Today, California Attorney General Rob Bonta released a statement that his office has sent letters to businesses requesting information about their compliance with CCPA with respect to personal information of employees and job applicants. Below are some quick thoughts:

• To my knowledge, this is the first public announcement regarding enforcement of employee and job applicant data. If your company has employees or job applicants in California, make sure you address CPRA compliance with respect to their data.
• It is unclear whether these letters relate to enforcement of the CCPA or the CPRA. Technically, the exemption for employee and job applicant data under CCPA ended in January 2023, so it is very possible these letters relate to CCPA obligations. CPRA enforcement started on July 1, 2023, so it is also possible these letters relate to CPRA obligations. If they relate to CPRA, then, to my knowledge, this is the first public announcement regarding enforcement of CPRA.
• The statement does not explain how the AG’s Office chose which businesses to investigate, other than stating that the employers are “large California employers.” My guess is they sent letters to businesses with thousands of employees based in California.
• The statement does not frame the letters as “warning letters” but rather letters requesting information about compliance. It will be interesting to see what types of information the AG’s Office is looking for to help satisfy the inquiries.
• These letters serve as a reminder that the AG’s Office is digging into business practices. While consumer facing privacy policies and opt-outs are low-hanging fruit, the AG’s Office is very sophisticated and has been actively looking into actual practices and data flows, not just cursory reviews of policies and opt-out language.