California Security Camera Laws for Businesses: What Owners Need to Know

California does not regulate business security cameras through a single statute. Compliance depends on where cameras point, whether they capture audio, how footage is used, and whether the system monitors employees. A camera system that is perfectly legal in a warehouse loading dock may create liability in a breakroom, and a video-only system can become a criminal exposure the moment someone enables the microphone.

For California business owners and facility managers, the practical answer is to treat security cameras as both a physical security decision and a legal compliance decision. This guide explains the main rules, where they overlap, and how to plan a commercial installation that supports security without creating avoidable risk.

The Short Answer: What California Law Requires of Business Security Cameras

Video-only surveillance is generally permitted in common work areas such as entrances, lobbies, sales floors, warehouses, parking lots, and exterior perimeters, provided the cameras do not capture spaces where people have a reasonable expectation of privacy. Cameras are prohibited in restrooms, locker rooms, changing areas, lactation spaces, and similar private spaces. Audio recording is governed separately: California is an all-party consent state, so recording confidential conversations without every participant’s consent can create criminal and civil liability. Businesses that meet CCPA thresholds must also treat identifiable footage as personal information and provide appropriate notice.

California’s Overlapping Legal Frameworks

California regulates commercial video surveillance through at least four independent layers. Satisfying one does not automatically satisfy the others, and a single camera can trigger more than one framework at the same time.

Penal Code 632 and CIPA: Audio Is Different From Video

The California Invasion of Privacy Act, codified in Penal Code sections 630 through 638.55, governs audio recording and eavesdropping. Penal Code 632 prohibits intentionally recording a confidential communication without the consent of all parties. A confidential communication is one where the circumstances reasonably indicate that at least one party wants the conversation confined to those present. Workplace conversations, private meetings, and telephone calls can qualify.

The statute carries criminal penalties and separate civil exposure. A business that enables audio on a camera system without a clear legal basis may face claims even if it never intended to record a private conversation. For most commercial deployments, the safest operational choice is to disable audio at the camera or recorder level unless legal counsel has specifically approved an audio use case.

Penal Code 647(j): Camera Placement and Reasonable Expectation of Privacy

Penal Code 647(j) addresses visual surveillance of private spaces. It prohibits recording in bathrooms, bedrooms, changing rooms, fitting rooms, dressing rooms, and other areas where the occupant has a reasonable expectation of privacy. The analysis is location-specific. Open offices, lobbies, and parking areas generally present different privacy questions than enclosed private offices or employee changing areas.

Camera angle matters as much as camera location. A camera mounted in a hallway can violate the statute if its field of view reaches into a restroom or locker room. Privacy masking, physical barriers, and careful lens selection are part of compliance, not just design preference.

Labor Code 435: Workplace Surveillance Restrictions

Labor Code 435 prohibits private and public employers from causing an audio or video recording of an employee in a restroom, locker room, or room designated for changing clothes, unless authorized by court order. A recording made in violation of the section cannot be used by the employer for any purpose.

This is a workplace-specific layer that sits on top of the general privacy rules. It applies to employee spaces even when the employer owns the building and even when the camera is visible.

CCPA and CPRA: Footage as Personal Information

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, defines personal information broadly enough to include visual and electronic information that identifies or could reasonably be linked to a particular consumer or household. Identifiable camera footage can fall within that definition. Businesses that meet CCPA’s revenue or data-processing thresholds may owe notice-at-collection, access, deletion, and retention obligations for surveillance footage.

If analytics software processes footage to identify individuals through facial recognition or gait analysis, the data may also be treated as sensitive personal information, which carries additional obligations. Even businesses outside CCPA thresholds still face common-law privacy claims and California Constitution privacy arguments, so the absence of a statutory obligation is not the same as the absence of risk.

Where Businesses Can and Cannot Place Cameras

California businesses generally may place video-only cameras in common areas for legitimate security purposes. Typical acceptable locations include building entrances and exits, reception areas, sales floors, warehouse aisles, cash-handling areas, parking lots, loading docks, and exterior doorways. These areas are usually visible to employees and visitors, and the privacy expectation is lower.

Cameras should not be placed in restrooms, showers, locker rooms, changing rooms, lactation rooms, or any other space where employees or visitors reasonably expect privacy. Breakrooms and employee lounges require more careful analysis. Current law does not prohibit all breakroom cameras, but pending legislation and recent regulatory attention have increased scrutiny of employee-only spaces. A camera that watches a breakroom entrance for security is different from a camera that monitors how long employees sit at a table.

