The California Consumer Privacy Act, was passed in 2018 and became effective in 2020. It significantly changed California’s consumer privacy data collection rules, requiring businesses subject to the act to notify consumers about the kinds of personal information it collects about them and what it was used for. It also gave consumers several rights regarding their personal information, including the right to know what personal information businesses collect about them, obtain their personal information from companies, have their personal information deleted, and the right to opt out of the sale of their personal information.

Then, at the end of 2020, California voters approved Proposition 24, known as the California Privacy Rights Act. The CPRA amended the CCPA, building on its framework and expanding some of its protections.

The law’s broad language, specifically the way it defines consumers and their personal information, seemingly encompasses California-based employees, job applicants, independent contractors and most of the information collected about them within the scope of those roles.

As such, employers covered by the CPRA must comply with the law as it pertains to the personal information of additional consumers, including, but not limited to, their employees, job applicants and independent contractors (referred to throughout as “employment-related information”).

The CPPA adopted regulations went into effect March 29, 2023.