Makes employment decisions, in California

Cal. Civ. Code section 1798.81.5, as amended by AB 825 (2021, Ch. 527) · Read the law's page

• This binds a business that owns, licenses, or maintains personal information about a California resident, and by contract extends the same duty to a nonaffiliated third party the business discloses that information to; it exempts a health care provider, plan, or contractor already regulated by the Confidentiality of Medical Information Act, a financial institution subject to the California Financial Information Privacy Act, a covered entity governed by the federal HIPAA medical privacy and security rules, and a business already subject to state or federal law providing greater protection on the same subject, deemed compliant with this duty instead.
• Implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information you own, license, or maintain, to protect it from unauthorized access, destruction, use, modification, or disclosure.
• Covered personal information reaches a name paired with a Social Security, driver's license, state ID, passport, military ID, or tax ID number, a financial account or payment card number with its access code, medical or health insurance information, unique biometric data used to authenticate a person, or genetic data, when either the name or the data element is not encrypted or redacted; it also reaches a username or email address paired with a password or security question that unlocks an online account.
• A customer injured by a violation of this duty may bring a civil action for damages under Civil Code section 1798.84(b); where the violation is a breach of nonencrypted or nonredacted personal information, the CCPA/CPRA's own statutory-damages private right of action, Civil Code section 1798.150, is a separate and further remedy, researched as this jurisdiction's privacy row.

Cal. Code Regs. tit. 11, sections 7020 to 7028 and 7060 to 7063 · Read the law's page

• If you operate exclusively online and have a direct relationship with the consumers you collect personal information from, give consumers an email address for requests to delete, correct and know. Every other business must give two or more designated methods, one of them a toll-free telephone number, and a website method such as a webform if you maintain a website (section 7020(a) and (b)).
• Confirm receipt of a request to delete, correct or know within 10 business days, and respond within 45 calendar days of receipt. You may extend once by up to 45 more days if you give the consumer notice and an explanation (section 7021).
• To comply with a request to delete, erase the personal information from your existing systems (archived and backup systems excepted), deidentify it or aggregate it, tell your service providers and contractors to delete it, and notify the third parties you sold or shared it with unless that proves impossible or involves disproportionate effort, in which case give the consumer a detailed explanation (section 7022(b)).
• Do not disclose specific pieces of personal information to a requestor you cannot verify, and tell the requestor that you cannot verify their identity (section 7024(a)).
• Establish, document and comply with a reasonable method for verifying that a person making a request to delete, correct or know is the consumer about whom you hold information (section 7060(a)).
• Do not require a consumer to verify their identity to opt out of sale or sharing or to limit use of sensitive personal information (section 7060(b)).
• If you sell or share personal information, process an opt-out preference signal that is in a commonly used format, and that the sending platform makes clear is meant to opt the consumer out of sale and sharing, as a valid opt-out request (section 7025(b)).
• If you collect personal information online and receive such a signal, treat it as a valid request to opt out for that browser or device and any profile associated with it, including pseudonymous profiles, and do not require the consumer to supply more than is necessary to send the signal (section 7025(c)(1) and (2)).
• Display on your website whether you have processed the consumer's opt-out preference signal as a valid request to opt out of sale or sharing (section 7025(c)(6)).
• If you sell or share personal information, provide two or more designated methods for requests to opt out, which for an online business must include an opt-out preference signal and one other listed method. A cookie banner or cookie controls alone do not count (section 7026(a)).
• If you use or disclose sensitive personal information for purposes beyond those in section 7027(m), provide two or more designated methods for requests to limit (section 7027(b)).
• Take a request to opt in after opting out through a two-step process, a clear request followed by a separate confirmation (section 7028(a)).

Cal. Code Regs. tit. 2, Sections 11008 to 11079, including new Section 11008.1 (Civil Rights Council, approved June 27, 2025) · Read the law's page

• Do not use an automated-decision system or selection criteria, including a qualification standard, employment test, or proxy, that discriminates against an applicant or employee or a class of applicants or employees on a basis protected by the Fair Employment and Housing Act (Section 11009(f))
• Preserve employment records, including selection criteria and automated-decision system data, for four years from the date of the making of the record or the date of the personnel action involved, whichever occurs later (Section 11013(c))
• Treat a test, question, puzzle, game, or other challenge administered through an automated-decision system that is likely to elicit information about a disability as a medical or psychological examination or disability-related inquiry (Section 11071(e))

AB 316 (Ch. 672, Stats. 2025), Cal. Civ. Code Section 1714.46 · Read the law's page

• Do not defend a claim that artificial intelligence you developed, modified, or used caused harm to the plaintiff by arguing that the artificial intelligence autonomously caused the harm; the defense is unavailable (Civil Code Section 1714.46(b)).
• You may still present any other affirmative defense, including evidence relevant to causation or foreseeability, and evidence relevant to the comparative fault of any other person or entity (Section 1714.46(c)).

