Processes voice recordings, in California

Cal. Bus. and Prof. Code sections 22948.20 to 22948.25 · Read the law's page

• If you provide the operation of a voice recognition feature on a connected television in California, prominently inform either the user or the person the user designated to perform the setup, during the initial setup or installation of the television.
• Do not sell, or use for any advertising purpose, actual recordings of spoken word collected through a voice recognition feature to improve that feature, whether you are the television's manufacturer or a third party contracting with the manufacturer.
• The chapter reaches a connected television, a home-use video device with an integrated screen that exceeds 12 inches, and leaves out a personal computer, a portable device and a separate device such as a set-top box, game console or digital video recorder. A voice command that is not recorded or transmitted beyond the television is not a voice recognition feature.
• A manufacturer answers only for functionality provided at the time of the original sale, not for applications the user chooses to use in the cloud or downloads and installs, and the chapter does not apply to a product or service provided by a company covered under Penal Code section 637.5.

Cal. Civ. Code section 1798.81.5, as amended by AB 825 (2021, Ch. 527) · Read the law's page

• This binds a business that owns, licenses, or maintains personal information about a California resident, and by contract extends the same duty to a nonaffiliated third party the business discloses that information to; it exempts a health care provider, plan, or contractor already regulated by the Confidentiality of Medical Information Act, a financial institution subject to the California Financial Information Privacy Act, a covered entity governed by the federal HIPAA medical privacy and security rules, and a business already subject to state or federal law providing greater protection on the same subject, deemed compliant with this duty instead.
• Implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information you own, license, or maintain, to protect it from unauthorized access, destruction, use, modification, or disclosure.
• Covered personal information reaches a name paired with a Social Security, driver's license, state ID, passport, military ID, or tax ID number, a financial account or payment card number with its access code, medical or health insurance information, unique biometric data used to authenticate a person, or genetic data, when either the name or the data element is not encrypted or redacted; it also reaches a username or email address paired with a password or security question that unlocks an online account.
• A customer injured by a violation of this duty may bring a civil action for damages under Civil Code section 1798.84(b); where the violation is a breach of nonencrypted or nonredacted personal information, the CCPA/CPRA's own statutory-damages private right of action, Civil Code section 1798.150, is a separate and further remedy, researched as this jurisdiction's privacy row.

Cal. Code Regs. tit. 11, sections 7150 to 7157 · Read the law's page

• Before you start processing that presents significant risk to consumers' privacy (selling or sharing personal information, processing sensitive personal information other than for the employment purposes section 7150(b)(2)(A) lists, using automated decisionmaking technology for a significant decision, the inferences about applicants, students, employees, contractors or people in a sensitive location that section 7150(b)(4) and (5) describe, or training automated decisionmaking or facial-recognition or emotion-recognition technology), conduct a risk assessment (section 7150).
• In the risk assessment, document a specific purpose for the processing, the categories of personal information (the minimum necessary), the operational elements of the processing, the benefits, the negative impacts to consumers' privacy and their sources, and the safeguards, and weigh whether the risks outweigh the benefits (section 7152(a)).
• Review and update each risk assessment at least once every three years, and update it as soon as feasible and within 45 calendar days of a material change in the processing (section 7155(a)(2) and (3)).
• For processing you began before January 1, 2026 that continues after that day, complete and document the risk assessment no later than December 31, 2027 (section 7155(b)).
• Retain risk assessments, original and updated, for as long as the processing continues or for five years after completion, whichever is later (section 7155(c)).
• Submit the risk assessment information section 7157(b) lists to the Agency, with an attestation under penalty of perjury from a member of executive management, by April 1, 2028 for assessments conducted in 2026 and 2027 and by April 1 of each later year (section 7157).

Cal. Penal Code §§ 631, 632, 632.7, 633.5, 637.2 · Read the law's page

• Do not tap or make an unauthorized connection with a telephone or telegraph wire, line, cable, or internal telephonic communication system, or learn or try to learn the contents of a message while it is in transit, without the consent of all parties or other authorization.
• Get the consent of every party before using an electronic amplifying or recording device to eavesdrop on or record a confidential communication, whether the parties are in each other's presence or on a call; a communication is confidential where a party has an objectively reasonable expectation it is not being overheard or recorded, and disclosing that you are listening or recording, so that every party knows it, takes the recording outside this duty.
• Get the consent of every party before intercepting or recording a communication transmitted between a cellular or cordless telephone and another telephone; this reaches you even if you are a party to the call yourself, not only a third party who intercepts it.
• Section 633.5 lets a party record without the others' consent only where the party reasonably believes the recording will produce evidence of extortion, kidnapping, bribery, a violent felony (including human trafficking), a violation of Section 653m, or domestic violence; it is not a business or compliance exception, so get every party's consent for any other recording.
• These duties do not reach a public utility or telephone company, or its officers, employees, or agents, acting to construct, maintain, conduct, or operate its own communications services and facilities; this exemption does not reach a general business messaging its own customers.
• This all-party consent rule reaches a business's routine recording, from an office outside California, of calls with a party in California; the California Supreme Court has not decided how its choice-of-law analysis applies to an isolated personal call recorded from outside California, or to a recording made because of a reasonable, individualized belief that a caller is engaged in wrongdoing.

Cal. Lab. Code Sections 1580 to 1583 (AB 1883, Ch. 853, Stats. 2026) · Read the law's page

• Do not use a workplace surveillance tool that uses artificial intelligence on employees to recognize, or make inferences or predictions about, an individual's emotional state
• Do not use a workplace surveillance tool that uses artificial intelligence on employees to collect neural data, meaning information generated by measuring the activity of an employee's central or peripheral nervous system that is not inferred from nonneural information
• This binds any employer, meaning a person or governmental entity that employs or exercises control over the wages, hours, or working conditions of any person, including state and local government bodies and labor contractors