California privacy rights for employee drivers: what CCPA means for fleet data

Do employee drivers have CCPA rights?#

Employee drivers who are California residents generally do have CCPA rights over the personal information their employer holds. The CCPA, as amended by the CPRA, no longer sets workforce data apart the way it once did, so current and former employees, applicants and many contractors are treated as consumers, subject to the law's coverage thresholds and exceptions.

The change has a date. The employee and business-to-business exemptions expired on January 1, 2023, after the legislature ended its 2022 session without extending them. Under the CPRA amendments, an employee may request the specific pieces of personal information held about them that were generated on or after January 1, 2022. Coverage still depends on thresholds: secondary guides report the annual gross revenue threshold was adjusted to $26,625,000 effective January 2025, and many fleets with 50 to 500 employees may clear it.

The rules are still moving. The California Privacy Protection Agency opened preliminary rulemaking on April 20, 2026 on how the CCPA applies to employee, job applicant and independent contractor information, so check for any proposed or final regulations before relying on current practice.

For a fleet, that reaches well beyond the HR file. A company driver's information sits in the ELD, the telematics platform, the dashcam system, the dispatch or delivery app, safety scorecards, vehicle inspection reports and payroll records. Each of those systems may hold data a driver can ask about.

Residency, not the route, is the usual starting point. A driver who lives in California and runs interstate is generally in scope; a Nevada-based driver who passes through the state raises different questions. Mixed fleets should settle the approach with counsel rather than deciding request by request.

Which rights reach which fleet records?#

Each CCPA right reaches a different slice of fleet data, and each comes with limits that counsel applies to the facts. The table maps the rights to the records a carrier or private fleet usually holds.

What should a driver privacy notice cover?#

A driver privacy notice should describe each category of fleet data in plain terms, the purpose for each and how long each category is kept. Generic HR notices often skip telematics and cameras entirely, which is the gap a California driver is most likely to raise.

• 1Location: GPS breadcrumbs, geofence events and stop locations, and whether tracking continues off duty or during personal conveyance.
• 2Hours of service: ELD duty status, edits, annotations and unassigned driving events.
• 3Video and audio: road-facing and driver-facing cameras, what triggers recording and whether audio is captured.
• 4Driving behavior: harsh braking, speeding, following distance, phone use alerts and the resulting scores.
• 5Vendors: which platforms process the data on the company's behalf.
• 6Retention: how long each category is kept, and what overrides it, such as an open claim.

Precise location and camera data are the sensitive categories#

Precise location is the fleet data most likely to count as sensitive personal information under California law. Frequent telematics pings can show where a driver lives, parks overnight and spends breaks, and drivers may have a right to limit its use to purposes the job requires.

Running dispatch, proving delivery, logging hours of service and investigating a crash are uses tied to the job. Building a driver-level dataset for a third party is not. Driver-facing video adds questions under biometric and recording laws that vary by state, and audio raises consent issues of its own.

The practical step is to tag sensitive fields in each source system, so access requests, deletion reviews and any later licensing review all work from one field map instead of three separate ones.

Handling access and deletion requests against telematics systems#

Access and deletion requests against telematics systems are mostly a search problem, because one driver appears under different identifiers in each platform. The same person may be a login in the ELD, a name in the dispatch app, an employee number in payroll and an unlabeled face in camera footage filed under a truck number.

Telematics and camera vendors usually act as service providers, so their contracts should require them to help with requests. A contract that is silent on that point is worth fixing at renewal.

• 1Verify the request and the driver's identity through HR, not dispatch.
• 2Search each system by every identifier: login, employee number and truck assignment dates.
• 3Check for holds first: accident claims, workers' compensation files and litigation notices override deletion.
• 4Apply legal-obligation exceptions, such as hours-of-service records federal rules require the carrier to keep.
• 5Ask service providers to act on approved deletions under the contract's privacy terms.
• 6Log the response, any exceptions applied and the date the request closed.

What changes if you license fleet data?#

Licensing fleet data adds a separate CCPA question: is the company selling or sharing driver personal information, or providing data that is genuinely deidentified? A license of identifiable driver records can count as a sale, which brings opt-out rights and notice duties into play.

California law sets conditions before data counts as deidentified. Under Cal. Civ. Code 1798.140(m), the information must not reasonably be linkable to a particular consumer, and the business must take reasonable measures against re-association, publicly commit not to re-identify it and contractually bind any recipient to the same terms. Counsel should confirm a package meets them. In practice, most fleet packages drop driver identity, coarsen location and leave out driver-facing video, which also lowers the privacy burden that reduces net value under the SourceX Enterprise Data Value Framework.

Illustrative: a produce distributor answers a driver's request#

Illustrative: a fictional produce distributor runs a private fleet of refrigerated trucks in California, with ELDs and road-facing cameras on one telematics platform and a separate driver app for proof of delivery. A former driver sends an access request soon after leaving.

The privacy lead finds the driver's data in five systems and learns that the camera platform files clips by truck, not by driver. The team pulls clips by assignment dates, withholds frames that show other employees and keeps hours-of-service logs under the legal-obligation exception. The request closes within the required time.

The work pays off later. When leadership considers licensing delivery exception records, the field map already exists, so the team scopes out driver identity, stop-level location and all camera footage, and records the reasoning for counsel's review.

How SourceX approaches driver data#

Driver records get their closest scrutiny at two points in the SourceX five-step transaction. Rights review reads driver notices, telematics and camera contracts and any labor agreement before scope is set. Preparation then strips driver identifiers and coarsens or removes precise location, and driver-facing video stays out by default. The privacy record and release authorization sit in the SourceX Evidence Packet, and nothing moves without the fleet's sign-off.