CCPA and job applicant data: notice, rights and retention

California's privacy law covers your candidates. The exemption that kept applicant, employee and contractor data outside the California Consumer Privacy Act became inoperative on January 1, 2023, so a covered business must give job applicants a notice at collection before it collects anything, tell them how long it keeps each category, answer access, deletion and correction requests within 45 days, and not keep the data longer than is reasonably necessary. Interview notes, recordings, transcripts and AI-generated summaries are all personal information.

This guide covers who is caught, what counts as applicant personal information, a notice you can adapt, how to handle requests from candidates, and the automated decisionmaking rules that start on January 1, 2027.

Who has to comply

The obligations fall on a "business": a for-profit entity that does business in California, decides the purposes and means of processing, and meets one of three thresholds in Civil Code § 1798.140(d):

• annual gross revenues above $25,000,000 in the preceding calendar year, as adjusted for inflation. The CPPA's adjustment made that $26,625,000 from January 1, 2025, and the agency adjusts it again in odd-numbered years;
• buying, selling or sharing the personal information of 100,000 or more consumers or households a year; or
• deriving 50% or more of annual revenues from selling or sharing personal information.

Two details recruiters get wrong. First, "sharing" is a narrow defined term: it means disclosing personal information to a third party "for cross-context behavioral advertising." Sending a candidate's resume to a client is not "sharing" in that sense, though it may be a disclosure for a business purpose. Second, the revenue threshold is about the whole business, not the recruiting function, so a large employer is covered even if it hires ten people a year. Employment agencies that are separate businesses assess themselves against the same thresholds.

The exemption that used to exclude applicant and employee data, § 1798.145(m), still sits in the code with a closing paragraph: "This subdivision shall become inoperative on January 1, 2023." Anything you read that says HR data is exempt is describing the law before that date.

What counts as applicant personal information

Where the data physically sits does not change any of this. If your interview tool keeps transcripts on the recruiter's own computer, as Interview Signal does, those transcripts are still personal information your business holds, and they are in scope when a candidate asks what you have.

Sensitive personal information in interviews

Sensitive personal information (§ 1798.140(ae)) includes government identifiers, precise geolocation, racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, union membership, the contents of mail, email and text messages where you are not the intended recipient, genetic data, neural data, biometric information processed to uniquely identify someone, and information collected and analyzed concerning health or sex life or sexual orientation.

Candidates volunteer some of this in interviews without being asked: a health condition explaining a gap, a visa status, a union role. Two practical consequences. Consumers have a right to limit the use and disclosure of sensitive personal information under § 1798.121. And processing sensitive personal information is one of the triggers for a risk assessment under the CPPA's regulations, with a narrow exception for payroll, work authorization, benefits and accommodations. Train interviewers to note the job-related fact and not the characteristic; the examples in what not to write in interview notes apply directly.

The notice at collection

Under § 1798.100(a) and regulation § 7012, the notice must be given at or before the point of collection, and if you do not give it, you may not collect. Regulation § 7012(e) requires: the categories of personal information, including sensitive personal information, to be collected; the purposes of each; whether each category is sold or shared; the retention period for each category, or the criteria used to set it; a link to the opt-out notice if you sell or share; and a link to your privacy policy.

For recruiting that means the notice belongs where candidates first give you data: the careers page and application form, the job posting for applications by email, and the interview invitation when you add recording or transcription later in the process. A notice given orally is allowed where collection happens over the phone or in person.

Candidate notice at collection (California)  [adapt with counsel]

[Company] collects personal information from candidates. This notice tells
you what we collect, why, whether we sell or share it, and how long we keep
it. Our full privacy policy is at [link].

Category                          Why we collect it              Kept for
--------------------------------  -----------------------------  ---------
Identifiers (name, email, phone)  Contacting you, scheduling      [period]
Professional or employment        Assessing your application,     [period]
  information (resume, notes,       interviewing, deciding
  scorecards, references)
Education information             Verifying qualifications        [period]
Audio and electronic information  Accurate interview records      [period]
  (interview transcripts,           [only where we tell you and
  recordings where used)            you are asked at the start]
Inferences (ratings, summaries)   Comparing candidates fairly     [period]
Protected classification data     Voluntary EEO reporting, and    [period]
  you choose to give us             legal compliance
Sensitive personal information    [state which, and why. If you   [period]
                                    only use it for the purposes
                                    in Civil Code 1798.121(a),
                                    say so]

We do not sell or share (as those terms are defined in the CCPA) candidate
personal information. [Or: link to "Do Not Sell or Share My Personal
Information".]

Who else sees it: [hiring managers; our applicant tracking system; our
interview transcription provider; background check vendor], each acting as
a service provider under contract, and [clients, for agency placements].

Your rights: to know and access, delete, correct, and limit the use of
sensitive personal information, and not to be retaliated against for
exercising them. To make a request: [link / email / toll-free number].
We respond within 45 days and may extend once by a further 45 days.

Recording: if we transcribe or record an interview, we will tell you before
we start and you can decline. [Link to your recording notice.]

