A California employer can be liable when a customer, client, patient, or vendor harasses an employee, but only if the employer knew or should have known and didn’t act. Government Code section 12940(j)(1) says an employer “may also be responsible for the acts of nonemployees” in that situation. It’s a negligence standard, not strict liability. The employer’s defense usually depends on when managers learned of the conduct and how they responded.
When is an employer liable for a customer’s harassment?
When the employer, or its agents or supervisors, knew or should have known about it and failed to respond. The statute covers harassment by nonemployees of “employees, applicants, unpaid interns or volunteers, or persons providing services pursuant to a contract in the workplace,” and it attaches liability if the employer “knows or should have known of the conduct and fails to take immediate and appropriate corrective action.”
That’s the same knowledge-and-response standard California applies to coworker harassment. It isn’t the stricter rule for supervisors, where the employer is liable for a supervisor’s harassment regardless of what it knew. For customers and other outsiders, notice comes first. An employer that never heard about the conduct and had no reason to know of it has a strong defense.
Notice can come from places employers overlook. A complaint to a shift lead counts if the shift lead is a supervisor. So can a comment in a team chat that a manager read, a pattern of incident reports involving the same customer, or a security log. “Should have known” means the company can’t avoid notice by not asking.
Does it matter how much control the employer has over the customer?
Yes, and that’s where much of the defense lives. The statute directs that “In reviewing cases involving the acts of nonemployees, the extent of the employer’s control and any other legal responsibility that the employer may have with respect to the conduct of those nonemployees shall be considered.”
An employer can’t fire a customer the way it can fire an employee. What it can do depends on the business. A store can ban a shopper. A hospital can reassign a nurse but usually can’t discharge a sick patient. A staffing client controls its own premises but not the staffing agency’s worker schedules. The response a jury should expect varies accordingly, and the employer’s lawyers should frame the case around what the company could realistically do.
Control cuts both ways, though. In Carter v. Department of Veterans Affairs (2006) 38 Cal.4th 914, a nurse at a state veterans home was harassed by a resident. The opinion recounts that the home’s administrator “acknowledged that VA residents were subject to a code of conduct that prohibited them from engaging in sexual harassment,” and that “the VA could evict residents for misconduct.” An employer with written rules and real sanctions for outsiders will be asked why it didn’t use them.
What did the Supreme Court decide in Carter?
That the nonemployee language applies even to conduct that predated it. The Legislature added the language in 2003 after a Court of Appeal held that a bus company wasn’t liable when a passenger harassed a driver. The Supreme Court held, “We conclude the amendment merely clarified existing law and therefore does apply to this case.”
The court still sent the case back. The plaintiff argued that control had always been part of the employer’s duty to take reasonable steps. The court responded that “the broad rubric of reasonableness may not have afforded either the VA or the jury the opportunity to focus on the explicit elements articulated in amended subdivision (j)(1).” For employers, that’s the useful part. Control and legal responsibility are explicit elements, and a defense that doesn’t build the record on them gives up an argument it could have made.
The 2003 amendment addressed sexual harassment only. The current statute applies to “harassment” by nonemployees without that limit, so harassment based on race, religion, or any other protected characteristic is covered too.
What does an adequate response look like?
The statute asks for “immediate and appropriate corrective action,” and the response that’s appropriate depends on what the employer controls. In most cases it means documenting the report, telling the employee what will happen, and then acting against the outsider, not the employee.
A response that moves the burden onto the complaining employee is the one that loses cases. Changing the employee’s shift, cutting their hours, or pulling them off a lucrative account to avoid the customer can look like a penalty for complaining. If the employee asks for a reassignment, document that it was their request. If the company makes the change on its own, it should be at least as good a position.
Escalation should match the conduct. A first crude remark might warrant a warning to the customer and a note in the account. Touching, threats, or repeat conduct warrant a ban, a refusal of service, or a call to security or police. The Carter opinion describes a supervisor who advised the nurse “to have no contact” with the resident and gave her a walkie-talkie to call security, after which the harassment continued. Steps that leave the outsider’s behavior untouched rarely look adequate after the fact.