Private offices and closed-door meeting rooms also deserve review. A camera in a private office may capture confidential business discussions, personnel conversations, or activities unrelated to security. If a camera is necessary for after-hours intrusion detection, motion-triggered recording and privacy masking can reduce unnecessary capture.

Audio Is the Highest-Risk Feature on Most Commercial Cameras

Many modern IP cameras ship with built-in microphones. Installers often leave audio enabled because it is a default setting, not because the business has a legitimate audio surveillance plan. In California, that default can be expensive.

Penal Code 632 applies to confidential communications, and the test is whether the circumstances reasonably indicate that a party wanted the conversation confined. A private conversation in an office, a meeting room, or a phone call can meet that definition. Recording it without all-party consent can lead to criminal penalties and civil claims. The statute also limits the admissibility of unlawfully recorded evidence in legal proceedings.

The practical rule for most commercial projects is straightforward: if the business does not have a documented, counsel-approved reason to capture audio, disable it. Video-only surveillance avoids the CIPA audio problem entirely and still supports the majority of security and operational use cases.

Workplace Surveillance: Policies, Notice, and Employee Rights

California employers have legitimate reasons to monitor premises, including theft prevention, workplace safety, and property protection. The legal risk increases when surveillance is hidden, poorly documented, or used in ways that intrude on protected activity.

A written surveillance policy should explain what is monitored, where cameras are located, why the data is collected, who can access it, and how long it is retained. Employees should receive the policy at hire and whenever it changes. Visible signage at entrances and in monitored areas supports transparency, even where no statute expressly requires a sign for video-only recording.

Employers should also avoid using cameras to monitor union organizing, protected concerted activity, or employee conversations about working conditions. Surveillance that chills protected activity can create labor-law exposure separate from privacy law.

California is also tightening workplace surveillance rules. Assembly Bill 1331, scheduled to take effect January 1, 2027, adds new limits on surveillance tools in employee-only spaces, including bathrooms, locker rooms, changing areas, breakrooms, cafeterias, lactation spaces, and lounges. Employers should review camera placement and monitoring policies before that date rather than waiting for a complaint.

Data Privacy Obligations Under CCPA and CPRA

Businesses that meet CCPA thresholds should treat camera footage like any other category of personal information. That means providing notice at or before collection, limiting retention to what is reasonably necessary, securing the footage, and honoring applicable access and deletion requests.

Retention is a common weak point. Many systems record continuously and retain footage for months because storage is inexpensive. A defensible retention schedule should reflect the business purpose. If footage is kept longer than necessary, the business increases both privacy exposure and storage costs.

Access control is equally important. Camera systems should use unique accounts, role-based permissions, and audit logs. Footage should not be exportable by every user, and recorded video should be encrypted in transit and at rest where the platform supports it. These are security controls, but they also support privacy compliance.

Technical and Installation Considerations That Affect Compliance

Compliance is not only a legal exercise. Camera placement, field of view, recording settings, and network design determine what the system actually captures.

• Lens selection and field of view: A wide-angle lens may reach into a private area even when the camera housing is mounted in a public hallway.
• Privacy masking: Many video management systems can block out sensitive regions, but masking should be verified after installation and after any camera adjustment.
• Audio defaults: Disable microphones at the camera, recorder, or management platform unless audio capture has been approved.
• PoE and network capacity: IP cameras draw power and bandwidth from the network. Undersized switches or poor cabling can cause dropped frames, recording gaps, and unreliable playback.
• Storage planning: Resolution, frame rate, retention period, and motion-based recording all affect storage requirements. A system designed without enough storage may overwrite footage before an incident is investigated.
• Cybersecurity: Cameras are network devices. Default passwords, outdated firmware, and flat network designs can expose footage and create a path into other business systems.
• Documentation: As-built drawings, camera schedules, IP addresses, and retention settings make future audits and troubleshooting far easier.

California businesses should also confirm that the installing contractor holds the appropriate license for the scope of work. Commercial camera projects that involve low-voltage cabling typically fall within the C-7 Low Voltage Systems classification, and projects may require coordination with the authority having jurisdiction over permits and inspections. Requirements vary by building type and project scope, so the contractor and the business should confirm local requirements before work begins.

