Bill
AB 1221
AB 1221 would regulate workplace surveillance by requiring 30-day advance notice, restrict certain biometric/AI tools, limit data sharing, and empower workers with transparency and
Status and timeline
- Introduced: February 21, 2025.
- Most recent action: In committee — Held under submission (May 23, 2025).
- Passed through Labor & Employment, Privacy & Consumer Protection, and Appropriations committees with amendments (see legislative actions for dates).
Purpose / intent
AB 1221 would regulate employers’ use of workplace surveillance tools and the collection, sharing, and use of “worker data.” The bill aims to increase transparency about electronic monitoring, restrict certain high‑risk surveillance practices (including some biometric/AI inferences), and limit third‑party data transfers.
Key definitions (selected)
- Employer: Broadly defined to include private and specified public employers and labor contractors.
- Worker: Employees and independent contractors working for a business or state/local governmental entity.
- Worker data: Any information that identifies, relates to, or can be linked to a worker, however collected or inferred.
- Workplace surveillance tool: Any system/app/device that collects worker data by means other than direct human observation (examples include video/audio surveillance, continuous incremental time‑tracking, geolocation, photo‑optical systems).
- Vendor: Third party or subcontractor that collects, stores, analyzes, or interprets worker data.
- Neural data: Measurements of central or peripheral nervous system activity (defined separately).
Notice and transparency requirements
- Employers must provide affected workers with plain‑language written notice at least 30 days before introducing a workplace surveillance tool. Notice may be emailed or provided via hyperlink, must be separate from other communications, and must be in the language used for routine workplace communications.
- Employers already using a surveillance tool before Jan 1, 2026 must provide the required notice by Feb 1, 2026.
- Employers must keep an updated list of surveillance tools and notify new hires.
- Additional notice is required within 30 days of any significant update to a tool or use.
- Required contents of the notice include (among other things): description of worker data collected; intended purpose and necessity; specific activities/locations/roles monitored; frequency of collection; storage locations and retention; who may access the data (including vendor names); whether the tool will inform employment‑related decisions; and workers’ rights to access and correct data plus how to do so.
Restrictions on sharing and uses of data
- Employers may not transfer, sell, disclose, or license worker data (including deidentified or aggregated data) to vendors — except when a vendor is under contract solely to analyze or interpret the worker data and the contract includes specified terms (full contract terms appear in the bill text).
- Employers are prohibited from using certain workplace surveillance technologies (the bill specifically targets tools that incorporate facial, gait, or emotion recognition) except as specified in the text.
- Employers are prohibited from using surveillance to infer sensitive attributes about workers, including immigration status, veteran status, ancestral history, religious or political beliefs, disability status, criminal record, and credit history (list in bill).
Employment decisions and access
- The bill addresses use of surveillance in making employment‑related decisions (hiring, discipline, promotion, termination, scheduling, performance evaluation, health & safety, etc.) — employers must disclose whether a tool will be used for such decisions.
Enforcement, remedies, and penalties
- Enforcement authority: Labor Commissioner (Division of Labor Standards Enforcement) is designated to enforce the part; public prosecutors may also enforce provisions.
- Private right of action: Employees are authorized to bring civil actions for remedies provided in the bill (specific remedies are stated in the full text).
- Penalty: Employers violating the bill’s provisions are subject to a civil penalty of $500 per violation.
Potential impacts
- Employers: Additional compliance requirements (notice, recordkeeping, contracts with vendors), limitations on data sharing and certain AI/biometric surveillance uses; potential liability and per‑violation penalties.
- Vendors: Contract limitations and narrower uses for aggregated/deidentified data; possible loss of certain data streams.
- Workers: Greater transparency and rights to access/correct data; protections against certain intrusive inferences and biometric surveillance.
Notes and caveats
- Several sections of the bill text (including full contract requirements and some prohibitions) are truncated in available summaries. For implementation guidance and exact legal obligations, consult the full enrolled/legislative text as amended.
Compiled from official sources — confirm details with the bill’s official record.
Sign in to ask a question.
