We’re Not a Tech Company, So CCPA Doesn’t Apply to Us
Plenty of small California employers assume the California Consumer Privacy Act is a tech-company problem, something for social platforms and ad networks, not a staffing agency, a restaurant group, or a delivery service.
That assumption just got expensive.
On June 21, 2026, California’s privacy agency, CalPrivacy, announced it will begin formal audits of gig economy companies. The audits focus on how these companies handle personal information belonging to their own workforce: job applicants, employees, and independent contractors, not just customers.
Here is the break point. The CCPA has covered workforce data since 2023, once a business crosses roughly $25 million in annual revenue. Many employers built a customer-facing privacy program and stopped there, assuming the HR side of the business didn’t need the same rigor.
It did. Applicants, employees, and contractors have the same rights to know, correct, delete, and opt out of automated decision-making that customers do. A business must confirm a request within 10 business days and respond within 45.
There’s a second, separate obligation sitting on top of that one. Regulations effective January 1, 2026 will, over the next few years and then ongoing, require certain businesses conduct an annual cybersecurity audit and file the results with CalPrivacy under penalty of perjury.
Two different audit exposures, one shared blind spot: a privacy program built for customers that was never extended to the workforce side of the business.
If your privacy policy describes rights and channels for customers but nobody has actually tested what happens when an employee submits a request, that gap is precisely what CalPrivacy’s new gig-economy audits are designed to find.
A short review of your intake channels, response timelines, and whether the cybersecurity audit threshold applies to you now is far less costly than an audit finding later.
Contact Michael Trust Law, APC for a no-charge initial consultation. The facts determine what needs to be addressed — and how much of a conversation that takes.
This post shares general information based on common patterns I see in California workplaces. It is not legal advice, does not create an attorney-client relationship, and outcomes depend on specific facts — no lawyer can guarantee a result. Past results do not guarantee or predict future outcomes. AI may have been used to create this post. All content reviewed by a CA attorney before publication.