California Employee Monitoring Laws: Employer Rules (2026)

California employers face some of the strictest monitoring rules in the country. Labor Code § 980 bars demanding an employee's social media password, Labor Code § 435 bans cameras in restrooms and locker rooms, and the CPRA gives employees of businesses that meet its coverage thresholds CCPA-style notice and access rights over monitoring data since 2023. Two statutes signed on September 30, 2026, Chapter 851 (AB 1331) and Chapter 853 (AB 1883), add a workplace-bathroom surveillance ban and a prohibition on AI tools that read employee emotions or collect neural data, both operative January 1, 2027.

Information last verified on October 1, 2026. This article has not yet been reviewed by a licensed lawyer.

This article covers what California law says specifically about an employer's ability to monitor its employees, as distinct from the general recording-consent rules covered in California Recording Laws and its workplace recording page. This cluster's focus is the employer side: social media password protections, surveillance limits, and how California's privacy statutes now reach employee data.

Jurisdiction scope: This article addresses California state law on employer monitoring of employees, including Cal. Lab. Code § 980 (social media passwords), Cal. Lab. Code § 435 (restroom and locker room recording), the new Labor Code workplace-surveillance provisions added by Chapters 851 and 853 of the Statutes of 2026, and the CPRA's employee-data provisions, together with the federal ECPA baseline. It does not re-derive California's two-party consent recording rules or general GPS-tracking law in depth; for those, see the linked California recording law and GPS tracking law pages.

How Federal and California Recording Law Apply to Employer Monitoring

California is a two-party, or all-party, consent state for recording confidential communications under Penal Code § 632, meaning every participant in a confidential conversation must consent before it can be recorded. This article does not re-derive that framework; for the full rules on consent, penalties, and exceptions, see California Recording Laws and the site's dedicated workplace recording guide.

A separate federal rule governs employer monitoring of business communications specifically. Under the Wiretap Act, the business-extension exemption in 18 U.S.C. § 2510(5)(a) excludes communications equipment a business furnishes and uses "in the ordinary course of business" from the Act's definition of an interception device, so a business that owns its phone or computer system can monitor communications on that system without needing a party's consent at all. The Eleventh Circuit narrowed that exception in Watkins v. L.M. Berry & Co., 704 F.2d 577 (11th Cir. 1983): an employer can monitor a business call, but once a call is identified as personal, continued listening falls outside the exception, and the employer must stop listening as soon as it has determined that the call is personal. In California, this federal exception operates alongside, not instead of, the state's stricter two-party consent rule for confidential communications.

California Has No Dedicated Monitoring Notice Law, But the CPRA Fills Part of the Gap

California has not enacted an electronic-monitoring notice statute in the style of Connecticut, Delaware, New York, or Maine. Instead, the state's principal notice mechanism for employee monitoring runs through its consumer privacy law. The California Consumer Privacy Act and its amendment, the California Privacy Rights Act (CPRA), originally exempted employee and job-applicant data. That exemption expired on January 1, 2023, when the Legislature declined to extend it, and employees of a covered employer now have the same core rights as any other California consumer with respect to their employer's data practices.

Coverage is the threshold question, and it excludes most California employers. Civ. Code § 1798.140(d) defines a "business" as an entity "organized or operated for the profit or financial benefit of its shareholders or other owners" that also meets at least one of three tests: annual gross revenues in excess of $25,000,000, annually buying, selling, or sharing the personal information of 100,000 or more consumers or households, or deriving 50 percent or more of its annual revenues from selling or sharing consumers' personal information. A nonprofit employer of any size, and a for-profit employer that clears none of the three thresholds, is not a CCPA business and owes none of the duties described in this section.

In practice, for an employer that does meet those thresholds, this means providing a notice at collection describing the categories of personal information it collects about employees, including monitoring, surveillance, and location data, and the purposes for which it is used. Employees of such an employer can request to know what has been collected, request deletion of information no longer needed for a disclosed purpose, request correction of inaccurate information, and opt out of the sale or sharing of their personal information. New CPPA regulations add risk-assessment obligations beginning January 1, 2026, for covered employers whose monitoring activities involve significant use of employee data, including any use of automated decision-making technology (ADMT) for a significant employment decision; employers with pre-existing covered activities have until December 31, 2027 to complete an initial assessment, and ADMT-specific notice and opt-out mechanics phase in January 1, 2027.

