Compliance Guide — California
CCPA/CPRA Employee Monitoring Compliance: California Employer Guide for 2026
CCPA/CPRA employee monitoring compliance is the set of legal obligations California employers carry when collecting digital work activity data from employees. Since January 1, 2023, the California Privacy Rights Act has extended full consumer-level privacy rights to workers, meaning every productivity log, screenshot, app usage record, and AI-generated performance score is subject to notice, access, and deletion rules with teeth. This guide explains every obligation, what changed with AB 1008 in 2025, and how to configure your monitoring platform to stay compliant.
7-day free trial. No credit card required.
What Is CPRA Employee Monitoring Compliance?
CPRA employee monitoring compliance is the practice of collecting, retaining, and managing employee work-activity data in accordance with the California Privacy Rights Act (Civil Code Sections 1798.100 et seq.). The CPRA, which took full effect for employee data on January 1, 2023, closed the workforce exemption that had existed under the original California Consumer Privacy Act (CCPA) and made California employees data subjects with the same rights as any consumer. Employers should review California employee monitoring laws alongside CPRA, as they impose additional disclosure obligations under AB 984.
Before 2023, California employers could monitor employee digital activity with relatively few restrictions under state privacy law. The CPRA ended that era. Employers covered by the law must now treat employee monitoring data the same way they treat customer data: issuing privacy notices before collection, responding to access requests within 45 days, honoring deletion requests where no legal exception applies, and correcting inaccurate records on request.
Who must comply: The CPRA applies to for-profit businesses that meet any one of three thresholds: (1) annual gross revenues above $25 million; (2) buy, sell, or share the personal information of 100,000 or more consumers or households annually; or (3) derive 50% or more of annual revenues from selling or sharing consumer personal information. For most employers with California-based workers, the $25 million revenue threshold is the relevant trigger. Nonprofit organizations are generally excluded, though they may face obligations under other California statutes.
What Monitoring Data Is Personal Information Under CPRA?
CPRA defines personal information broadly as any information that identifies, relates to, describes, or is reasonably capable of being associated with a particular individual. For employee monitoring platforms, this covers app usage logs, website visit records, time-on-task data, productivity scores, idle time records, keystroke intensity patterns, screenshot metadata, screen recording files, geolocation data (if GPS tracking is used), and any AI-derived behavioral assessments tied to an identifiable employee. Truly aggregated data that cannot be re-linked to an individual is excluded from CPRA's scope.
Sensitive personal information under CPRA: The act creates a higher-protection category called "sensitive personal information," which includes precise geolocation, biometric data, health information, and data about a person's private communications. Employers using GPS-based monitoring or biometric timeclocks must apply additional protections to this data, including a separate "Limit the Use of My Sensitive Personal Information" disclosure option.
The 5 Core CPRA Obligations for California Employers Who Monitor Employees
The CPRA imposes five distinct categories of obligation on employers who collect employee monitoring data. Each one requires a deliberate policy decision and, in most cases, a technical control in your monitoring platform.
1. Privacy Notice at Collection
CPRA requires employers to provide a privacy notice at or before the time personal information is collected. For monitoring purposes, this means employees must receive a written disclosure before monitoring begins — not buried in an employee handbook, but delivered as a standalone document that the employee acknowledges. The notice must describe the categories of data collected (e.g., app usage logs, productivity scores, screenshots), the specific business purposes for collection, the retention period for each data category, and whether the data is shared with third-party processors or analytics vendors.
A notice delivered on day one of employment that merely states "the company may monitor computer activity" does not satisfy CPRA. The law requires specificity. Courts and the California Privacy Protection Agency (CPPA) have indicated that vague notices create enforcement exposure even where monitoring itself is lawful.
