California AI Data Privacy: What Instacart Riders Need by

AI notetakers are everywhere now, and gig workers like Instacart riders in San Francisco are using them, which brings up some tough questions about data security. A new law in California is trying to draw a clear line for what data rights independent contractors have which will change how these AI tools can be used and what companies have to do to stay on the right side of the law. This creates new responsibilities for the platforms and new rights for their workers. So, what should you actually be doing to get compliant?

California Assembly Bill 289: Expanding Data Privacy for Independent Contractors

California’s new Assembly Bill 289 (AB 289) is a big deal for independent contractors, extending serious data protections to them across the state. The law is signed and goes into effect on January 1, 2026, building on existing privacy rules to specifically tackle the problems we’re seeing in the gig economy with tools like AI notetakers. It’s a recognition that the old lines between employees and contractors are pretty blurry now, especially when it comes to the data you generate while working. The bill really drills down on how personal information is collected and used, including any data from AI tools that track worker performance or record conversations.

For a long time, independent contractors were stuck in a legal gray area, lacking the data protections that traditional employees had under laws like the California Consumer Privacy Act (CCPA) in a work context. AB 289 fixes that by defining independent contractors as “consumers” when it comes to their work data, which hands them a whole new set of rights. This means that data collected by platforms like Instacart from their riders, particularly anything an AI notetaker spits out, is now under much tighter control. Any business in California using a lot of contractors has to get its data practices in order before the deadline or face some serious penalties, including fines from the California Privacy Protection Agency and lawsuits from the contractors themselves.

Impact on Instacart Riders and AI Notetakers in San Francisco

If you’re an Instacart rider in San Francisco, AB 289 is going to affect you directly and immediately. A lot of riders are already using AI notetaker apps to stay organized, transcribing customer chats, logging delivery notes, or even analyzing conversations to figure out how to give better service. These apps are useful, but they also capture a ton of sensitive information about both the rider and the customer. Before this law, who owned that data and what could be done with it was confusing. Now, AB 289 makes it clear that riders have specific rights over that data, even if it’s on their personal phone but used for their Instacart gig.

Imagine a rider uses an AI app to record a customer’s delivery instructions. The AI could then chew on those notes to find patterns, suggest better delivery routes, or flag a difficult customer. Under AB 289, that rider now has the legal right to ask Instacart what data they’re collecting (if any), see how it’s being used, and demand that it be deleted. And if a platform like Instacart pushes its riders to use these tools, their responsibility for protecting the data becomes even greater, including what happens if that data gets shared with the AI’s developers. So if you’re delivering groceries to a house near Golden Gate Park or working through the Mission District, any AI-generated notes about those jobs get these new legal protections.

Defining “Personal Information” in the Age of AI

AB 289 changes the game by expanding what “personal information” means to include “inferences” an AI might draw about you to create a profile, covering everything from your work habits and attitudes to your abilities. This is a direct shot at how AI notetakers work. If an AI analyzes your customer interactions and creates a “profile” on your communication style or efficiency, that profile itself is now considered protected personal information, even without your name attached. You can’t ignore it.

The law also gets tough on what counts as “de-identified” and “aggregated” data. A platform can’t just strip out a name and claim the data is anonymous anymore, because AB 289 requires serious technical safeguards to prevent that data from being re-identified. My experience is that most companies have no idea how easy it is to re-link supposedly “anonymized” data back to a person. For example, an AI notetaker that logs the exact time and location of every Instacart delivery could easily be used to identify a specific rider by combining it with other public information. The law says businesses have to prove their de-identification methods work, which often means hiring outside auditors and investing in real privacy engineering. This is not simple.

Concrete Steps for Instacart and Other Gig Platforms

For companies like Instacart that depend on a contractor workforce in California, the grace period for AB 289 is gone. Time is up. Here’s the checklist of what needs to be done now:

