Your employer installed software that takes a screenshot of your screen every five minutes. They track your location through your company phone, including after business hours. They asked for your Instagram password during the hiring process. They have cameras in the break room pointed at the seating area where employees eat lunch. Each of these scenarios raises serious legal questions in California — and in several cases, the answer is the same: your employer has broken the law.

California has some of the strongest workplace privacy protections in the country. The state's legal framework draws from the California Constitution, the Penal Code, the Labor Code, and the California Privacy Rights Act — layers of protection that together create enforceable limits on what employers can monitor, record, track, or demand. Understanding those limits is not just important for your privacy. It is the foundation for knowing when your employer has crossed a legal line and what remedies you have when they do.

The Constitutional Foundation: Privacy as an Inalienable Right

Unlike the federal Constitution, which courts have interpreted to apply primarily to government actors, the California Constitution's privacy provision at Article I, Section 1 applies to private employers as well. California voters added privacy to the state's inalienable rights in 1972, explicitly intending it to restrain private actors — including the businesses where Californians work.^[1]

This constitutional protection matters in practical terms because it gives employees a basis for challenging surveillance and monitoring that goes beyond specific statutes. Courts evaluating employer privacy violations ask whether the employee had a reasonable expectation of privacy in the area or information at issue, and whether the employer's intrusion was serious enough to constitute an egregious violation of social norms. The California Supreme Court's framework developed in Hill v. NCAA (1994) — which established the balancing test for constitutional privacy claims — applies directly to the workplace.^[2]

California Penal Code Section 632: No Secret Audio Recording

California is an all-party consent state. Under Penal Code Section 632, it is a crime to intentionally record a confidential communication — whether in person or by telephone — without the consent of all parties to that conversation.^[3] This applies in the workplace. An employer who places recording devices in areas where employees have confidential conversations, or who uses audio-capable surveillance cameras in conference rooms or break areas without providing clear notice, may be violating California's Invasion of Privacy Act.

The civil penalty for a Penal Code Section 632 violation is $5,000 per recorded conversation, and affected employees may sue for those damages without having to demonstrate any additional harm.^[3] The law applies regardless of whether the employer owned the device doing the recording and regardless of whether the conversation involved any sensitive business information. The prohibition is on secret audio recording of confidential communications — period.

Video-only surveillance does not require employee consent under Section 632. It does, however, require transparent disclosure, and it is absolutely prohibited in certain areas under Labor Code Section 435 (see below).^[4]

Labor Code Section 435: No Cameras in Private Areas

Labor Code Section 435 explicitly prohibits employers from causing an audio or video recording to be made of an employee in a restroom, locker room, or room designated by the employer for changing clothes, unless authorized by a court order.^[5] Violations of this statute are not trivial. An employer who installs cameras in these areas — even for legitimate security reasons and even with disclosure — violates Section 435 unless a court has specifically authorized it.

This protection is absolute and cannot be waived by an employment contract or company policy. No matter what your onboarding paperwork said, no matter what your employee handbook authorizes, your employer cannot legally place recording equipment in restrooms or locker rooms. If they have done so, they have committed a Labor Code violation that may give rise to civil liability.

Labor Code Section 980: Your Social Media Is Off Limits

California Labor Code Section 980 makes it illegal for employers to require or request that an employee or job applicant disclose a username or password for the purpose of accessing their personal social media, access their personal social media in the employer's presence, or otherwise divulge personal social media content that is not publicly available.^[6] An employer that retaliates against a worker for refusing this demand violates the statute. This protection extends to job applicants — an employer cannot condition a job offer on access to your personal Facebook, Instagram, or any other private social media account.

The statute does not protect information you post publicly. Your employer can view your public posts and, in most circumstances, may take adverse action based on what you publicly share online. What they cannot do is demand access to private content that you have not chosen to make public.

Remote Work Monitoring: Where the Law Draws the Line

The expansion of remote and hybrid work in California has intensified the monitoring question significantly. By 2026, employers routinely use software that tracks keystrokes, takes periodic screenshots, monitors website activity, records application usage, and measures idle time. California law does not prohibit this monitoring outright on employer-owned devices during work hours — but it requires clear disclosure, and it draws a firm line around personal devices and off-duty time.^[7]

Monitoring a personal device — even a device used partly for work — requires separate, specific written consent from the employee. The consent must define the scope of monitoring, limit tracking to work applications and work hours, and cannot be buried in general onboarding agreements. The California Constitution's Article I, Section 1 privacy right applies to personal property, and courts have held that blanket authorization for monitoring in an employment agreement does not constitute the kind of specific consent required for access to a personal device.^[8]

GPS location tracking follows the same principle. Employers may track company-issued vehicles and devices during work hours if employees are notified. Tracking a personal vehicle or a personal phone during off-duty hours is a different matter entirely. Courts and the Labor Commissioner have consistently treated off-duty location tracking of personal vehicles as a serious privacy invasion that cannot be justified by general business interest alone.^[9]

The California Privacy Protection Agency is also drafting rules specifically governing AI-driven monitoring in employment contexts. Beginning January 1, 2026, employers whose monitoring activities involve automated decision-making technology affecting significant employment decisions must conduct privacy risk assessments. Employers with pre-existing covered activities have until December 31, 2027 to complete an initial assessment.^[10]

What to Do If Your Employer Is Monitoring You Unlawfully

If you have reason to believe your employer is recording you without consent, tracking your location outside work hours, accessing your personal devices or social media accounts, or installing surveillance equipment in prohibited areas, you have enforceable rights. The first step is documentation. Write down what you observed, when you observed it, who told you about it, and any communications related to the monitoring. This contemporaneous record can be critical evidence.

You can file a complaint with the California Department of Industrial Relations for Labor Code violations, or with the California Privacy Protection Agency for CPRA violations. You may also have the right to file a civil lawsuit directly for violations of Penal Code Section 632, seeking the $5,000 per-violation civil penalty without needing to prove additional damages. Constitutional privacy violations can give rise to claims for emotional distress damages and injunctive relief.^[11]

Retaliation for asserting your privacy rights is its own separate violation under California law. If your employer disciplines you, reduces your hours, passes you over for a promotion, or terminates you after you complain about unlawful monitoring or refuse to provide your social media password, that retaliation may give rise to additional claims entirely independent of the underlying privacy violation.^[6]

The Bottom Line

California's workplace privacy protections are among the strongest in the country — and they are expanding, not contracting. In 2026, employers using AI-driven monitoring tools face new risk-assessment obligations. Pending legislation would extend protections to break rooms and require employees to be able to leave monitoring tools behind during off-duty hours. The direction of California law is unmistakable: employers who monitor employees must be transparent, stay within defined legal boundaries, and never extend surveillance into private spaces or off-duty life.

If your employer has crossed those boundaries — through secret recordings, prohibited surveillance, demands for social media access, off-duty GPS tracking, or covert monitoring of your personal devices — California law gives you the right to hold them accountable. At Smith Reback Law, we represent California workers whose privacy rights have been violated in the workplace. We evaluate every available claim, from constitutional invasion of privacy to Penal Code civil penalties to Labor Code retaliation, and your consultation is completely confidential and costs nothing.