If you record or transcribe interviews, the CCPA notice is not the same thing as consent to record. California is an all-party consent state for confidential communications; the spoken line and the wording for it are in the interview recording consent script, and the state table is in two-party consent states.

Candidate requests: what to do in 45 days

Mechanics from § 1798.130: at least two designated methods for requests, including a toll-free number unless you operate exclusively online; respond within 45 days, extendable once by a further 45 with notice; verify the requester. Recruiting adds one wrinkle: candidate data is scattered across an applicant tracking system, email, calendar invites, note-taking tools and individual laptops. Write down where it lives before the first request arrives, because 45 days disappears quickly when three of those systems belong to someone else.

Retention

Section 1798.100(a)(3) requires you to state how long you keep each category, or the criteria, and says a business "shall not retain a consumer's personal information ... for longer than is reasonably necessary for that disclosed purpose." So you need a period per category, and it has to be defensible in both directions:

• Federal rules require keeping application and hiring records. Employers covered by Title VII must keep them for one year under 29 C.F.R. § 1602.14, and longer if a charge is filed.
• California's Civil Rights Council regulations on automated-decision systems, effective October 1, 2025, require employment records, including automated-decision data, to be kept for at least four years (Civil Rights Department announcement).
• Anything beyond that needs a reason you can state, and audio is the first thing to question: if the purpose is an accurate record, a transcript usually serves it with less data than the recording.

Vendors are service providers, and the contract matters

A transcription provider, an applicant tracking system and an assessment vendor all process candidate data for you. Section 1798.100(d) requires a contract that limits them to specified purposes, obliges the same level of protection, and gives you rights to check. Questions worth asking each vendor: does it use candidate data to train models, where is the data stored and for how long, can it return or delete data on request within your 45-day clock, and will it help you answer access requests. A vendor that cannot produce one candidate's data on request is a compliance problem, however good the product is.

What arrives on January 1, 2027: the ADMT rules

The CPPA's regulations on CCPA updates, cybersecurity audits, risk assessments and automated decisionmaking technology took effect on January 1, 2026, and businesses using ADMT to make significant decisions must comply by January 1, 2027. The parts that matter to hiring:

• ADMT is technology that processes personal information and uses computation to replace or substantially replace human decisionmaking. "Substantially replace" means using the output to make a decision without human involvement, and human involvement requires a reviewer who knows how to interpret the output, reviews it with other relevant information, and has authority to make or change the decision (reg. § 7001(e)).
• Significant decision expressly includes "employment or independent contracting opportunities or compensation," and hiring is listed first (reg. § 7001(ddd)(4)).
• Pre-use notice before you collect the personal information you plan to process with ADMT, covering the purpose in specific terms, the rights to opt out and to access, and how the output is used (reg. § 7220).
• Opt-out unless an exception applies. Two are relevant: giving candidates an appeal to a designated human reviewer with authority to overturn the decision; or, for hiring decisions, using the ADMT solely to assess the person's ability to perform the work where it works for that purpose and does not unlawfully discriminate (reg. § 7221(b)).
• Access requests get a plain-language explanation of the purpose, the logic, and how the output was used in the decision, including whether it was the sole factor (reg. § 7222).
• Risk assessments are required before using ADMT for a significant decision, and for automated processing that infers ability, aptitude or performance from systematic observation of a job applicant. Assessments conducted in 2026 and 2027 are submitted to the agency by April 1, 2028, and processing that started before the regulations took effect needs an assessment by December 31, 2027 (regs. §§ 7150, 7155, 7157).

Whether an interview note-taker is ADMT turns on the same question as everywhere else: does a person with authority actually review the output and decide, or does the output decide? The definition was deliberately drafted around that.

Enforcement

The CPPA brings administrative actions and the attorney general enforces in court. Administrative fines are up to $2,500 per violation and $7,500 per intentional violation under § 1798.155, adjusted by the CPPA to $2,663 and $7,988 from January 1, 2025. There is no general right to cure. The private right of action is limited to certain data breaches under § 1798.150, though the volume of applicant data an employer holds is exactly what makes a breach expensive.

A checklist for recruiting teams

• Confirm whether your organization meets a CCPA threshold, and write down the answer with the date.
• Map where candidate data lives: ATS, email, calendar, note-taking tools, laptops, agency partners.
• Publish a candidate notice at collection on the careers page and application form, with categories, purposes and retention periods.
• Add a line to interview invitations where you transcribe or record, separate from the consent step at the start of the call.
• Set retention per category, reconciled with federal recordkeeping and the four-year rule for automated-decision data.
• Put a request process in place: two methods, verification, a 45-day clock, and a template for each right.
• Check vendor contracts for service provider terms, training use, deletion and access support.
• Inventory anything that scores, ranks or recommends candidates, and decide before 2027 whether a human genuinely decides.
• Review the privacy policy so the candidate sections match what the recruiting team actually does.

California is one of several regimes a recruiter may hit in a single week. The state-by-state summary shows which jurisdictions add AI rules on top of privacy, including Colorado and New York City.