CalPrivacy has announced the launch of its first sectoral audit, with gig economy platforms chosen as the initial focus of regulatory scrutiny.
The audit aims to determine whether gig platforms are properly respecting workers’ rights of access and control over their personal information.
California’s comprehensive privacy law remains the only US state privacy regulation that extends its protections explicitly to workers, making this audit particularly significant.
CalPrivacy highlighted that gig platforms collect extensive and sensitive information from the workers who operate on them, raising serious compliance concerns.
The data collected by these platforms includes precise geolocation information and biometric data, both of which are considered highly sensitive categories under California law.
Regulators also noted that these platforms use algorithmic systems to make what they described as “consequential decisions” affecting workers’ livelihoods and working conditions.
The use of algorithmic decision-making has been a growing area of concern for legislators across multiple US states as privacy frameworks continue to evolve.
As part of the audit, CalPrivacy will examine whether workers are being given enough information to meaningfully exercise their legal rights under existing privacy law.
Regulators will also investigate whether platforms are honouring access requests within the 45-day statutory window and whether responses provided to workers are complete and accurate.
A further area of examination will be whether platforms are delivering requested information to individuals in a genuinely usable and accessible format.
The potential outcomes of the audit are wide-ranging, including enforcement action against non-compliant platforms, as well as trend reporting and recommended best practices.
Legal analysts at Sheppard, Mullin, Richter and Hampton have noted that even businesses without gig workers should pay close attention to the audit’s findings and scope.
The audit’s focus areas, including meaningful exercise of CCPA rights and data underpinning algorithmic decisions, are relevant to a broad range of businesses operating in California.
Companies are being advised to review what data sits behind their algorithmic systems and whether their processes genuinely allow consumers and workers to exercise their statutory privacy rights.