California’s privacy regulator has launched its first-ever audit, signaling a new phase of active oversight under the California Consumer Privacy Act (CCPA) and its amendments. The California Privacy Protection Agency (CPPA) is focusing on delivery and transportation apps in the gig economy, examining how platforms collect and use personal information from both consumers and workers, and how individuals can exercise rights to know what data is collected, how it is used, and with whom it is shared.
The agency’s choice of sector is notable. Gig economy platforms (i.e., food delivery and transportation apps) often rely on highly sensitive and operationally important data, including geolocation data, behavioral and performance metrics, biometric data, communications records, and other information that may be used to make decisions about assignments, ratings, compensation, and account status. According to the CPPA, hundreds of consumer complaints and public comments during rulemaking in part prompted the audit by with officials noting particular concern about the rapid evolution of employee monitoring technologies and AI-enabled data practices.
As part of the audit, the CPPA plans to review platform policies and practices, request documentation and data, interview company personnel, and directly test app processes. The agency‘s inquiries will be narrowly focused and it plans to publish an industry compliance report similar to the Federal Trade Commission’s Rule 6(b) market studies. For companies operating in or adjacent to the gig economy, the audit is a reminder to pressure-test privacy notices, rights-request workflows, data sharing disclosures, employee and contractor privacy practices, retention schedules, and governance around sensitive data and automated decision-making before regulators come knocking.