California’s landmark consumer privacy law expanded on New Year’s Day, thanks to a ballot measure voters approved in 2020.

It builds on existing privacy law requiring companies to disclose the data they collect from consumers, how they use it and who they share it with. It also gives California residents the right to request that their data be corrected, deleted or not sold.

For the first time, these requirements now also apply to employers.

If you’ve ever encountered those boxes at the bottom of virtually every website asking about your data privacy preferences, you know California privacy law has far-reaching effects. Its application to employers will too, according to employment attorney Darcey Groden with Fisher Phillips.

“Given the vast amount of data that California employers have about their employee just by the nature of the employment relationship, [it] is going to be very tricky,” she said.

The law applies to employer data from any employee, job applicant, independent contractor or even an emergency contact who resides in California.

While many companies already have the infrastructure for dealing with consumer data, the employment relationship is much more involved, Groden said. “There’s just a lot of constantly catching data in the employment context.”

Typically, you’ve got your human resources file, health care information, emails and surveillance footage — all of these will need to be accounted for. That means a lot of additional work for HR departments, per Lothar Determann, an attorney at Baker McKenzie who teaches privacy law at the University of California, Berkeley.

“This law is very complex,” he said. “It’s going to be costly to comply with it.”

It will be a particular challenge for companies that aren’t consumer-facing, per Zoe Argento, an attorney at Littler Mendelson. Think manufacturing and construction companies, for instance.

“They typically don’t have a privacy department, so this is very new to them,” Argento said.

Companies that have a lot of workers and collect a lot of data, like gig platforms, could also be significantly affected.

“Those companies are just such a black box,” said Lindsey Cameron, a management professor at the Wharton School.

More disclosure could bring greater transparency about how these platforms use worker data to program their algorithm, she added.

But the disclosures — like those boxes at the bottom of every website — will likely be such a fire hose of details that they might not mean much to workers, Cameron said.

“There’s no way a worker can really make an informed choice around it.” But, she added, the data could help people like her, who study worker privacy.