California's Social Media Password Law

Cal. Lab. Code § 980 prohibits an employer from requiring or requesting that an employee or applicant disclose a username or password for the purpose of accessing personal social media, access personal social media in the employer's presence, or otherwise divulge personal social media content. An employer that retaliates against a worker for refusing, by discharging, disciplining, or threatening to do either, violates the statute, though it can still take a lawful adverse action for other, independent reasons.

Two exceptions matter for employers. First, under subsection (c), an employer may require disclosure of personal social media reasonably believed relevant to investigating allegations of employee misconduct or a violation of law or regulation, but only for use in that investigation or a related proceeding. Second, under subsection (d), the statute does not restrict an employer's ability to require login credentials for a device it actually issued to the employee, such as a company phone or laptop account.

Video and Audio Surveillance Limits: Labor Code 435 and Hernandez v. Hillsides

Cal. Lab. Code § 435 is a bright-line rule: no employer may cause an audio or video recording to be made of an employee in a restroom, locker room, or room designated for changing clothes, unless authorized by a court order. Employee consent cannot substitute for a court order, any recording made in violation cannot be used by the employer for any purpose, and a violation is an infraction. This is one of the clearest statutory limits on workplace surveillance in the country and applies to nearly every private and public employer in the state.

Outside those specifically protected spaces, California courts evaluate workplace video surveillance under a reasonable-expectation-of-privacy and highly-offensive-intrusion standard. The California Supreme Court's decision in Hernandez v. Hillsides, Inc., 47 Cal.4th 272 (2009), remains the leading case: the Court found that two employees had a reasonable expectation of privacy in their shared, closed-door office even though the employer had a legitimate reason (identifying who was accessing inappropriate websites) for installing a hidden camera, but held the employer was not liable because the camera was never activated while the employees were present and the intrusion, on the facts, was not highly offensive to a reasonable person. The case illustrates that a legitimate business reason for surveillance does not eliminate the need to weigh the manner and scope of the intrusion against the employee's privacy interest.

GPS and Vehicle Tracking

California's general anti-tracking statute, Penal Code § 637.7, makes it a misdemeanor to use an electronic tracking device to determine the location or movement of a person. The statute reaches vehicle tracking through its definition of the device rather than its statement of the prohibition: subdivision (d) defines an "electronic tracking device" as any device attached to a vehicle or other movable thing that reveals its location or movement by the transmission of electronic signals. Subdivision (b) then provides that the section does not apply where "the registered owner, lessor, or lessee of a vehicle has consented to the use of the electronic tracking device with respect to that vehicle." Because an employer is typically the registered owner or lessee of its own fleet vehicles, this consent exception is why employers can generally track company-owned vehicles without violating § 637.7. For the fuller rules on GPS and vehicle tracking in California, including how this interacts with personal vehicles and the state's general privacy framework, see California GPS Tracking Laws.

Biometric Monitoring

California does not have an Illinois-style Biometric Information Privacy Act with a standalone private right of action for mishandled fingerprint or facial-recognition data. Biometric identifiers are instead treated as a category of "sensitive personal information" under the CPRA, which gives employees of a covered business the right to limit certain uses of that data and requires the same notice-at-collection and risk-assessment obligations described above when such an employer's monitoring program processes biometric data, such as a fingerprint time clock or facial-recognition access system. Separately, from January 1, 2027, a new Labor Code provision bars an employer from using an AI surveillance tool to collect an employee's neural data or to infer that employee's emotional state, which is discussed in the next section. For more detail on how California defines and protects biometric data generally, see California Biometric Privacy Laws.

Two New Workplace Surveillance Statutes Take Effect January 1, 2027

California enacted its first general restrictions on workplace surveillance tools at the close of the 2026 session. The Governor approved two bills on September 30, 2026 and the Secretary of State chaptered both the same day. Neither enrolled text carries an urgency clause, so both become operative January 1, 2027 under the default rule in article IV, section 8(c) of the California Constitution. One drafting wrinkle is worth flagging: each act purports to add a "Part 5.8" to Division 2 of the Labor Code, so the codifier may renumber one of them. The chapter numbers are the stable identifiers, and the final codified section numbers may differ from the ones in the enrolled bills.

