Executive Summary
- What’s new: The California Privacy Protection Agency (CalPrivacy) has launched its first sectoral audit — targeting gig economy platforms’ compliance with the California Consumer Privacy Act (CCPA) — and has confirmed it is the first in a planned series, meaning businesses across industries should take note.
- Why it matters: The audit will culminate in a public report on the industry’s CCPA compliance, and the findings carry cascading effects: Businesses may be referred directly to CalPrivacy’s Enforcement Division, which has broad subpoena power to compel documents and testimony in support of its audit authority. The audit also reflects the Enforcement Division’s broader push to address compliance gaps involving human resources and business-to-business data, not just traditional consumer-facing data, as well as growing regulatory attention to automated decision-making technology used to manage workers and consumers.
- What to do next: Businesses operating in California that are subject to the CCPA — not only gig economy platforms — should consider reviewing their CCPA compliance programs now. Because it is not yet clear which sectors CalPrivacy will target next, businesses should ensure compliance efforts extend to employee and job applicant data as well as consumer data, and should consider consulting counsel if they receive an audit inquiry from CalPrivacy.
__________
The California Privacy Protection Agency (CalPrivacy) has moved from rulemaking and enforcement into a new phase of proactive oversight. After formally launching an Audits Division in February 2026, it recently announced its first sectoral audit, focused on gig economy platforms and modeled on the Federal Trade Commission’s (FTC’s) Section 6(b) market studies.
The July 21, 2026, audit announcement signals that CalPrivacy intends to use its statutory audit authority as a systematic tool for assessing industrywide compliance and as a complement to its enforcement authority, with the Audits Division’s findings to be published in a public report at the audit’s conclusion.
Although the initial audit targets gig economy platforms, CalPrivacy has made clear that this is only the first in a planned series of sectoral audits — meaning businesses in every industry, not just gig platforms, should take this development seriously and revisit their own CCPA compliance posture now.
CalPrivacy’s New Audits Division Signals Proactive Oversight
In February 2026, CalPrivacy launched its Audits Division, led by Chief Privacy Auditor Sabrina Boyson Ross, former director of public policy at Meta. The Audits Division is intended to examine the privacy and technology records of businesses to determine compliance with the CCPA, and CalPrivacy has made clear that audit findings can lead directly to enforcement action.
CalPrivacy Executive Director Tom Kemp has indicated that the division will also monitor compliance with related laws, such as the Delete Act. In addition, Kemp highlighted the Audits Division’s strategy of operating “through both announced and unannounced audits.”
The First Sectoral Audit: Gig Economy Platforms
On July 21, 2026, CalPrivacy announced that the Audits Division had begun its first formal privacy audit targeting gig economy platforms operating in California, fulfilling Kemp’s earlier stated goal of beginning compliance audits within the year.
Kemp described the audit as “an important milestone for our newly formed Audits Division,” noted that it responds to “hundreds of consumer complaints” and comments received during public rulemaking, and said the division is focused on “increasing compliance through proactive engagement and review.”
CalPrivacy chose the sector based on consumer complaints and comments, but the agency previewed that this audit is “the first in a series of sectoral audits.” The audit will evaluate whether major gig platforms are meeting their CCPA obligations, with a specific focus on compliance with consumers’ rights to access and exercise control over their personal information.
CalPrivacy noted that gig platforms — including app-based transportation, delivery and task services — collect extensive personal information, including:
- Precise geolocation data.
- Behavioral and performance metrics.
- Biometric identification data.
- Financial information and communications records.
Algorithmic systems may use such information to make decisions about workers’ dispatch assignments, performance ratings, earnings and account status. This reliance on algorithmic systems to make consequential worker-related decisions places the audit squarely within CalPrivacy’s broader focus on automated decision-making technology (ADMT).
Businesses should expect forthcoming CCPA ADMT compliance obligations — including obligations taking effect in 2027, relating to pre-use notices, opt-out rights and information about the logic underlying automated decisions — to be an increasing area of regulatory focus.
Notably, California is the only state, among the nearly two dozen states with comprehensive privacy laws, that requires employers subject to the CCPA to extend these rights to workers — underscoring CalPrivacy’s unique position to scrutinize human resources (HR) data practices.
