Records calls, in California

Cal. Civ. Code section 1798.81.5, as amended by AB 825 (2021, Ch. 527) · Read the law's page

• This binds a business that owns, licenses, or maintains personal information about a California resident, and by contract extends the same duty to a nonaffiliated third party the business discloses that information to; it exempts a health care provider, plan, or contractor already regulated by the Confidentiality of Medical Information Act, a financial institution subject to the California Financial Information Privacy Act, a covered entity governed by the federal HIPAA medical privacy and security rules, and a business already subject to state or federal law providing greater protection on the same subject, deemed compliant with this duty instead.
• Implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information you own, license, or maintain, to protect it from unauthorized access, destruction, use, modification, or disclosure.
• Covered personal information reaches a name paired with a Social Security, driver's license, state ID, passport, military ID, or tax ID number, a financial account or payment card number with its access code, medical or health insurance information, unique biometric data used to authenticate a person, or genetic data, when either the name or the data element is not encrypted or redacted; it also reaches a username or email address paired with a password or security question that unlocks an online account.
• A customer injured by a violation of this duty may bring a civil action for damages under Civil Code section 1798.84(b); where the violation is a breach of nonencrypted or nonredacted personal information, the CCPA/CPRA's own statutory-damages private right of action, Civil Code section 1798.150, is a separate and further remedy, researched as this jurisdiction's privacy row.

Cal. Penal Code §§ 631, 632, 632.7, 633.5, 637.2 · Read the law's page

• Do not tap or make an unauthorized connection with a telephone or telegraph wire, line, cable, or internal telephonic communication system, or learn or try to learn the contents of a message while it is in transit, without the consent of all parties or other authorization.
• Get the consent of every party before using an electronic amplifying or recording device to eavesdrop on or record a confidential communication, whether the parties are in each other's presence or on a call; a communication is confidential where a party has an objectively reasonable expectation it is not being overheard or recorded, and disclosing that you are listening or recording, so that every party knows it, takes the recording outside this duty.
• Get the consent of every party before intercepting or recording a communication transmitted between a cellular or cordless telephone and another telephone; this reaches you even if you are a party to the call yourself, not only a third party who intercepts it.
• Section 633.5 lets a party record without the others' consent only where the party reasonably believes the recording will produce evidence of extortion, kidnapping, bribery, a violent felony (including human trafficking), a violation of Section 653m, or domestic violence; it is not a business or compliance exception, so get every party's consent for any other recording.
• These duties do not reach a public utility or telephone company, or its officers, employees, or agents, acting to construct, maintain, conduct, or operate its own communications services and facilities; this exemption does not reach a general business messaging its own customers.
• This all-party consent rule reaches a business's routine recording, from an office outside California, of calls with a party in California; the California Supreme Court has not decided how its choice-of-law analysis applies to an isolated personal call recorded from outside California, or to a recording made because of a reasonable, individualized belief that a caller is engaged in wrongdoing.

Cal. Lab. Code Sections 1580 to 1583 (AB 1883, Ch. 853, Stats. 2026) · Read the law's page

• Do not use a workplace surveillance tool that uses artificial intelligence on employees to recognize, or make inferences or predictions about, an individual's emotional state
• Do not use a workplace surveillance tool that uses artificial intelligence on employees to collect neural data, meaning information generated by measuring the activity of an employee's central or peripheral nervous system that is not inferred from nonneural information
• This binds any employer, meaning a person or governmental entity that employs or exercises control over the wages, hours, or working conditions of any person, including state and local government bodies and labor contractors