AB 1331 (Elhawary), Chapter 851, Statutes of 2026: bathroom surveillance. AB 1331 adds Labor Code Part 5.8 commencing at section 1560. Section 1561(a) provides that, "Unless directed by a court order, an employer shall not use a workplace surveillance tool to monitor or surveil employees in a bathroom located in the workplace." Section 1561(b)(1) gives an employee the right to leave behind workplace surveillance tools on their person when entering a bathroom. That right has limits: it does not apply where federal or existing state law requires the employee to remain available during a meal or rest period, the employer may still check such tools for the one-time entry and exit of a bathroom, and there is no violation where the employee voluntarily brings a tool in or where an employer policy requires a badge or personal alarm for identification, safety, or bathroom access, provided that device neither records audio or video nor has artificial intelligence embedded in or attached to it. Section 1563 lets the Labor Commissioner and public prosecutors enforce the part, and section 1563(d) sets a penalty of up to five hundred dollars ($500) for each violation.

AB 1331 is not California's first rule about recording in a bathroom, and it does not displace the older one. Labor Code § 435 has banned employer audio and video recording of an employee in a restroom, locker room, or changing room without a court order since 1999, and section 1564(a) of the new part says expressly that the part "is not intended to limit any other state or local law, including, but not limited to, Section 435, that provides equal or greater protection to employees." The two run in parallel and each reaches further than the other in a different direction. Section 435 covers more places, adding locker rooms and changing rooms to restrooms, and it voids the resulting footage for any employer use. AB 1331 covers only the bathroom, but it reaches far more than cameras and microphones: a "workplace surveillance tool" under section 1560(f) includes geolocation, electromagnetic and photoelectronic tracking, continuous incremental time-tracking tools, and biometric collection, so a badge reader or an activity tracker that § 435 never touched is now in scope inside a workplace bathroom. It also carries a monetary penalty, where a § 435 violation is an infraction.

AB 1883 (Bryan), Chapter 853, Statutes of 2026: emotion recognition and neural data. AB 1883 adds Labor Code Part 5.8 commencing at section 1580. Section 1581(a) provides that "An employer shall not use a workplace surveillance tool that uses artificial intelligence on employees for either of the following: (1) Recognizing, or making inferences or predictions about, an individual's emotional state. (2) Collecting neural data." Section 1580(e) defines neural data as information generated by measuring the activity of an employee's central or peripheral nervous system that is not inferred from nonneural information, so an inference drawn from a nonneural source such as keystroke or productivity telemetry is not neural data. Using artificial intelligence on that same telemetry to infer an employee's emotional state is separately barred by paragraph (1).

The exception is narrower than a quick read suggests. Section 1581(b) says the section "does not prohibit an employer from using a workplace surveillance tool to ensure safety, or otherwise if it does not meet the specifications in subdivision (a)." The first clause is a safety carve-out; the second merely restates that a tool doing neither of the two prohibited things is unaffected. Neither clause is a general business-necessity defense for emotion recognition or neural-data collection. A separate exemption in section 1583 covers operations involving the development of aircraft for use in the national airspace or of products or services for national security, military, space, or defense purposes, and it applies only to operations covered by a federal statute, federal regulation, or binding federal contract where the surveillance is reasonably necessary to comply with it. Enforcement tracks AB 1331: the Labor Commissioner or a public prosecutor, injunctive relief and attorney's fees in a civil action, and a penalty of up to $500 per violation under section 1582(d). Both acts define "employer" to include state and local government entities, the University of California, and the California State University, and both declare their subject a matter of statewide concern so that they bind charter cities.

Recent Developments: The Failed Notice Bill and the Meta Example

California's Legislature has repeatedly tried and failed to pass a comprehensive workplace-surveillance notice law. AB 1221, the Workplace Technology Accountability Act, would have required 30 days' written notice before deploying a new workplace surveillance tool and would have barred certain uses of AI-driven monitoring, such as facial or gait recognition, but it failed on February 2, 2026 when it was filed with the Chief Clerk under Joint Rule 56 without advancing out of the Legislature. AB 1331 took the opposite path. It sat on the Senate inactive file from September 13, 2025, was pulled from that file on August 21, 2026, was amended into the workplace-bathroom measure described above, and was signed as Chapter 851. AB 1221 itself never returned, so California still has no general duty to give advance notice before deploying a workplace surveillance tool. The operative rules are the CPRA notice-at-collection framework, Lab. Code §§ 435 and 980, Penal Code § 637.7, and the two new statutes that take effect January 1, 2027.

Real-world monitoring disputes continue to test these boundaries even without new legislation. In 2026, Meta's internal Model Capability Initiative, a program that logged employee keystrokes, mouse activity, and app usage on company devices to train AI models, drew an internal petition from more than 1,600 employees after the company disclosed in June 2026 that sensitive data the program collected, including private prompts and internal discussions, had been broadly accessible inside the company. Meta subsequently paused the program after the security review; reporting on the episode describes no option for employees to opt out of the tracking on company devices. The episode is a useful illustration of the kind of employer monitoring program that California's CPRA notice and risk-assessment rules, and any future legislation modeled on AB 1221, are aimed at.

