California Privacy Regulator Launches First Sectoral Audit—Targets Gig Platforms

On July 21, 2026, the California Privacy Protection Agency, now branding itself publicly as CalPrivacy, announced that its Audits Division has launched its first formal privacy audit, focused on gig economy platforms operating in California. The audit is the first in a planned series of “sectoral audits” and will evaluate whether major gig platforms are complying with the California Consumer Privacy Act (CCPA), particularly with respect to consumers’ and workers’ rights to access and control personal information.

Although the audit is directed at app-based transportation, delivery, and task-service platforms, the broader message is important for any business collecting applicant, worker, contractor, geolocation, profiling, performance, biometric, communications data, or automated decision-making technology (ADMT) use in California. CalPrivacy’s focus on gig workers also reinforces a point that employers and workforce platforms should not underestimate: California privacy rights apply not only to traditional consumers, but also to employees, job applicants, and independent contractors.

What is CalPrivacy Focused on with this Audit

CalPrivacy stated that the audit will focus on whether gig platforms are honoring the CCPA’s access and control rights in practice, including whether workers and consumers can meaningfully learn what personal information is collected, how it is used, and with whom it is shared. The agency specifically identified categories of data commonly collected by gig platforms, including precise geolocation data, behavioral and performance metrics, biometric identification data, financial information, and communications records.

The announcement also highlights the use of algorithmic systems that process worker and consumer data to make consequential decisions, such as dispatch assignments, performance ratings, earnings, account status, suspension, and deactivation. CalPrivacy’s Chief Privacy Auditor, Sabrina Ross, framed the right of access as particularly important for gig workers because access to underlying data may affect a worker’s ability to understand or contest decisions that impact their livelihood. This is particularly important to consider in light of the new ADMT rules.

Why This Matters Beyond the Gig Economy

The audit reflects a notable shift from complaint-driven enforcement to proactive, regulator-initiated review. CalPrivacy cited Civil Code section 1798.199.40 as authority for the audit, and that provision directs the agency to administer, implement, and enforce the CCPA, and to appoint a Chief Privacy Auditor to conduct audits of businesses to ensure compliance. The CCPA regulations also provide that the agency may audit a business, service provider, contractor, or person to ensure compliance with any provision of the CCPA, including where processing presents significant risk to consumer privacy or security.

For employers, staffing platforms, marketplaces, and businesses using workforce management technology, the announcement is a reminder that privacy compliance is increasingly tied to employment and operational decision-making. It’s important to ensure workforce populations can exercise their rights. Data subject access request programs that were built primarily for customer-facing requests may not be sufficient for worker-facing requests involving HR systems, performance tools, location tracking, productivity analytics, background check data, communications data, or AI-enabled decision support.

Access Rights Are the Immediate Priority

CalPrivacy’s announcement places particular emphasis on the CCPA right to know and access personal information. The agency stated that the audit will examine whether platforms process access requests within the 45-day statutory window, whether responses are complete, and whether platforms have implemented systems that allow workers to exercise their rights.

Under the CCPA regulations, businesses must generally confirm receipt of requests to delete, correct, or know within 10 business days, and must respond to such requests no later than 45 calendar days after receipt, subject to a possible additional 45-day extension with notice and explanation. The regulations also require businesses to provide appropriate methods for submitting requests to know, delete, and correct, including at least two designated methods for many businesses, one of which must be a toll-free number if the business does not operate exclusively online with a direct consumer relationship.

Practical Takeaways for Businesses

Businesses operating in California, particularly those with platform, marketplace, workforce analytics, HR technology, logistics, mobility, delivery, field service, or contractor-based models, should consider taking the following steps:

1. Pressure-test worker access request workflows. Confirm that employee, applicant, contractor, and gig worker requests are routed, tracked, verified, and answered within CCPA timelines. All intake routes, including any toll-free numbers, should be tested for smooth function. Training for those handling these channels may be indicated.
2. Inventory high-risk worker data. Identify systems that collect geolocation, biometric, productivity, performance, behavioral, financial, communications, dispatch, rating, or account-status data. CalPrivacy expressly identified several of these data types in its gig economy audit announcement.
3. Review completeness of access responses. Ensure responses cover not only obvious profile or account information, but also data held in operational systems, vendor platforms, analytics tools, customer-support records, and decisioning systems where applicable.
4. Assess algorithmic and automated decision-making technology (ADMT) documentation. Businesses should be prepared to explain how personal information is used in decisions affecting work assignments, compensation, ratings, discipline, suspension, or deactivation, especially where algorithmic systems or automated decision-making are involved. Separate ADMT related compliance generally begins January 1, 2027.
5. Check vendor and service provider readiness. Because relevant data may sit with service providers, contractors, or workforce technology vendors, businesses should confirm that contracts, data maps, and operational processes support timely CCPA responses.
6. Prepare for audit-style scrutiny. Even businesses outside the gig sector should assume that CalPrivacy may continue selecting sectors based on perceived risk, complaint volume, sensitive data practices, or high-impact uses of personal information. The agency’s audit regulations permit audits where processing presents significant risk to privacy or security, or where there is a history of noncompliance.

The Bottom Line

CalPrivacy’s first sectoral audit is more than a gig economy enforcement development. It is a signal that California’s privacy regulator is moving into a more proactive phase, with worker data, access rights, and algorithmic decision-making squarely in view.

Businesses should use this development as an opportunity to review whether their CCPA programs work in practice for employees, applicants, independent contractors, and other workforce populations, not just traditional consumers. For companies that collect sensitive or high-volume worker data, the most important question may no longer be whether a privacy policy says the right things, but whether the business can produce complete, timely, and defensible responses when regulators or workers ask to see the underlying data.