Does CCPA apply to job applicants and candidate data?

Does the CCPA cover job applicants now?#

The CCPA covers job applicants who are California residents, because the law defines consumers broadly enough to include applicants, employees and independent contractors. A temporary exemption for employment and business-to-business information was first adopted in October 2019 through AB 25, and the CPRA later set its sunset at January 1, 2023. The legislature ended its 2022 session without extending it, so the exemption expired on that date.

Even while the exemption applied, the CCPA's data breach provisions, including the private right of action for breaches, already reached employee and applicant data. The rules are still moving: on April 20, 2026 the California Privacy Protection Agency opened preliminary rulemaking on how the CCPA applies to employees, job applicants and independent contractors, with comments accepted through May 20, 2026. Check with counsel for any proposed or final regulations that followed.

The practical result is that a candidate who uploads a resume through your careers page, replies to a recruiter's message or sits for a recorded video interview can exercise the same rights as a customer of a retailer. The law reaches the business, not the job location, so a firm headquartered in another state can still be covered when it recruits Californians.

Coverage also depends on thresholds tied to annual gross revenue, to the volume of consumers' personal information a business buys, sells or shares, and to the share of revenue earned from selling or sharing it. The revenue figure is adjusted over time, so check the current text rather than an old compliance memo.

Which candidate records count as personal information?#

Candidate personal information under the CCPA is any record that identifies, relates to or could reasonably be linked to a candidate. In a staffing or consulting firm that reaches far beyond the resume.

• 1ATS records: profiles, parsed resumes, submissions, interview stages, placements and recruiter notes in systems such as Bullhorn.
• 2Communications: email threads, texts sent from a recruiting text platform, exported platform messages and call recordings.
• 3Assessments: skills tests, interview scorecards, video interview recordings and transcripts produced by AI note-takers.
• 4Onboarding files for placed workers: tax forms, right-to-work documents, background check results and payroll details.
• 5Inferences: match scores, fit ratings and tags that a recruiter or a tool assigns to a person.

Sensitive personal information in candidate files#

Sensitive personal information is a narrower category with its own rules, and candidate files hold more of it than most recruiters realize. Social Security and driver's license numbers, passport details, and voluntary self-identification answers about racial or ethnic origin or health typically sit in onboarding and compliance modules that recruiters rarely open.

Candidates can ask a business to limit its use of sensitive information when the business uses it beyond the purposes the regulations permit. If those fields feed only payroll, background checks and required reporting, the analysis is simpler than if anyone pulls them into matching, analytics or marketing. Keep the fields walled off and document who can see them.

Rights and duties for agencies at a glance#

Agency rights and duties under the CCPA fall into two groups: what candidates can ask for, and what the firm must do without being asked. The table pairs each one with the record work it creates inside a recruiting operation.

Response deadlines, verification rules and the request methods you must offer are set in the statute and regulations. Build your request workflow from the current text with counsel rather than from a template written for consumer retail.

Is submitting a candidate to a client a sale?#

Submitting a candidate to a client is not automatically a sale under the CCPA, but it is not automatically exempt either. The answer depends on whether the disclosure is made for valuable consideration, whether the candidate directed it, and whether the client receives the profile as a third party or handles it under your instructions.

A firm that submits a candidate only after the candidate approves a specific role stands in a different position from one that circulates unsolicited profiles to many clients to generate demand. Recruitment process outsourcing adds another layer: when you recruit under a client's brand and instructions, you may be that client's service provider or contractor, and the law expects a written contract with use restrictions.

Write down how each flow works in your firm, then have counsel classify it. That classification drives your notice language, your opt-out mechanics and your client contract terms.

What can a firm keep after a deletion request?#

A firm can keep candidate records after a deletion request when an exception applies, such as a legal obligation to retain them or the need to complete a transaction the candidate asked for. Employment, tax and anti-discrimination rules require many employers to keep certain hiring and payroll records, so a placed contractor's onboarding file is treated differently from a passive candidate's profile.

The mistake to avoid is applying an exception to the whole record. Keep the documents the exception actually covers, delete or suppress the rest, and record the reasoning. Recruiter notes, match scores, marketing lists and duplicate resumes are rarely needed to meet a retention law.

Deletion also has to reach service providers. If your assessment vendor, texting platform or video interview tool holds copies, the request flows to them under your contract.

Illustrative: a staffing firm handles its first deletion request#

Illustrative: a fictional IT staffing firm with recruiters in Texas and California receives a deletion request from a California software engineer it once placed on a contract assignment. The engineer's records sit in Bullhorn, in a recruiter's Outlook folders, in a texting tool and in the payroll system used for placed contractors.

The privacy lead deletes the ATS profile, parsed resumes, recruiter notes and text history, and instructs the texting vendor to do the same. Payroll records, tax forms and the right-to-work file stay, because counsel confirms retention obligations apply. The firm replies explaining what was deleted, what was kept and why, then adds a deletion step to its offboarding checklist for placed contractors.

Other states, other laws and the SourceX view#

Many other state comprehensive privacy laws carve out data collected in an employment context, which is why California usually drives candidate-privacy work for US firms. The Colorado Attorney General, for example, states that the Colorado Privacy Act does not cover individuals acting in an employment context such as a job applicant, and the Virginia Consumer Data Protection Act generally excludes employment-context information with no sunset on that exemption. Check each newer state law's consumer definition rather than assuming the same carve-out.

Candidate data can also fall under background check rules, anti-discrimination recordkeeping, state and local rules on automated hiring tools, and GDPR for candidates in the EU or UK. California rules on automated decision-making technology may also reach AI screening tools, so confirm current duties and effective dates with counsel.

SourceX treats candidate personal information as out of scope by default when a staffing or consulting firm explores licensing records to AI developers. The Rights step of the SourceX five-step transaction reads the firm's candidate notice, client contracts and vendor terms first, and the fit check collects only metadata. Where firm-owned process records remain, such as job order workflows with personal details removed, whether they meet California's definition of deidentified information is assessed with counsel deal by deal and recorded in the privacy record of the SourceX Evidence Packet.