2. Right to Know
California employees have the right to request that an employer disclose what personal information has been collected about them, the categories of sources from which it was collected, the business purposes for collection, and any third parties with whom the data has been shared. Employers must respond within 45 calendar days, extendable by an additional 45 days if the request is complex or numerous requests have been received. The employer must also inform the employee if no data has been collected — a non-response to a right-to-know request is itself a violation.
For monitoring data specifically, this means that if an employee submits a right-to-know request, the employer must be prepared to produce the employee's productivity records, app usage history, screenshot logs, AI-generated performance assessments, and any other monitoring data tied to that individual. The practical implication: your monitoring platform must support individual-level data exports filtered by employee and date range.
3. Right to Delete
Employees may request deletion of their personal information, including monitoring records, once that data is no longer needed for the purpose for which it was collected. Employers may decline deletion requests under several enumerated exceptions: completing a transaction, fulfilling a legal obligation, maintaining records required by other laws (such as FLSA timekeeping records or HIPAA records for clinical staff), detecting security incidents, or when retention is necessary to protect against malicious, deceptive, or illegal conduct. Importantly, "we might need it someday" is not a valid exception. Each retained record needs a specific, documented justification tied to one of the statutory exceptions.
Practical guidance: establish a written data retention schedule by data category before your first employee submits a deletion request. A retention schedule of 90 days for standard productivity logs, 12 months for performance-related records, and 36 months for records tied to legal investigations is a defensible baseline for most employers. Retain records tied to the FLSA minimum (3 years for non-exempt employee time records) where applicable.
4. Right to Correct Inaccurate Personal Information
CPRA added a right to correct inaccurate personal information that did not exist under the original CCPA. For employee monitoring, this right is most likely to be invoked for productivity scores that an employee believes do not accurately reflect their actual work output, attendance records that show incorrect clock-in or clock-out times, and AI-generated performance assessments that the employee disputes as inaccurate. Employers must investigate correction requests and either correct the data or explain why the data is accurate. Ignoring correction requests is a CPRA violation.
The correction right creates an interesting operational tension: if your monitoring platform produces an AI-derived productivity score, and an employee disputes it, you need to be able to explain the algorithm's inputs and logic to justify the score. This is also now a requirement under AB 1008, described below.
5. Opt-Out Rights for Data Sharing
CPRA requires employers to provide employees with an opt-out mechanism for the "sale" or "sharing" of their personal information. Sale under CPRA includes exchanging personal information for valuable consideration, and sharing includes making personal information available to third parties for cross-context behavioral advertising. Most monitoring data sharing with analytics vendors or HR platforms falls under the "service provider" exception — meaning if the vendor is contractually prohibited from using the data for any purpose other than performing services for the employer, the transfer is not a "sale" under CPRA. However, if employee monitoring data flows to a platform that aggregates workforce analytics across clients, or to a vendor that may use the data for its own product development, that transfer likely constitutes sharing under CPRA and requires an opt-out mechanism.
AB 1008 (2025): How California's AI Law Affects Employee Monitoring Scores
AB 1008, signed into law in 2025, extends CPRA's protections explicitly to AI-generated employee assessments. The law was a direct legislative response to the growing use of algorithmic monitoring tools that produce productivity scores, risk scores, and behavioral classifications from raw monitoring data without any human review.
What Is an "AI-Generated Employee Assessment" Under AB 1008?
AB 1008 defines an AI-generated employee assessment as any automated decision or score derived from employee data using machine learning, algorithmic processing, or predictive analytics, where the output influences decisions about hiring, promotion, compensation, discipline, or termination. For monitoring platforms, this captures automated productivity scores, behavioral risk flags generated by anomaly detection systems, attrition risk scores derived from activity patterns, and performance ratings calculated by AI rather than managers.
The practical implication is significant: if your monitoring platform produces a productivity score, a risk flag, or any AI-derived classification tied to an individual employee's data, that output is now personal information subject to CPRA's full rights framework, including the right to know, the right to correct, and the right to explanation.
