in a warning seems to have ended. It seems likely that CalPrivacy will impose fines if it discovers blatant violations during its new audit campaign. Under the CCPA, CalPrivacy may impose administrative fines of up to $7,988 per violation. These fines add up quickly, for example, where an organization has failed to respond appropriately to multiple data rights requests or has systemic deficiencies in its privacy compliance program.

Key Takeaways

To help reduce the risk of adverse findings during a CalPrivacy audit, gig economy Covered Businesses should consider conducting proactive internal reviews of their privacy compliance programs. Priority areas include:

• Reviewing privacy policies for accurate descriptions of privacy rights and means to exercise those rights;
• Testing opt-out mechanisms to confirm they function as intended;
• Ensuring that all channels for exercising CCPA rights are actively monitored and properly staffed; and
• Ensuring that processes to comply with requests work in practice.

In addition, all Covered Businesses should consider reviewing their privacy programs for workforce data.