California continues to police artificial intelligence (“AI”) in the workplace. Following proposed rulemaking on the use of AI for significant employment decisions, as we reported here, Assemblymember Isaac Bryan introduced Assembly Bill 1221 (“AB 1221”) this legislative session. The bill aims to regulate workplace surveillance tools, including AI, and use of employee data derived therefrom. Applicable to employers of all sizes, AB 1221 could present significant challenges for businesses.

Key Provisions of AB 1221

If enacted, AB 1221 would regulate workplace surveillance tools and the data they collect. The bill broadly defines a “workplace surveillance tool” to encompass any system or device that actively or passively collects or facilitates the collection of worker data, activities, communications, biometrics and behaviors and includes incremental time-tracking tools, geolocation, and photo-optical systems, among others. The bill has several key provisions that will impact businesses:

• Notice:  Employers will be required to provide written notice to employees 30 days before using any surveillance tool, detailing the data collected, its purpose, frequency, storage, employment-related decisions, and workers’ rights to access and correct their data.
• Data Security: The bill also sets forth robust measures to protect employee data, including required provisions in employer contracts with vendors they engage to analyze or interpret employee data.
• Prohibited Technologies:  The bill bans the use of facial, gait, neural data collection, and emotional recognition technologies.
• No Collection of Protected Characteristics: AB 1221 prohibits employers altogether from using surveillance tools to infer an employee’s immigration status, veteran status, ancestral history, religious or political beliefs, health or reproductive status, history, or plan, emotional or psychological state, neural data, sexual or gender orientation, disability status, criminal record, credit history, or any other status protected under California’s Fair Employment and Housing Act.
• Limited Use in Disciplinary Actions: Employers are prohibited from relying exclusively on surveillance tools to make disciplinary decisions; to the extent they wish to rely on surveillance data at all for such decisions, employers must notify workers, allow data correction, and adjust personnel decisions within 24 hours if data challenged by the employee warrants it.
• Penalties and Civil Liability: AB 1221 delegates enforcement to the California Labor Commissioner and provides for a $500 civil penalty per employer violation. In addition, AB 1221 would create a separate private right of action for employees, pursuant to which they could obtain damages, injunctive relief, punitive damages, and attorneys’ fees and costs.

Areas of Uncertainty

While AB 1221 aims to establish a framework for workplace surveillance, several aspects of the bill remain ambiguous. For instance, the requirement to provide notice for “significant updates or changes” to surveillance tools is not clearly defined. Additionally, the bill does not specify who is responsible for determining what constitutes an “up-to-date cybersecurity safeguard.”

Also, “injured” employees presumably would be able to recover their “noneconomic” damages for alleged “physical pain and mental suffering” associated with violations of this statute, which is a common remedy sought in employment cases that could substantially increase the liability for employers. These ambiguities could lead to inconsistent enforcement and legal challenges, creating costly uncertainty for employers.

Current Status

As of May 7, 2025, the bill is headed back to the Assembly Appropriations Committee. If passed and signed by Governor Newsom, AB 1221 would establish some of the broadest workplace privacy regulations in the nation. We will continue to monitor its progress.