The Right to Explanation for AI Assessments
AB 1008 adds an obligation not present in the original CPRA: when an employee requests information about an AI-generated assessment that influenced an employment decision, the employer must disclose the significant factors the AI system considered and their relative weights. You cannot simply say "the system gave you a 62% productivity score." You must be able to explain that the score was based on, for example, 40% active app time, 25% task completion rate, 20% idle time ratio, and 15% website classification breakdown, with the thresholds used for each component.
Employers whose monitoring platforms produce black-box AI scores without transparent, auditable logic face the highest AB 1008 risk. Before deploying any AI-powered monitoring feature, confirm that the vendor can provide a detailed methodology document and that the platform logs the inputs used to generate each employee's score.
Disclosure Requirements for AI Monitoring Under AB 1008
Employers must update their CPRA privacy notices to disclose when AI systems are used to generate employee assessments. The updated notice must describe: (1) the categories of data used as inputs to AI assessments, (2) the types of assessments produced, (3) how those assessments are used in employment decisions, and (4) the employee's right to request explanation and correction. Notices that pre-date AB 1008's effective date and do not address AI assessment are non-compliant regardless of when they were originally issued.
CPRA Enforcement: What California Employers Are Facing in 2026
The California Privacy Protection Agency (CPPA) began active enforcement of CPRA in 2023 and has accelerated its pace of enforcement actions since. The CPPA is an independent agency with subpoena authority, the power to conduct audits, and the ability to impose fines without first going to court.
CPRA Fine Structure
CPRA penalties are per-violation, not per-incident. Unintentional violations carry a maximum fine of $2,500 per violation. Intentional violations carry a maximum fine of $7,500 per violation. There is no statutory cap on total fines in a single enforcement action. For a company with 200 California employees, each of whom received an inadequate privacy notice, that is potentially 200 separate violations at $2,500 each, totaling $500,000 in fines for a single deficiency. The CPPA also has authority to require remediation and compliance audits as conditions of settlement.
The Attorney General retains concurrent enforcement authority and has brought actions against employers for CCPA violations since 2020. From 2023 forward, both the CPPA and the AG can pursue CPRA violations independently, effectively doubling employer exposure to regulatory scrutiny.
High-Risk Employer Behaviors the CPPA Is Targeting
CPPA enforcement guidance and public statements identify several high-priority targets: (1) employers who collect employee monitoring data without any written privacy notice; (2) companies that fail to respond to employee right-to-know requests within the 45-day window; (3) organizations that retain monitoring data indefinitely without a documented retention schedule; and (4) employers using AI-based monitoring tools whose privacy notices do not disclose AI-generated assessments. The CPPA has also indicated interest in vendors who aggregate employee monitoring data across employer accounts for their own analytics purposes, which constitutes a "sale" under CPRA that employers must disclose and permit opt-out of.
Private Right of Action
Unlike the GDPR, CPRA does not grant employees a broad private right of action for most violations. Employees cannot sue for a failed right-to-know response or an inadequate privacy notice. However, CPRA Section 1798.150 does provide a private right of action specifically for data breaches caused by a failure to implement reasonable security measures. If an employer's monitoring data is breached due to inadequate security and that data includes sensitive personal information, affected employees can seek statutory damages of $100 to $750 per consumer per incident, or actual damages if higher. For a 500-person workforce, a single breach event could generate $375,000 in statutory damages at the minimum end, without any showing of actual harm.
How to Build a CPRA-Compliant Employee Monitoring Program: Step-by-Step
CPRA compliance for employee monitoring is not a one-time checkbox exercise. It is an ongoing operational practice that requires coordinated action across legal, HR, IT, and management. The following steps represent the minimum required for a defensible compliance posture in 2026.
Step 1: Conduct a Data Mapping Audit
Before you can write a compliant privacy notice, you need to know exactly what your monitoring platform collects. A data mapping audit documents every category of personal information collected through monitoring tools, the specific data elements within each category, the business purpose for each category, where the data is stored, how long it is retained, who within the organization can access it, and whether any of it flows to third-party vendors. For most organizations using a modern monitoring platform, the audit will reveal 8 to 15 distinct data categories ranging from basic login timestamps to AI-generated productivity scores.
