On December 11th, President Trump signed an executive order directing federal agencies to review and potentially challenge certain state laws regulating artificial intelligence, including those that affect workplace decision making. While the order signals increased federal scrutiny of state AI regulation, it does not eliminate or suspend any existing laws. In California, AI-related employment requirements—such as disclosure obligations and protections against discriminatory decision-making—remain fully in effect unless and until a court or Congress takes action.

California businesses are already currently required to provide notifications of any data breach to the affected individuals “in the most expedient time possible and without unreasonable delay.” If a breach requires notice to more than 500 California residents, the business must provide a copy of the notification, to the Attorney General, who will make public the notification on its website.

A recent federal court ruling in California has created uncertainty for businesses that use website tracking technology. On November 18th, the Southern District of California allowed a lawsuit against Adidas to move forward, finding that its use of tracking pixels may violate the California Invasion of Privacy Act (“CIPA”). The court concluded that Adidas collected user data without obtaining affirmative consent—despite having a privacy policy—because that policy was not clearly presented to visitors. This ruling conflicts with other California decisions that have held there is no reasonable expectation of privacy in data like IP addresses and device identifiers, suggesting that

The California Courts of Appeal in Mora v. C.E. Enterprises, Inc. recently upheld a common pay model used by auto dealerships and similar businesses. The Court confirmed that a hybrid structure of paying service technicians an hourly wage, supplemented by a bonus based on completed “flag hours,” fully complies with state wage-and-hour law, including the rules governing piece-rate compensation under Labor Code § 226.2. The decision is a win for employers.

Beginning February 1, 2026, California employers will face a new annual obligation under Senate Bill 294: providing every current and newly hired employee with a stand-alone Workplace Know Your Rights Act Notice. This notice is separate from all existing Labor Code postings and must be distributed through the employer’s usual communication channels, such as email, text, or in-person delivery. The Labor Commissioner will issue a template notice by January 1, 2026, update it each year, and release educational videos by July 1, 2026, to help employers meet their obligations.

California’s recent PAGA reforms clarified several procedural and standing requirements, but one major issue remains unsettled: whether plaintiffs can pursue “headless” PAGA actions—those representative claims brought allegedly on behalf of other employees, without alleging any individual PAGA violations. This question in the past few years has created confusion and inconsistent outcomes across California courts, especially in pre-reform cases. The California Supreme Court is now poised to potentially resolve the issue in Leeper v. Shipt, Inc., expected in early 2026.

California Attorney General Rob Bonta recently reached a $530,000 settlement with Sling TV after alleging the company violated the California Consumer Privacy Act (“CCPA”). The lawsuit claimed Sling TV failed to provide consumers with a clear and simple method to opt out of the sale and sharing of their personal information, and that its website design used deceptive “dark patterns” to mislead users into thinking their data was protected when it was not. The complaint also alleged inadequate safeguards for children’s privacy. In addition to the monetary penalty, Sling TV agreed to revise its opt-out processes, improve parental controls, and