Consumer Protection Dispatch
On July 21, 2026, the California Privacy Protection Agency (CalPrivacy) announced that its Audits Division has begun the agency’s first formal privacy audit. The audit targets major gig economy platforms operating in California, including app-based transportation, delivery and task services, and is the first in what CalPrivacy says will be a series of sectoral audits.
The review will focus on whether platforms comply with the CCPA rights of consumers and the independent contractors who provide services through them. In particular, CalPrivacy will examine whether platforms respond to access requests within the required timeframe, whether responses are complete and whether the platforms’ systems allow individuals to exercise their rights meaningfully.
The announcement is significant beyond the gig economy as it reflects CalPrivacy’s first use of a formal, sector-wide audit. It also provides an early indication of how the agency’s newly formed Audits Division intends to evaluate whether CCPA rights operate effectively in practice.
A New Phase of Proactive CCPA Oversight
CalPrivacy is conducting the audit under California Civil Code section 1798.199.40, which directs the agency to audit businesses to ensure CCPA compliance. According to the agency, sectoral audits provide an opportunity to identify compliance risks and vulnerabilities, agree upon remediation, highlight strong practices and publish trend reporting that can inform the public.
CalPrivacy formed its Audits Division in February 2026 to conduct regulatory examinations of businesses and evaluate compliance with the CCPA. Executive Director Tom Kemp described the gig economy review as an important milestone for the division and stated that the audit responds to hundreds of consumer complaints and comments submitted during public rulemaking.
The agency’s decision to begin with a sectoral review also indicates that the audit is intended to examine privacy practices across an industry, rather than address only an individual complaint or company.
Access Rights as an Operational Test
The audit will focus specifically on whether gig platforms comply with the right of access. Under the CCPA, California consumers may request information about the personal information a business has collected about them, including the categories and specific pieces of personal information collected, the purposes for which the information is used and the third parties with whom it has been shared. CalPrivacy will examine whether platforms respond to access requests within the CCPA’s 45-day timeframe, whether their responses are complete and whether their systems allow workers and consumers to exercise their rights in accordance with the law.
The agency characterized access as foundational to the exercise of other privacy rights. Without knowing what information a platform maintains, an individual may not know that certain information should be corrected or deleted. For gig workers, access may also provide visibility into information affecting dispatch assignments, performance ratings, earnings and account status.
Worker Data Is Squarely Within Scope
California’s comprehensive privacy law extends privacy rights to individuals acting in an employment or independent-contractor capacity. As CalPrivacy emphasized in its announcement, this allows gig workers to exercise CCPA rights regarding personal information collected and used in connection with their work.
Gig economy platforms may collect extensive information about both workers and customers. CalPrivacy identified precise geolocation, behavioral and performance metrics, biometric identification data, financial information and communications records as categories that may be involved. For workers, these records may reflect where they traveled, how they performed particular tasks, how customers evaluated them and how the platform calculated compensation or made decisions about their accounts.
Algorithmic Decisions Heighten the Importance of Access
CalPrivacy expressly connected access rights to gig platforms’ use of algorithmic systems. According to the agency, platforms may use worker data to make consequential decisions about dispatch assignments, performance ratings, earnings and account suspension or deactivation.
Chief Privacy Auditor Sabrina Ross emphasized that a worker may be unable to contest an algorithmic decision without access to the underlying data. The announcement therefore presents access as especially important where a platform’s use of personal information may directly affect a worker’s livelihood.
The agency did not announce a broader audit of algorithmic decision-making requirements. Instead, its discussion of algorithms underscores why complete and meaningful access to personal information may be particularly consequential for gig workers.
Conclusion
CalPrivacy’s first sectoral audit marks a significant step for the agency’s newly formed Audits Division and its use of proactive reviews to evaluate CCPA compliance across an industry. By beginning with gig economy platforms, the agency is focusing on a sector in which extensive data collection, workforce privacy rights and algorithmic decision-making can directly affect individuals’ livelihoods.
The emphasis on timely and complete access responses also reflects CalPrivacy’s view that privacy rights must operate meaningfully in practice. Pillsbury will continue to monitor the audit and CalPrivacy’s selection of additional sectors for review and can assist companies with CCPA compliance, workforce privacy and consumer-rights response processes.