California employee privacy laws give workers some of the strongest workplace privacy protections in the country, drawing from a constitutional right to privacy, a stack of Labor Code and Civil Code provisions, and consumer data laws that now reach into HR files. Your employer can still monitor company equipment, investigate misconduct, and require job-related medical exams in the right circumstances, but the default rule in California tilts toward the employee: intrusions need a real business justification, and several categories of information and conduct are off-limits regardless.
The Constitutional Right That Sets the Floor
Article I, Section 1 of the California Constitution lists privacy as an inalienable right alongside life, liberty, and property.1California Legislative Information. California Constitution Article I Unlike the federal Constitution, California’s version applies against private employers, not just the government. That single difference drives most of what follows.
In Hill v. National Collegiate Athletic Association, the California Supreme Court set out how a privacy claim actually works. You need three things: a legally recognized privacy interest, a reasonable expectation of privacy based on widely accepted social norms, and an invasion serious enough to count as an egregious breach of those norms.2Justia. Hill v. National Collegiate Athletic Association (1994) Even when all three are met, the employer can defend the intrusion by showing it serves a legitimate competing interest, with courts weighing the severity of the intrusion against how closely the reason ties to core business functions. Most workplace privacy disputes get decided on that balance.
Monitoring, Recording, and Tracking
Employers can generally monitor work email and internet use on company-owned devices if they have a clear written policy and tell employees monitoring occurs. Notice is what defeats the reasonable expectation of privacy. Where employers run into trouble is monitoring without notice, or extending surveillance into places where privacy expectations are strong regardless of policy.
Audio and Video
California is an all-party consent state. Penal Code 632 makes it a crime to record a confidential conversation without the consent of every person involved, with fines up to $2,500 and up to a year in county jail for a first offense, and a $10,000 fine for a second.3California Legislative Information. California Code PEN 632 A conversation is “confidential” when the circumstances suggest the parties meant it to stay between them. A closed-door meeting counts. A shout across a warehouse floor probably doesn’t.
Video surveillance is more permissible than audio, but Labor Code 435 draws a firm line. Employers cannot make audio or video recordings in restrooms, locker rooms, or rooms used for changing clothes. Any recording made in violation of this rule is inadmissible and cannot be used for any purpose.4California Legislative Information. California Code LAB 435
Searches and Location Tracking
Employers can search company-provided workspaces, like desks and assigned lockers, when a written policy warns employees not to expect privacy in those areas. Personal belongings are different. Searching a purse, a backpack, or a personal phone without consent requires a compelling job-related reason, and the scope has to be narrow.
For location data, Penal Code 637.7 prohibits using an electronic tracking device to determine a person’s location or movement without consent. The statute exempts tracking a vehicle when the registered owner consents, which covers GPS on company fleet vehicles with proper notice. Attaching a tracker to an employee’s personal car is a misdemeanor.5California Legislative Information. California Code PEN 637.7
Social Media and Personal Accounts
Labor Code 980 flatly prohibits employers from requiring or requesting that employees or job applicants hand over usernames or passwords for personal social media accounts. Employers also cannot require you to pull up your personal social media in their presence or turn over the content of personal accounts. Retaliation for refusing an illegal request is separately prohibited, so your employer cannot fire or discipline you for saying no.6California Legislative Information. California Code Labor Code LAB 980
There is a narrow exception. If your employer reasonably believes your personal social media contains evidence relevant to an investigation into workplace misconduct or a legal violation, it can ask for that specific content, but only for the investigation or a related proceeding. This does not authorize a general fishing expedition through your accounts.
Personal Data Rights Under the CCPA and CPRA
Since January 1, 2023, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, extends data privacy rights to employees at large for-profit businesses. HR records, contact information, and performance data now get the same protection as customer data.7State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA)
Before or at the point your employer starts collecting personal information, it must give you a notice describing the categories collected and the business purpose for each. You then have three main rights:
- Request that your employer disclose the categories and specific pieces of personal information it has collected about you, and the sources of that information.
- Request correction of inaccurate information.
- Request deletion of personal information the employer collected from you, subject to exceptions for legal obligations and certain internal purposes.
These rights apply to data collected in the prior 12 months, and your employer must respond to a verifiable request within 45 days.
If your personal information is exposed because your employer failed to maintain reasonable security, Civil Code 1798.150 gives you a private right of action with statutory damages of $100 to $750 per consumer per incident, or actual damages, whichever is greater. Before suing for statutory damages, you must give the business 30 days’ written notice identifying the specific violation. If the business cures the problem and provides a written statement that it won’t happen again, the statutory damages claim is blocked, though you can still sue for actual pecuniary damages without prior notice.8California Legislative Information. California Civil Code 1798.150 The private right of action covers data breaches from inadequate security only. Other CPRA violations, like ignoring an access or correction request, go through the California Privacy Protection Agency instead.