Step 2: Draft and Deliver a Privacy Notice at Collection
Using the data mapping results, draft a written privacy notice that covers every collected data category. The notice must meet CPRA's specificity requirements: it cannot describe monitoring in generic terms. It must name the data types ("app usage logs showing application name, category, and time spent"), the purposes ("workforce productivity measurement and security incident investigation"), the retention periods ("productivity logs retained 90 days; security investigation records retained for the duration of the investigation plus 12 months"), and any third-party vendors who receive the data. Deliver this notice to every California employee before monitoring begins. New hires should receive it as part of day-one onboarding, and existing employees must receive updated versions whenever the scope of monitoring changes materially.
Step 3: Establish a Rights Request Workflow
CPRA requires a designated method for employees to submit rights requests. This is typically a secure web form, a dedicated email address, or a portal within your HR system. The workflow must be capable of routing requests to the appropriate data custodian, triggering a 45-day response clock, and generating documentation of the response for compliance records. Assign clear internal ownership: the most common failure point in CPRA compliance is not the policy itself but the absence of a human being with defined responsibility for managing incoming employee rights requests.
Step 4: Configure Retention Controls in Your Monitoring Platform
Retention periods disclosed in your privacy notice must be enforced technically, not just stated on paper. Configure your monitoring platform to automatically delete data after the stated retention period expires. Most enterprise monitoring tools support configurable retention windows. Standard configurations for a defensible CPRA posture: productivity metrics and app usage logs deleted after 90 days; screenshots and screen recordings deleted after 30 days unless flagged for an active investigation; investigation-related records retained for the duration plus 12 months; time records subject to FLSA retained for 36 months.
Step 5: Update Vendor Agreements
Every third-party vendor that receives employee monitoring data must sign a CPRA-compliant data processing agreement (DPA). The DPA must prohibit the vendor from using the data for any purpose other than providing services to your organization, require the vendor to implement reasonable security measures, and require the vendor to assist you in responding to employee rights requests. If a vendor refuses to sign a DPA or insists on the right to use employee data for its own purposes, that transfer is likely a "sale" under CPRA requiring employee opt-out mechanisms and explicit disclosure.
Step 6: Address AI Assessment Disclosure Under AB 1008
Audit every feature in your monitoring platform that generates a score, rating, flag, or classification derived from employee data. For each such feature, obtain documentation from the vendor describing the algorithm's inputs, logic, and output range. Update your privacy notice to disclose the existence of AI-generated assessments, the data used as inputs, and the employee's right to request explanation and correction. Establish an internal process for handling employee correction requests for AI scores, including a pathway for human review of disputed assessments.
How eMonitor Supports CPRA Employee Monitoring Compliance
eMonitor is designed with privacy-first defaults that align with California's employer obligations under CPRA. The platform's architecture reflects several key compliance requirements, though it does not replace legal counsel or a formal compliance program.
Work-Hours-Only Monitoring
eMonitor monitors employee activity only during defined work hours. Monitoring begins when the employee clocks in and stops when they clock out. This architectural choice reduces the scope of personal information collected and the associated CPRA compliance burden. Off-hours monitoring of company devices is one of the highest-risk areas under CPRA, as it is more likely to capture sensitive personal information unrelated to work. By default, eMonitor does not capture any data outside of active work sessions.
Configurable Data Retention Policies
eMonitor supports configurable retention windows at the administrator level. Administrators can set different retention periods for different data categories — for example, retaining productivity scores for 90 days while retaining time records for 36 months to satisfy FLSA requirements. When a retention window expires, the platform automatically deletes the associated records. This technical enforcement of retention policies is the most reliable way to prevent data from persisting beyond its disclosed retention period.