Common Compliance Mistakes California Businesses Make

Leaving audio enabled by default. This is the most common and most avoidable CIPA risk. If the business has not approved audio capture, turn it off.

Pointing cameras too broadly. A camera intended for a hallway or entrance should not see into a restroom, locker room, or changing area. Field-of-view checks belong in the design phase, not after a complaint.

Treating breakrooms as ordinary common areas. Breakrooms and lounges are employee-only spaces with higher privacy sensitivity. Camera placement should be limited and documented.

Using hidden cameras without a policy. Covert surveillance in common areas is legally risky and can damage employee trust. Visible, disclosed cameras are easier to defend.

Ignoring retention and access controls. Keeping footage indefinitely and allowing broad access increases privacy and security exposure.

Hiring an unlicensed installer. Low-voltage work is regulated in California. A properly licensed contractor helps ensure the installation meets applicable codes and can coordinate inspections where required.

How ITTC Approaches Commercial Camera Projects

“A compliant camera system starts with placement and network design, not the camera box. We look at what the lens can see, whether audio is needed, how footage is stored, and how the system connects to the rest of the network before anything is mounted.”

— Abner Navarro, Network Support Specialist, ITTC

ITTC approaches commercial security camera projects as infrastructure projects, not standalone hardware purchases. The process begins with an assessment of the site, the business’s security objectives, and the areas that must be excluded from view. That assessment informs camera selection, lens choice, cabling pathways, and network requirements.

Because cameras depend on network connectivity and power, ITTC coordinates commercial security camera installation with the underlying network infrastructure and structured cabling. This matters in older buildings where existing cabling, switch capacity, or rack space may not support additional PoE devices without upgrades.

For businesses that need ongoing oversight, ITTC can connect camera systems to managed network services and IT support services so that firmware updates, access control, storage health, and network performance are monitored after installation. As a California C-7 low voltage contractor, ITTC can also coordinate the low-voltage scope with the broader technology plan, including server room and MDF/IDF connectivity where the project requires it.

Frequently Asked Questions

Can California businesses record video without employee consent?

Video-only recording in common work areas is generally permitted without employee consent, provided the cameras do not capture private spaces where employees reasonably expect privacy. However, disclosure through a written policy and visible signage is strongly recommended. Audio recording is treated differently and generally requires all-party consent for confidential communications.

Do security cameras need to capture audio in California?

No. Most commercial security use cases do not require audio, and disabling microphones is the simplest way to reduce CIPA exposure. If a business believes it has a legitimate need for audio, legal counsel should review the specific use case, location, and notice practices before audio is enabled.

Are cameras allowed in California breakrooms?

Current law does not ban all breakroom cameras, but breakrooms are employee-only spaces with heightened privacy sensitivity. Cameras should be limited to entrances or security-relevant areas, and monitoring should not extend to how employees use the space. Assembly Bill 1331, effective January 1, 2027, adds further restrictions on surveillance in breakrooms and other employee-only areas.

Does CCPA apply to security camera footage?

CCPA can apply when camera footage identifies or could reasonably be linked to a particular person and the business meets the law’s coverage thresholds. Covered businesses should provide notice at collection, limit retention, secure footage, and honor applicable access and deletion rights. Businesses outside CCPA thresholds still face other privacy laws and should not assume footage is unregulated.

Who can install commercial security cameras in California?

Low-voltage camera cabling is typically installed by a licensed C-7 Low Voltage Systems contractor. Some projects may also involve a C-10 electrical contractor depending on scope. Businesses should verify the contractor’s license status and confirm whether the local authority having jurisdiction requires permits or inspections for the specific project.

What should a workplace camera policy include?

A written policy should describe the purpose of surveillance, the locations where cameras are used, the types of data collected, who may access footage, retention periods, and the consequences of misuse. It should be provided to employees and updated when camera systems or monitoring practices change.

Planning a Security Camera Project in California?

California security camera compliance depends on placement, audio settings, employment policy, and data handling. A system that is technically functional can still create legal and operational risk if those pieces are not coordinated.

If your business is planning a new camera system, expanding an existing one, or reviewing whether current cameras are placed and configured appropriately, ITTC can assess the environment and help align the physical infrastructure with the network and security requirements. Request a consultation with ITTC to discuss your project.

Edit