What is the California Consumer Privacy Act (CCPA)?
The California Consumer Privacy Act (CCPA) is California's main privacy law. It gives California residents, including job applicants and employees, rights over their personal data, such as the right to know what is collected, to correct it, to ask for deletion and to limit use of sensitive information.
Law and compliancetopic
2 minread
1related terms
In one line
California's privacy law. It gives job applicants and employees rights over their personal data, including the right to know what is collected.
The CCPA applies to for profit businesses that do business in California and meet at least one threshold: annual gross revenue above an inflation adjusted amount, set at 26,625,000 dollars from January 1, 2025; buying, selling or sharing personal information of 100,000 or more California residents or households; or earning half or more of revenue from selling or sharing personal information.
Employment data used to be largely exempt. That exemption expired at the end of 2022, so covered employers now owe applicants and staff the same core rights as consumers, including a notice at collection explaining what data is collected and why.
For recruiting, that covers resumes, interview notes, assessment results, background check data and anything your sourcing or AI tools collect about California candidates.
Why it matters to recruiters
Recruiters and HR collect large amounts of personal data, often through many tools. Under the CCPA, a covered employer needs a privacy notice for applicants, a way to handle requests to know, correct or delete, retention limits and contracts with vendors that process the data. Agencies sourcing California candidates should check whether they are covered too.
An example from a recruiting desk
A rejected applicant in California emails a tech company asking what personal data it holds about her. The HR team has to search the ATS, the scheduling tool, the assessment vendor and interview notes, then respond within the legal deadline. After this, they map every tool that stores candidate data so the next request takes hours, not weeks.
Tips that help
Give California applicants a notice at collection before or when you gather their data.
Keep an inventory of every recruiting tool that stores candidate information.
Set retention periods for applicant data and delete records when they expire.
Check vendor contracts include the service provider terms the law expects.
Mistakes to avoid
Assuming employee and applicant data is still exempt from the CCPA.
Forgetting that sourced candidates who never applied may still be covered.
Frequently asked questions
Does the CCPA apply to job applicants?
Yes, for covered businesses. The employment data exemption ended on December 31, 2022, so applicants and employees who are California residents now have CCPA rights. Check whether your business meets the thresholds. This is not legal advice.
Does the CCPA apply to small businesses?
Only if they meet a threshold, such as the revenue amount or handling data of 100,000 or more California residents or households. Many small employers fall below them, but the thresholds should be checked each year as the revenue figure is adjusted.
What is the difference between the CCPA and the GDPR?
Both give people rights over their data. The GDPR covers the EU and requires a legal basis for processing. The CCPA covers California and focuses on notice, access, deletion, correction and limits on selling or sharing data.