Employee-Facing Access Dashboards
Every eMonitor employee has access to their own monitoring data through a personal dashboard. This dashboard shows the employee's own productivity scores, app usage breakdown, time records, and attendance history. When an employee submits a CPRA right-to-know request, the monitoring data component of the response can be fulfilled directly by directing the employee to their dashboard and generating a data export for the requested period. This self-service model reduces the administrative burden on HR and IT teams managing rights requests.
Role-Based Access Controls for Monitoring Data
eMonitor enforces role-based access controls that limit which administrators and managers can view which employees' monitoring data. A regional sales manager can view their direct reports' data but cannot access data for employees in other departments. This principle of minimum necessary access is a CPRA best practice for limiting the exposure of employee personal information within the organization. Access logs are maintained for all data views and exports, supporting accountability requirements under CPRA.
Data Export for Rights Request Fulfillment
eMonitor generates individual employee data exports in structured formats that can be provided in response to CPRA access and portability requests. The export includes all monitoring data categories tied to the employee during the requested period, formatted for human review. This capability is essential for meeting the 45-day response window for right-to-know requests without requiring manual data extraction from the platform's backend.
How Does CPRA Compare to GDPR for Employee Monitoring?
California employers with operations or employees outside the United States frequently ask whether CPRA compliance also satisfies GDPR. The answer is: partially, but not fully. GDPR's influence on US privacy law is evident in CPRA's data subject rights structure, but the two laws differ meaningfully in scope, legal basis requirements, and enforcement mechanisms.
| Dimension | CPRA (California) | GDPR (EU/UK) |
|---|---|---|
| Geographic scope | California employees and consumers | EU/UK resident employees regardless of employer location |
| Legal basis for monitoring | Notice at collection; no consent required for most monitoring | Legitimate interest, legal obligation, or explicit consent required; balancing test mandatory |
| Privacy notice | Required at or before collection; must specify categories, purposes, retention | Required; must also state legal basis, DPO contact, and right to lodge complaint with supervisory authority |
| Right to access | 45-day response window | 30-day response window (one-month) |
| Right to delete | Yes, with enumerated exceptions | Right to erasure, with exceptions; stronger employee protections in practice |
| AI assessment rules | AB 1008 (2025) — disclosure and correction rights | GDPR Article 22 — right not to be subject to solely automated decisions with significant effects |
| Maximum fine | $7,500 per intentional violation | 4% of global annual turnover or €20 million, whichever is greater |
| Private right of action | Limited to data breaches only | Broad; individuals can seek compensation for any GDPR violation causing damage |
| DPO requirement | None | Required for large-scale systematic employee monitoring |
Employers with both California and EU employees typically need separate compliance programs. GDPR's consent and legitimate interest requirements impose stricter pre-collection obligations, while CPRA's notice-at-collection approach is operationally simpler but still requires significant documentation. Building a monitoring program that satisfies GDPR generally comes close to satisfying CPRA, but the reverse is not true — a CPRA-compliant program is not automatically GDPR-compliant.
The 6 Most Common CPRA Employee Monitoring Compliance Mistakes
CPPA enforcement actions and compliance audits consistently identify the same recurring failures. Understanding these common mistakes is more operationally useful than reviewing the statute in the abstract.
Mistake 1: Using a Vague Monitoring Disclosure in the Employee Handbook
A sentence in the employee handbook stating that "the company may monitor computer activity" does not satisfy CPRA's notice-at-collection requirement. CPRA requires a specific, standalone notice delivered at or before collection that names the data categories, purposes, retention periods, and vendor sharing. Handbook language that is generally about company policies is not the functional equivalent of a CPRA privacy notice.
Mistake 2: Failing to Update the Privacy Notice When Monitoring Scope Expands
Employers who deploy a monitoring platform, issue a privacy notice, and then activate additional features (screen recording, AI productivity scoring, GPS tracking) without updating the notice are exposed to CPRA violations for the newly collected data categories. Each material expansion of monitoring scope requires a notice update and re-delivery to affected employees before the new collection begins.
