WorkAuditor Blog

Employee monitoring in California is a different sport from the rest of the country. The state combines the strictest call-recording rules in the nation, an invasion-of-privacy statute that has produced class actions over tracking software, and a consumer privacy law that now treats employees like consumers. If you have a single remote employee in California, these rules apply to you — whether your company is in San Francisco or San Antonio.

A startup client with ten employees, one of them in Sacramento, discovered this the hard way: their monitoring tool's audio recording feature, which was harmless in their home state, created a wiretap exposure in California on day one.

Why California is different

The California Invasion of Privacy Act (CIPA) — California Penal Code sections 631, 632, and 632.7 — is the core of the state's approach. It prohibits intercepting communications and recording confidential conversations without consent from all parties. California is an all-party consent state, so an employer who records audio without each participant's knowledge faces criminal penalties, civil damages, and attorney's fees.

The statute's bite for employers has deepened recently: California courts have allowed class actions over tracking software — including workplace tools — to proceed on the theory that silently capturing what employees type and see constitutes unlawful interception. The litigation trend is unambiguous, and the notice requirement is its centerpiece: employees must be told, in advance and in detail, that monitoring is happening.

The recording rule: no silent audio

If your tool records calls or ambient audio, California requires every party's consent before recording starts. Practical consequences:

• Announce that calls are recorded at the start of every call.
• Include recording in your monitoring consent documentation.
• Consider disabling audio capture entirely for California employees — the configuration most employers choose.

What the notice itself must contain

California doesn't recognize "we may monitor" as sufficient disclosure. The notice should state, in plain language:

• Exactly what is collected: screens, keystrokes, applications, websites, time tracking.
• Why it's collected and who will see it.
• How long data is retained and how it's deleted.
• How employees can access data about themselves.

Court decisions and the CCPA/CPRA framework together push California toward "specific and informed" disclosure. A generic handbook clause is a lawsuit waiting for a plaintiff.

CPRA: employees are now consumers

When the California Privacy Rights Act took full effect, the temporary exemption for employee data expired. California employers must now provide notice at collection for employee personal information, state the purposes of collection, and honor access and deletion requests over HR data — including monitoring logs. In practice: your monitoring disclosure and your privacy notice should be one document, not two inconsistent ones.

Video and location monitoring

Video surveillance of work areas is generally permitted with notice, but the state draws hard lines at private areas — restrooms, locker rooms, changing areas — where courts have found surveillance unlawful even with notice. California law also restricts GPS-based tracking of a person's location without consent, which limits location tracking of employees in personal vehicles and off-hours device tracking. For remote employees, pointing a camera at a home office is monitored territory; pointing it at anything else is not.

What a compliant rollout looks like

For a company adding California employees this quarter:

1. Run the monitoring program by counsel familiar with CIPA and CPRA.
2. Disable audio capture or implement announced-call recording.
3. Issue a specific, plain-language notice before software goes live.
4. Collect signed acknowledgments at onboarding.
5. Keep monitoring data out of personal spaces — no cameras in private areas, no personal-account content.
6. Maintain a notice-at-collection record under CPRA with retention and deletion terms.
7. Review the program when California law changes, which is often.

The out-of-state employer's mistake

The most common error I see is headquarters-based thinking: a company in Texas or Colorado reviews its policy against its home state's rules and never re-reads it for its California contingent. If even one employee works from California, the monitoring rules for that employee are California's. The reverse is also true — your policy may be over-strict elsewhere, but under-strict in California is the expensive direction.

Employee monitoring in California is workable — thousands of employers do it lawfully every day — but it demands specific notice, no silent recording, and a CPRA-aware paper trail. If you're configuring monitoring for a team that includes California, WorkAuditor is a cloud-based employee monitoring software for Windows and Mac with per-user collection scopes and configurable privacy settings that let you apply state-specific rules to specific employees. Explore it at https://www.workauditor.com.