California Privacy Protection Agency Launches First Sectoral Audit, Targets Gig Economy Platforms

Audit to evaluate whether platforms honor consumers’ and workers’ privacy rights in practice

July 21, 2026

SACRAMENTO, CA — The California Privacy Protection Agency (CalPrivacy) today announced that the Audits Division has begun its first formal privacy audit, focused on gig economy platforms operating in California. The audit — the first in a series of sectoral audits — will evaluate whether major gig platforms are meeting their obligations under the California Consumer Privacy Act (CCPA), with a specific focus on compliance with consumers’ rights to access and exercise control over their personal information.

Gig platforms — including app-based transportation, delivery, and task services — collect extensive personal information from California consumers, including the independent contractor workers who power their services. The data collected may include precise geolocation data, behavioral and performance metrics, biometric identification data, financial information, and communications records. Algorithmic systems process this data to make consequential decisions about workers’ dispatch assignments, performance ratings, earnings, and account status, including suspension or deactivation.

CalPrivacy’s audit will examine whether workers and consumers are meaningfully able to exercise their legal right to know what data is being collected about them, how it is being used, and with whom it is being shared. Unlike other states, California’s comprehensive privacy laws allow workers, including employees and independent contractors, to exercise their privacy rights in relation to their employer.

“Core to California’s privacy rights is ensuring people have the power to access and understand the information that a company collects about them. For gig workers in California, the right of access is vital because it may directly impact their livelihood. You cannot contest a decision made by an algorithm without the underlying data. This audit is about ensuring underlying privacy rights work in the real world.”

The Right of Access: A Foundation, not a Formality

The CCPA guarantees California consumers — including employees, job applicants, and independent contractors such as gig workers — the right to know what personal information a business has collected about them, the categories and specific pieces of that information, the purposes for which it is used, and the third parties with whom it has been shared. These are enforceable legal rights, and businesses are required to honor access requests accurately and within specified timeframes.

Meaningful access to one’s personal information is often the precondition for exercising any other privacy right. A worker whose account has been deactivated based on behavioral metrics cannot challenge that outcome without knowing what data drove the decision. A rider who wants to ensure their profile is correct cannot easily do so without knowing what information a company is storing about them. A rider whose location data is being retained cannot request its deletion without knowing that it exists. Access is not one right among many: it is sometimes the right that makes all others possible.

The audit will examine whether gig platforms are processing access requests in compliance with the law: whether requests are being honored within the 45-day statutory window, whether responses are complete, and whether platforms have implemented systems that allow workers to exercise their rights in accordance with our privacy laws.

“This is an important milestone for our newly formed Audits Division. This audit is responsive to hundreds of consumer complaints and also comments received during public rulemaking. Via structured sectoral audits, the division is focused on increasing compliance through proactive engagement and review.”

About the Audit

The Audits Division will conduct this sectoral audit pursuant to California Civil Code section 1798.199.40, which directs the Agency to audit businesses to ensure compliance with the CCPA. Sectoral audits such as this one provide an opportunity to identify risks and vulnerabilities and agree upon remediations, shed light on strong practices, and publish sector trend reporting that can inform the public.