Disclaimer

This article provides general legal information about employee monitoring law in California as of October 1, 2026. It is not legal advice and does not create an attorney-client relationship. Workplace privacy and employment law involve fact-specific analysis; consult an attorney licensed in California about your specific situation before acting on anything in this article.

Related articles

• Employee Monitoring Laws by State
• California Recording Laws
• California Workplace Recording Laws
• California GPS Tracking Laws
• California Biometric Privacy Laws

---

Last updated: October 1, 2026. Statutes cited reflect their in-force version as of October 1, 2026.

More California Laws

• California AI Meeting Recording Laws
• California At-Will Employment Laws
• California Data Privacy Laws
• California GPS Tracking Laws
• California Recording Laws
• California Whistleblower Laws

Frequently Asked Questions

Does my California employer have to tell me before monitoring my computer?

California has no dedicated electronic-monitoring notice statute, and the CPRA notice duty reaches only employers that qualify as a CCPA 'business': a for-profit entity with more than $25 million in annual gross revenue, or that handles the personal information of 100,000 or more consumers or households, or that makes 50 percent or more of its revenue from selling or sharing personal information. If your employer meets one of those tests, then since the CPRA's employee exemption expired in 2023 it must provide a notice at collection describing what personal information it collects, including through monitoring, and why. A nonprofit employer or a smaller for-profit employer owes no such notice. There is no separate 30-day advance-notice requirement for anyone; a bill that would have added one, AB 1221, failed in February 2026.

Can my employer ask for my Instagram password in California?

No, not for personal use. Cal. Lab. Code § 980 bars an employer from requiring your social media username or password, except when your account is reasonably believed relevant to a misconduct investigation or the account is one the employer itself issued to you.

Can my employer put a camera in the restroom or locker room in California?

No. Cal. Lab. Code § 435 bans employer audio or video recording of employees in restrooms, locker rooms, or changing rooms without a court order, and your consent cannot substitute for one. Any footage recorded in violation cannot be used for any purpose. From January 1, 2027, AB 1331 (Chapter 851, Statutes of 2026) adds a second layer for bathrooms specifically: absent a court order an employer may not use any workplace surveillance tool there, which includes geolocation, badge and activity tracking and not only cameras and microphones, and you have the right to leave such a tool behind when you go in.

Can my California employer use AI to read my emotions or collect brain data?

Not after January 1, 2027. AB 1883 (Chapter 853, Statutes of 2026) bars an employer from using a workplace surveillance tool that uses artificial intelligence either to recognize or make inferences or predictions about an employee's emotional state or to collect neural data, meaning information generated by measuring the activity of the employee's central or peripheral nervous system. The statute allows use of a surveillance tool to ensure safety and exempts certain aerospace and defense operations where a federal statute, regulation, or binding federal contract makes the tool reasonably necessary. The Labor Commissioner or a public prosecutor can enforce it, with a penalty of up to $500 per violation.

Can my California employer install a hidden camera in my office?

It depends on the facts. In Hernandez v. Hillsides, Inc. (2009), the California Supreme Court held employees had a reasonable expectation of privacy in a shared, closed-door office, but found the employer not liable because the camera was never activated while they were present and the intrusion was not highly offensive on those specific facts. Courts weigh the manner and scope of the surveillance against the employee's privacy interest.

Can my employer track a company car with GPS in California?

Generally yes. Penal Code § 637.7 exempts tracking consented to by the vehicle's registered owner, lessor, or lessee, and an employer is typically the registered owner or lessee of its own fleet vehicles. See California GPS Tracking Laws for the fuller framework, including personal-vehicle scenarios.

Do I have a right to see what monitoring data my employer collected about me in California?

Only if your employer qualifies as a CCPA 'business.' Civ. Code § 1798.140(d) limits that term to for-profit entities that also clear at least one threshold: more than $25 million in annual gross revenue, handling the personal information of 100,000 or more consumers or households, or deriving 50 percent or more of revenue from selling or sharing personal information. If your employer meets one of those tests, then since the CPRA's employee exemption expired on January 1, 2023 you have the right to know what personal information, including monitoring and location data, it has collected, and rights to request deletion or correction, subject to the same exceptions that apply to other CCPA/CPRA rights. If you work for a nonprofit or a smaller for-profit employer, the CCPA gives you no such right.