California is adapting to the prevalence of technology in the modern workplace – especially artificial intelligence – as these digital tools become more embedded in business infrastructure. Among other consequential AI-related bills currently under consideration, Assembly Bill 1221 (AB 1221) stands out. Now advancing through the legislature, the bill is poised to impose comprehensive restrictions on workplace surveillance technologies.
If enacted, the bill would require businesses to provide clear and timely notice – at least 30 days in advance – before implementing any new surveillance tool. This stand-alone notice must include details about the type of data being collected, the purpose behind the monitoring, and an explanation of why the tool is necessary, among other key pieces of information. For surveillance systems already in place, employers would be required to issue the notice by February 1, 2026.
A “workplace surveillance tool” is defined broadly under AB 1221. The bill covers not only traditional methods like video and audio monitoring, but also more sophisticated methods, including continuous incremental time-tracking tools (e.g. electronic timeclocks and keystroke logging), location tracking, facial and gait recognition, and even behavior detection. In practice, this means that a wide range of software tools – many of which are used for productivity, scheduling, or employee analytics – could fall within the purview of AB 1221. As a result, employers may need to closely scrutinize even seemingly routine technologies, such as onsite video cameras, for compliance risks.
A significant portion of the bill is focused on data privacy. AB 1221 would restrict employers from transferring or selling employee surveillance data except to vendors who are contractually bound to maintain rigorous data safeguards. Contracts must include terms for secure handling, limited use, and proper deletion. This provision will require many companies to revisit and potentially revise existing agreements with third-party software providers, particularly those offering workforce analytics or remote monitoring services.
The legislation would also limit how surveillance data can be interpreted or used. Due to growing concerns about algorithmic bias, AB 1221 prohibits employers from using collected data to infer characteristics protected by the Fair Employment and Housing Act – such as immigration status, religious or political beliefs, health or reproductive status, criminal record, or other sensitive personal traits. This prohibition aligns with broader state efforts to ensure fairness in automated decision-making and to prevent surveillance tools from enabling subtle forms of discrimination.
Operationally, one of the bill’s most impactful provisions is its requirement for human oversight in disciplinary matters. Employers would be prohibited from relying solely on automated systems to make employment decisions. If surveillance data is used to support actions such as termination, demotion, or pay adjustments, a human must first review and validate that data. In addition, employees must be notified when surveillance information plays a role in any adverse employment action. The employee will then have five business days to dispute or request correction of that information – requests to which employers must respond within 24 hours. Any surveillance data used in disciplinary decisions must be retained for at least five years.
If an employer violates any of the provisions under AB 1221, employees would be permitted to bring private lawsuits for actual and punitive damages, temporary or preliminary injunctive relief, a $500 civil penalty per violation, and reasonable attorney’s fees and costs. In addition, both the Labor Commissioner and public prosecutors would have the power to enforce these provisions.
Although AB 1221 has not yet become law, its policy trajectory is clear – and employers would be wise to take this time to prepare for its likely passage. Employers should conduct a thorough audit of any existing employee monitoring tools, whether directly or indirectly used. Internal policies, handbooks, and notice procedures should be reviewed and updated for clarity and legal compliance. Contracts with vendors handling worker data should be evaluated to ensure they will meet the bill’s expected standards. Employers will also want to make sure that they are already in compliance with the California Privacy Rights Act (CPRA), which amended the California Consumer Privacy Act (CCPA), and requires employers to notify employees of the employment-related personal information that the employer collects, and how that data is used.
In sum, AB 1221 could redefine not only how surveillance is conducted, but how work is monitored, measured, and managed throughout the state.