Mistake 3: No Formal Rights Request Process
The CPPA has identified the absence of a functional rights request mechanism as a standalone violation. An employer who has a privacy notice but no documented process for receiving and responding to employee access, deletion, and correction requests is non-compliant. The response mechanism must be clearly communicated to employees and must actually work — test it before the first real request arrives.
Mistake 4: Indefinite Data Retention
Many monitoring platforms default to retaining all data indefinitely unless an administrator configures a retention window. Employers who accept default settings without configuring retention controls often retain years of employee monitoring data for which there is no current business purpose. CPRA requires data to be deleted once the stated purpose is fulfilled, and retention without purpose is an independent violation.
Mistake 5: Overlooking AI-Generated Assessments Under AB 1008
Employers who deployed AI-powered monitoring features before AB 1008 and have not updated their privacy notices to reflect AI assessment data are non-compliant as of the law's effective date. Review every scoring, flagging, or classification feature in your monitoring platform and ensure each one is disclosed in the current version of your privacy notice with inputs, purpose, and correction rights described.
Mistake 6: No Vendor Data Processing Agreements
Every third-party vendor that receives employee monitoring data must be covered by a CPRA-compliant DPA. Employers who share monitoring data with analytics platforms, HR systems, or productivity benchmarking services without a signed DPA restricting the vendor's use of that data are potentially exposing employees' personal information to uses not disclosed in the privacy notice. This creates CPRA liability and, if the vendor uses the data for cross-context behavioral advertising or sells it, may require the employer to provide an opt-out mechanism.
CPRA Employee Monitoring Compliance Checklist for 2026
Use this checklist to assess the current state of your compliance program and identify gaps requiring immediate attention.
- ☐ Data mapping audit completed and documented for all monitoring data categories
- ☐ CPRA privacy notice delivered to all California employees before monitoring begins
- ☐ Privacy notice updated to disclose AI-generated assessments under AB 1008
- ☐ Written rights request procedure in place with a designated intake method
- ☐ 45-day response clock tracking implemented for all incoming rights requests
- ☐ Data retention windows configured in monitoring platform and enforced technically
- ☐ CPRA-compliant DPAs signed with all monitoring data vendors
- ☐ Vendor sharing assessed for "sale" or "sharing" classification under CPRA
- ☐ Sensitive personal information (GPS, biometrics) subject to additional protections
- ☐ Role-based access controls limiting monitoring data visibility to authorized personnel
- ☐ AI assessment methodology documentation obtained from monitoring platform vendor
- ☐ Process for employee correction requests for AI-generated scores established
- ☐ Annual compliance review scheduled to catch regulatory updates
Disclaimer: This checklist is provided for informational purposes only and does not constitute legal advice. California privacy law is complex and evolving. Consult qualified employment counsel to assess your organization's specific compliance obligations under the CPRA and related statutes.
CCPA/CPRA Employee Monitoring Compliance: Frequently Asked Questions
Does the CPRA apply to employees in California?
Yes. The California Privacy Rights Act (CPRA), fully effective January 1, 2023, extended consumer-level privacy rights to California employees. Employers meeting the law's thresholds — most commonly annual gross revenue above $25 million — must comply with CPRA employee data obligations, including privacy notices before collecting monitoring data and responding to employee rights requests within 45 days.
What employee monitoring data is covered by CPRA?
CPRA covers all personal information collected about California employees, including app usage logs, website activity records, screenshots, keystroke intensity data, productivity scores, GPS location data, and behavioral analytics. Aggregated, de-identified data sets that cannot reasonably be re-linked to an individual fall outside CPRA's scope, but most monitoring platforms produce individually attributable records that are squarely within it.
What must a California employer include in a monitoring privacy notice?