Cal. Code Regs. tit. 11, Sections 7200 to 7222 · Read the law's page

• If you use automated decisionmaking technology (ADMT) to make a significant decision about a consumer (granting or denying financial or lending services, housing, education enrollment or opportunities, employment or independent-contracting opportunities or compensation, or healthcare services), give the consumer a Pre-use Notice describing that use and the consumer's rights to opt out of and access information about it
• Let a consumer opt out of your use of ADMT to make a significant decision about them, unless you offer an appeal to a human reviewer with authority to overturn the decision or another exception listed in the regulation applies
• When a consumer requests access to your use of ADMT to make a significant decision, respond with a plain-language explanation of the specified information about that use
• If you were already using ADMT for a significant decision before January 1, 2027, come into compliance with these requirements by that date; if you begin such use on or after that date, be in compliance from the start

Cal. Code Regs. tit. 11, sections 7150 to 7157 · Read the law's page

• Before you start processing that presents significant risk to consumers' privacy (selling or sharing personal information, processing sensitive personal information other than for the employment purposes section 7150(b)(2)(A) lists, using automated decisionmaking technology for a significant decision, the inferences about applicants, students, employees, contractors or people in a sensitive location that section 7150(b)(4) and (5) describe, or training automated decisionmaking or facial-recognition or emotion-recognition technology), conduct a risk assessment (section 7150).
• In the risk assessment, document a specific purpose for the processing, the categories of personal information (the minimum necessary), the operational elements of the processing, the benefits, the negative impacts to consumers' privacy and their sources, and the safeguards, and weigh whether the risks outweigh the benefits (section 7152(a)).
• Review and update each risk assessment at least once every three years, and update it as soon as feasible and within 45 calendar days of a material change in the processing (section 7155(a)(2) and (3)).
• For processing you began before January 1, 2026 that continues after that day, complete and document the risk assessment no later than December 31, 2027 (section 7155(b)).
• Retain risk assessments, original and updated, for as long as the processing continues or for five years after completion, whichever is later (section 7155(c)).
• Submit the risk assessment information section 7157(b) lists to the Agency, with an attestation under penalty of perjury from a member of executive management, by April 1, 2028 for assessments conducted in 2026 and 2027 and by April 1 of each later year (section 7157).

Cal. Lab. Code Sections 1400.5, 1401 and 1402.7 (SB 951, Ch. 860, Stats. 2026) · Read the law's page

• When a mass layoff, relocation, or termination at a covered establishment is caused in whole or in substantial part by an AI system or other automated technology replacing or automating employment positions, add to the written notice the number, classification or occupation, and work location of the layoffs substantially due to the replacement or automation
• Include in that notice the job functions performed by the replaced workers that will be automated and the specific category or type of AI system or other automating technology that substantially resulted in the technological displacement
• Put the statement "This notice is for a technology displacement" at the top of that notice

Cal. Lab. Code Sections 1520 to 1526.7 (SB 947, Ch. 859, Stats. 2026) · Read the law's page

• Do not rely solely on an automated decision system when making a disciplinary or termination decision
• If you primarily rely on an automated decision system's output to make a disciplinary or termination decision, direct a human to corroborate the decision using the data collected or used to produce the output or other relevant supporting information, and do not use the output if it cannot be corroborated or the reviewer finds it inaccurate, incomplete, or misleading
• Do not use an automated decision system to prevent compliance with or violate labor, occupational health and safety, employment, or civil rights laws, to infer an employee's protected status, or to predict and take adverse action against a worker for exercising legal rights
• When you primarily used an automated decision system to make a disciplinary or termination decision, give the affected employee a plain-language, stand-alone written postuse notice at the time you tell them of the decision
• On request, give an employee a meaningful, objective description of their own data used by the system when you primarily used it to make a disciplinary or termination decision
• Do not discharge, demote, suspend, or otherwise retaliate against an employee for exercising their rights under this part