1. Update Privacy Policies and Terms of Service: Your policies need to be rewritten to clearly state what data you collect from contractors, especially from AI tools, what you do with it, and who you share it with. They must be easy to find and understand.
2. Implement Data Access and Deletion Mechanisms: Contractors need a simple way to see their personal data, ask for corrections, and request deletion. This absolutely includes data that an AI generated about them. You need a process to handle these requests quickly.
3. Obtain Explicit Consent for AI Data Collection: If you’re going to integrate or even recommend an AI notetaker, you must get explicit, informed consent from contractors to collect and process their data. This can’t be buried in a 50-page terms of service agreement. It has to be obvious.
4. Conduct Data Protection Impact Assessments (DPIAs): Before you roll out any new AI tool that touches contractor data, you must run a DPIA to find and fix privacy risks. Being proactive here will save you from major headaches later.
5. Train Staff on New Regulations: Anyone at your company who handles contractor data needs to be trained on exactly what AB 289 requires and what your new policies are.
6. Review Third-Party Vendor Contracts: If you use a third-party AI service, you need to check that your contract forces them to comply with AB 289’s rules. At the end of the day, you’re responsible for what your vendors do with your contractors’ data.

For example, if Instacart puts an optional AI assistant in its app to help riders with orders, all the data that assistant processes falls under AB 289. The company has to tell riders exactly what’s being collected (voice recordings, location, efficiency scores), how it’s being used (for performance reviews, route planning), and give them an easy way to opt out or delete their data. This isn’t about legal box-checking. It’s about building a trusting relationship with your workforce.

Concrete Steps for Instacart Riders and Independent Contractors

As a contractor, whether you’re an Instacart rider in San Francisco or working elsewhere in the state, you can’t just sit back. These new rights are only as good as your willingness to use them, so you have to take steps to protect yourself.

1. Review Platform Privacy Policies: Actually read the privacy policies and terms of service for platforms like Instacart. Find the sections that talk about data collection from contractors and the use of AI.
2. Exercise Your Rights: If you use an AI tool for work, ask the platform what data it has on you, what it’s for, and tell them to delete it if you want. Keep a record of your requests.
3. Be Mindful of Personal AI Tool Usage: If you’re using your own AI notetaker app, read its privacy policy. Know what data you’re feeding it and who might get access to it down the line.
4. Demand Transparency: Don’t be afraid to ask platforms direct questions about how they’re using AI to generate performance insights about you. You have a right to a straight answer.
5. Seek Legal Counsel: If you feel your data rights under AB 289 have been ignored or violated, talk to a lawyer who specializes in privacy or labor law. They can tell you your options, like filing a complaint with the California Privacy Protection Agency.

AI notetakers are helpful, but they’re also data vacuums. The good news is that as a contractor, you now have the power to control that data. If an AI app on your phone records a customer’s gate code for a delivery in the Marina District, you have the right to ask Instacart (if they can access that data) to explain what they’re doing with it or just delete it. This isn’t some abstract legal theory. It’s a practical tool that you need to actively use.

The Role of Data Security in Compliance

AB 289 isn’t just about privacy rights. It’s also about data security. The law demands that any personal information you collect, especially with AI tools, must be protected with reasonable security measures. This forces platforms to have strong cybersecurity protocols in place to stop data breaches and prevent contractor data from being misused. The California Attorney General’s Office has made it clear that “reasonable security” isn’t a fixed target, it changes as technology and threats change, which means platforms can’t just install some security software and call it a day. It requires constant monitoring and testing.

For instance, if an AI notetaker’s transcribed conversations are stored on a cloud server, that server better have strong encryption, multi-factor authentication, and be subject to regular security audits. I’ve seen firsthand how bad it gets when data security is weak, and a breach of contractor data, even from a third-party AI tool, can destroy a platform’s reputation and lead to massive legal bills. The cost of a breach (notifications, credit monitoring, lawsuits) is always more than the cost of setting up good security in the first place. It’s not a place to cut corners, and California has signaled it will hold companies accountable.

Future Trends and What to Expect

The law around AI and data privacy is changing fast, and while AB 289 is a big move, it won’t be the last. We should probably expect more regulations coming down the pike to address things like algorithmic bias in performance reviews and the impact of generative AI on personal data. The California Privacy Protection Agency (CPPA) will almost certainly release more specific guidance and start taking enforcement actions that clarify what AB 289 means in practice. For businesses, compliance isn’t a one-and-done project but a continuous process of responsible data management. For contractors, it means staying aware of your rights as technology keeps changing how we work. What do you think comes next?

The bottom line is that both gig platforms and their independent contractors need to pay close attention to California’s data privacy laws. Getting ahead of AB 289’s requirements is the only way to avoid legal pitfalls and build a working relationship that isn’t founded on data paranoia.