A CPRA-compliant monitoring privacy notice must describe the categories of personal information collected, the business purposes for collection, retention periods, whether the data is shared with third-party vendors, and how employees submit rights requests. The notice must be delivered before or at the time of collection. Vague handbook language does not satisfy CPRA's specificity requirements.
Can employees request deletion of monitoring data under CPRA?
Yes. California employees have the right to request deletion of personal information collected through monitoring. Employers may deny deletion for data needed to fulfill legal obligations, complete ongoing transactions, detect security incidents, or maintain records required by other laws such as FLSA or HIPAA. The employer must respond within 45 days, with a 45-day extension available if the request is complex.
What does AB 1008 (2025) add to CPRA for employee monitoring?
AB 1008, effective 2025, extends CPRA protections to AI-generated employee assessments. Automated productivity scores, AI-derived performance ratings, and algorithmic risk flags are now subject to the same notice, access, and correction rights as other personal data. Employers using AI-powered monitoring tools must disclose AI assessment data in their privacy notices and respond to employee requests to review or correct AI-generated scores.
What is the penalty for CPRA violations involving employee monitoring data?
The California Privacy Protection Agency (CPPA) can issue fines of $2,500 per unintentional violation and $7,500 per intentional violation, with no cap on total fines per enforcement action. The CPPA has actively pursued employers since 2023, with multiple enforcement settlements exceeding $1 million. Employees lack a private right of action for most CPRA violations, except for data breaches caused by inadequate security measures.
Does CPRA require consent before monitoring California employees?
CPRA does not require employee consent for monitoring in most cases, but it does require a privacy notice at or before the time of data collection describing what is collected, why, and for how long. California Labor Code Section 980 separately prohibits employers from requiring employees to disclose personal social media credentials, but does not restrict workplace system monitoring with proper notice.
How long can employers retain employee monitoring data under CPRA?
CPRA requires employers to disclose retention periods in the privacy notice and to delete data once the stated purpose is fulfilled. A defensible baseline is 90 days for standard productivity logs, 12 months for performance-related records, and 36 months for records subject to FLSA retention requirements. Retaining data longer than disclosed without updating the notice is independently a CPRA violation.
Is sharing employee monitoring data with vendors a "sale" under CPRA?
CPRA defines "sale" broadly to include sharing personal information for valuable consideration. Sharing under a data processing agreement with a vendor contractually prohibited from independent use of the data is not a "sale" under CPRA. However, if the vendor aggregates employee monitoring data across clients or uses it for its own product development, that transfer likely constitutes sharing under CPRA and requires an opt-out mechanism and explicit disclosure.
How does eMonitor help California employers comply with CPRA?
eMonitor supports CPRA compliance through configurable data retention policies that auto-delete monitoring records after defined periods, employee-facing access dashboards that fulfill right-to-know requests, role-based access controls limiting who can view personal monitoring data, and data export tools for responding to portability requests. The platform's work-hours-only monitoring restricts collection to active work sessions, reducing the scope of personal data requiring CPRA management.
What is the difference between CCPA and CPRA for employers?
CCPA (effective 2020) originally contained a partial employee exemption that expired January 1, 2023. CPRA, which amended CCPA, removed that exemption and made employees full data subjects. CPRA also created the California Privacy Protection Agency as an independent enforcement body, added the right to correct inaccurate data, and extended AB 1008 protections to AI-generated employee assessments in 2025.
Related Compliance Resources
California Employee Monitoring Laws
Full guide to California workplace monitoring requirements, including Labor Code Section 980 and AB 984 notification rules.
Read the guide →GDPR Employee Monitoring Compliance
Legal basis requirements, DPIA obligations, and legitimate interest assessments for monitoring EU and UK employees.
Read the guide →Compliance Hub
All compliance guides for employee monitoring across GDPR, HIPAA, CCPA/CPRA, SOC 2, and state-specific regulations.
Explore compliance →