Off-Duty Conduct, Politics, and Cannabis
What you do on your own time is generally your business. Several statutes back that up.
Labor Code 1101 bars employers from creating any rule that prevents employees from participating in politics or running for public office.9California Legislative Information. California Code Labor Code 1101 Labor Code 1102 prohibits using threats of termination or job loss to pressure employees into adopting or abandoning any political position.10California Legislative Information. California Code Labor Code 1102 Together they mean your employer cannot fire you over a yard sign, a donation, or a social media post supporting a candidate.
Labor Code 96(k) lets employees file a claim with the Labor Commissioner for lost wages resulting from demotion, suspension, or discharge for lawful conduct that occurred during non-working hours and away from the employer’s premises.11California Legislative Information. California Code Labor Code 96 The word doing the work here is “lawful.” If the activity is legal and off-premises, the employer needs a strong, specific connection to job performance to justify any adverse action.
Cannabis got its own protection with AB 2188, effective January 1, 2024. Employers cannot discriminate against employees or applicants based on cannabis use off the job and away from the workplace, and cannot penalize you based on a drug test that detects nonpsychoactive cannabis metabolites — the residue that lingers long after any impairment has worn off. This doesn’t authorize being impaired at work or using cannabis on the job, and it doesn’t apply to building and construction trades, positions requiring federal security clearances, or jobs where federal law mandates drug testing.12California Legislative Information. Assembly Bill (AB) 2188
Medical Exams, Drug Testing, and Genetic Information
Health information gets the tightest protection.
Medical Exams and Disability Inquiries
Under the Fair Employment and Housing Act, employers cannot require a medical or psychological examination of a job applicant or ask disability-related questions before making a conditional job offer. After a conditional offer, an exam is permissible only if it is job-related, consistent with business necessity, and required of all entering employees in the same job classification. For current employees, medical exams are permitted only when the employer can demonstrate they are job-related and consistent with business necessity.13California Legislative Information. California Government Code 12940
Drug Testing
California has no comprehensive drug testing statute, but courts have applied the constitutional privacy right to sharply limit employer testing. Random drug testing of current employees is generally prohibited unless the position is safety-sensitive or federal law requires it. Outside those situations, employers typically need reasonable suspicion of impairment — observable signs like slurred speech, erratic behavior, or involvement in a workplace accident — before ordering a test. Even where testing is permissible, AB 2188 blocks employers from relying on nonpsychoactive cannabis metabolites alone as the basis for adverse action.
Genetic Information
California enacted its own genetic information nondiscrimination law, CalGINA, in 2011. Under FEHA, employers cannot require employees or applicants to undergo testing for genetic characteristics, and cannot make hiring, firing, or other employment decisions based on genetic information, which includes your own genetic test results, family members’ results, and family medical history.14California Legislative Information. CalGINA – SB 559 The legislature explicitly found federal GINA’s protections “incomplete for Californians,” so CalGINA fills the gaps.
Confidentiality of Medical Records
All medical information your employer obtains, whether through the hiring process, a drug test, a fitness-for-duty exam, or the interactive accommodation process, must be stored in medical files separate from your general personnel file and kept confidential.15Cornell Law Institute. Cal. Code Regs. Tit. 2 11069 – Interactive Process Access is limited to supervisors who need to know about work restrictions or accommodations, first aid personnel who may need to respond to an emergency, and government officials investigating civil rights compliance.
How to Enforce Your Rights
The right path depends on the type of violation, and choosing wrong can burn time you need.
For discrimination based on medical information, disability inquiries, or genetic information — anything under FEHA — file with the California Civil Rights Department. The CRD investigates and can pursue back pay, emotional distress damages, and policy changes. The intake form must be submitted within three years of the date you were last harmed.16California Civil Rights Department. California Civil Rights Department – Complaint Process Miss that deadline and the FEHA claim is gone.
For CPRA violations, like an employer ignoring your data access request, failing to provide a collection notice, or refusing to correct inaccurate records, file with the California Privacy Protection Agency.17California Privacy Protection Agency. Complaint Form The CPPA can impose administrative fines per violation, with higher amounts for intentional violations and those involving minors under 16, adjusted annually for inflation.18California Privacy Protection Agency. California Privacy Protection Agency Announces 2025 Increases for Administrative Fines
You can also sue directly. Data breach claims under Civil Code 1798.150 allow statutory damages of $100 to $750 per consumer per incident without proof of a specific dollar loss, though the 30-day cure notice comes first for statutory damages. For broader invasion-of-privacy claims rooted in the state Constitution, you can seek actual damages, including compensation for emotional distress. Violations of Penal Code 632 carry both criminal penalties and a civil remedy. An employment attorney can help you sort out which combination of remedies fits your situation and which deadlines apply.