CCPA employee data exemption expired: what it means for licensing workplace records

What changed when the CCPA employee exemption expired?

California employee, job applicant and contractor personal information has been fully covered by the CCPA since January 1, 2023, so a covered company can no longer treat workplace records as outside the statute. For a company thinking about licensing internal records, that means email, chat, HR-adjacent files and call recordings need a privacy review before anything leaves the building.

The California Attorney General's CCPA overview describes the rights the law gives California residents, including rights to know, delete, correct, opt out of sale or sharing and limit use of sensitive personal information. Those rights now reach people in their roles as staff and applicants, not only as customers. The law applies only to for-profit businesses that meet one of its thresholds, so the first question is always whether the company is covered at all.

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

Does the CCPA apply to this company?

Treat coverage as a three-part check, answered by the company's counsel rather than by the partner.

A national company with one California office can be covered. A company with no California presence and no California residents in its records may not be, though other states' laws or its own contracts can still apply. The state privacy law map for employee and B2B data compares how other states treat the same records.

Which workplace records raise the most questions?

Not every record carries the same weight. Sort them before the conversation with the owner gets abstract.

• Email and chat archives: names, addresses, performance comments and personal asides mixed into business threads.
• HR-adjacent files: onboarding forms, compensation notes, leave requests and disciplinary records. These are the highest-sensitivity category and are rarely the reason a company is a good fit.
• Recruiting records: applicant resumes and interview notes, which fall under the same employee-and-applicant coverage.
• Call and meeting recordings: voices and statements of staff and customers, with consent rules that vary by state.
• Operational records with outcomes: tickets, approvals, project records and decision logs, usually the most valuable material and often manageable once names are removed.

The CCPA defines categories of sensitive personal information, such as government identifiers and certain account credentials, that carry extra limits. A scope that excludes those fields from the start is simpler to defend than one that tries to clean them up later.

How do notices and de-identification fit in?

The statute's notice requirement, in Civil Code section 1798.100, asks a business to tell people at or before collection what categories of personal information it collects, why, and whether it is sold or shared. A company that collected staff data under an older, narrow notice should have its counsel compare that notice against the planned license.

De-identification changes the analysis. Information that has been properly de-identified is generally treated differently from personal information, and the sale question depends on what is actually delivered. That is why SourceX agrees de-identification and redaction rules with the company before any work begins, and why data is delivered only after an executed agreement and the company's authorization. The sale definition itself is covered in is licensing company records a sale under the CCPA.

What the standard counts as "properly de-identified" is a legal question for the company's counsel. The explainer on what anonymized means in AI data licensing describes the practical side.

Questions to put to the company's counsel

Bring this list to the owner, CFO or general counsel and let them take it from there:

• Is the company a covered business under the CCPA, and does it hold records of California staff or applicants?
• What did the employee and applicant privacy notices promise about use and disclosure?
• Which record sets contain sensitive personal information, and can they be excluded from scope?
• Will the buyer receive identifiable personal information, or only de-identified records?
• Do employment agreements, handbooks or union terms restrict disclosure of workplace communications?
• Is employee notice or consent advisable even where the law may not strictly require it? See do you need employee consent to license workplace data.

How does this change what a referral partner does?

Nothing about the partner's job becomes legal work. You make an introduction and give basic fit information; you never export, upload or describe confidential records.

1. Ask whether the company has California staff and keep the answer as a flag, not a conclusion.
2. Tell the sponsor that privacy review happens inside the process, with the company's counsel.
3. Introduce through the referral form or your referral link, and let SourceX run qualification, the data inventory and rights review.
4. Leave scoping and redaction rules to the company and SourceX, agreed before any work starts.

The company still needs 50+ full-time employees at peak (contractors excluded), several years of documented operations, rights to license the data and an authorized sponsor. A privacy question is a scoping issue, not usually a disqualifier. The company fit checker is a preliminary, non-binding screen.

Illustrative: a California-headquartered IT services firm

Illustrative and fictional. A managed services firm with several hundred staff and ten years of ticketing history wants to explore a license. Its counsel sorts the records into three tiers.

The sponsor takes that sorting to SourceX at qualification, and the inventory step documents what exists. Nothing is binding until the company agrees price and terms and signs.

When to slow down

Pause the introduction, or ask the company to involve counsel first, when:

• The most valuable records are HR files or applicant data.
• Staff were told in writing that their communications would never be shared.
• The company cannot say who is responsible for privacy compliance.
• The owner expects identifiable employee data to be delivered as is.

Next step

If the company has years of operational records across several systems and a sponsor willing to review scope with counsel, register as a partner and make the introduction. The how it works page shows each stage that follows. Rewards are not guaranteed and are paid only after the buyer pays and SourceX receives its fee.