How do the third-party harassment elements line up?
| Element | Source | What the employer shows in defense | Evidence |
|---|---|---|---|
| Harassment by a nonemployee in the workplace | Gov. Code § 12940(j)(1) | Conduct wasn’t severe or pervasive, or wasn’t based on a protected characteristic | Witness accounts, video, incident logs |
| Employer knew or should have known | Gov. Code § 12940(j)(1) | No report reached a supervisor or agent, and no pattern put it on notice | Complaint channels, manager messages, incident reports |
| Failure to take immediate and appropriate corrective action | Gov. Code § 12940(j)(1) | Prompt, proportionate steps against the outsider | Dated warnings, bans, security calls, account notes |
| Extent of control and legal responsibility over the nonemployee | Gov. Code § 12940(j)(1); Carter | Limited practical or legal authority over the outsider | Contracts, codes of conduct, property rights, regulatory limits |
What should an employer do once a customer harassment claim arrives?
These cases rise or fall on the timeline of notice and response. Pin it down early.
- Put a litigation hold on the incident reports, security video, customer account notes, team chats, scheduling records, and the harassment policy and training records for the managers involved.
- Calendar the response deadline on the CRD complaint, demand letter, or lawsuit, and check for an arbitration agreement and an employment practices liability (EPLI) policy that requires prompt notice.
- Identify who first heard about the conduct and what each manager did, and freeze any schedule or assignment change that could look like retaliation.
- Gather the contracts, codes of conduct, and site rules that establish what authority the company actually had over the customer, patient, or vendor.
- Talk to a lawyer before contacting the customer or the employee about the claim, or before offering anything to settle it.
Companies looking for employer defense in California employment cases can find more on the firm’s practice page.
Customer harassment questions from California employers
Are we liable if an employee never complained?
Not automatically. The statute asks whether the employer “knows or should have known of the conduct.” If a supervisor saw it, if coworkers reported it, or if the same customer had a documented history, the absence of a formal complaint won’t help much. If none of that happened, lack of notice is usually the employer’s strongest defense.
Does this cover vendors and contractors on our site?
Yes. The statute speaks of “nonemployees” generally, which reaches vendors, delivery drivers, contractors’ crews, and patients as well as customers. It also protects people who aren’t the employer’s employees, including “persons providing services pursuant to a contract in the workplace.” A company with multiple contractors on one site should know whose people it controls and who to call when a crew member crosses the line.
Can we tell employees to just ignore a difficult customer?
Not when the conduct is harassment. Telling an employee to tolerate it is the opposite of the statute’s demand for “immediate and appropriate corrective action.” Businesses with customer-facing staff should give managers a written escalation path, from a warning to a refusal of service, and the authority to use it without waiting for approval from headquarters.
Is a hostile customer always a harassment problem?
No. Rude, angry, or abusive customers aren’t harassment under FEHA unless the conduct is based on a protected characteristic such as sex, race, religion, or disability. General abuse and threats can still raise workplace safety obligations, including California’s workplace violence prevention rules, so they shouldn’t be ignored either.
If a harassment claim involves a customer or vendor
If your company has received a CRD complaint or lawsuit over harassment by a customer, patient, or vendor, what managers knew and how much control the company had over the outsider usually decide how much of it is real. Rosenberger + Kawabata represents employers defending employment lawsuits and claims through its business litigation practice, including claims involving harassment by customers and other nonemployees. Contact Rosenberger + Kawabata online for a confidential consultation, or call (310) 894-6921.
Sources
The statute is Government Code section 12940, subdivision (j)(1). The decision is Carter v. Department of Veterans Affairs (2006) 38 Cal.4th 914, a published decision of the California Supreme Court.
This post is general information about California employment law as of November 7, 2026. It is not legal advice, and reading it does not create an attorney-client relationship. Employment statutes, regulations, and court decisions change often, and the outcome of any claim depends on its facts. Past results do not guarantee future outcomes.