Ross has stated, “We are fortunate in California that we have jurisdiction over employee privacy,” reflecting that HR data protection is not a feature of state privacy laws across the United States. This coverage appears to dovetail with the Enforcement Division’s broader push on HR and business-to-business (B2B) compliance gaps, as reflected in a recent seven-figure enforcement penalty against a national retailer for failing to notify job applicants of their privacy rights.
Businesses should therefore confirm that their CCPA compliance programs extend to employee and job applicant data, not just to consumer-facing practices.
As part of the audit, the agency stated it will review platforms’ policies and practices, request relevant documentation and data, and interview company personnel. A team of auditors and technologists will also test the platforms’ processes directly.
The agency specifically noted that the audit will examine whether access requests are honored within the CCPA’s 45-day statutory window and whether responses are complete. CalPrivacy began reaching out to gig economy companies this summer and could contact additional companies in the coming weeks.
The audit follows a hiring spree at CalPrivacy and coincides with an additional $3.1 million in funding for privacy investigations approved by state lawmakers as part of the state budget finalized in June 2026. It signals the agency’s growing enforcement capacity and the likelihood of continued sectoral scrutiny.
A Model Resembling FTC Section 6(b) Studies
CalPrivacy’s audit process resembles certain FTC Section 6(b) market studies. Following the audit, the Audits Division will release a public report about the industry’s state of compliance, similar to the FTC’s 6(b) studies.
Ross has stated that while some agencies’ public reports can take up to a year following an audit, she anticipates a more expedited timeline. CalPrivacy has explained that sectoral audits are intended to “provide an opportunity to identify risks and vulnerabilities and agree upon remediations, shed light on strong practices and publish sector trend reporting that can inform the public” — underscoring that the resulting public report and remediation process are central features of the audit model, not incidental byproducts.
Audit Findings May Lead to Enforcement
CalPrivacy has directly linked its audit and enforcement functions. When announcing the Audits Division, the agency stated that “[a]udit findings may lead to enforcement referrals in appropriate circumstances.” Since its first CCPA enforcement action in March 2025, the Enforcement Division has brought several enforcement actions against companies across a range of industries, including, most recently, a $1.35 million penalty against a national retailer for, among other things, failing to notify consumers and job applicants of their privacy rights.
This enforcement track record — which already reaches HR-related compliance gaps — underscores that the agency is prepared to act on the compliance gaps its audits may uncover.
Although the audit inquiries have been described as “narrowly scoped” by CalPrivacy, the information disclosed by audited companies may result in negative consequences. Further, because CalPrivacy’s audit authority is backed by subpoena authority, respondents may now be required to disclose information outside of the enforcement context that can be used against them in enforcement actions.
Algorithmic Management Remains in the Spotlight
The audit also arrives amid a broader legislative push targeting employer use of algorithmic decision-making tools, sometimes referred to as “bossware.” California lawmakers, working with labor groups such as the California Federation of Labor Unions, have advanced bills that would bar employers from relying solely on algorithms to make disciplinary, termination or deactivation decisions.
Gov. Gavin Newsom vetoed one such bill, SB 7, in 2025; a similar bill, SB 947, is pending before the Assembly Appropriations Committee this August. Together with the sectoral audit and CalPrivacy’s ADMT regulations under the CCPA, this legislative activity signals sustained regulatory and legislative attention to how businesses — particularly those using algorithmic tools to manage workers — handle employee and consumer data in California.
What Businesses Should Do Now
CalPrivacy’s audit of gig economy platforms is positioned to be the first in a series of sectoral audits by the Audits Division. Businesses across all sectors — not only those resembling gig economy platforms — should treat this audit as a signal of increased CalPrivacy activity to come. Much remains uncertain, but the scope and outcome of this audit will likely be instructive for future sweeps.
Businesses should consider confirming that their CCPA compliance programs cover employee and job applicant data as well as consumer data in light of CalPrivacy’s subpoena authority, the link between audit findings and enforcement referrals, the agency’s emphasis on extending compliance expectations to HR and B2B data, its growing focus on ADMT and its stated intent to conduct further sectoral audits.
This memorandum is provided by Skadden, Arps, Slate, Meagher & Flom LLP and its affiliates for educational and informational purposes only and is not intended and should not be construed as legal advice. This memorandum is considered advertising under applicable state laws.