Third-Party Harassment in California Workplaces: When Customers, Vendors, and Clients Create Employer Liability

HOME › CALIFORNIA EMPLOYMENT LAW › HARASSMENT AT WORK › THIRD-PARTY HARASSMENT CALIFORNIA

Last updated: June 2026 — Reflects Government Code § 12940(j) as amended by SB 1300 (effective January 1, 2019), Raines v. U.S. Healthworks Medical Group (2023) 15 Cal.5th 519, and California Civil Rights Department enforcement guidance current as of January 1, 2026. Authored by JC Serrano, Founder — LRIS #0128.

Harassment at work does not always come from the person sitting in the next cubicle or from a manager who controls your schedule.

In California, some of the most persistent and legally complex harassment situations involve people who do not appear on the employer's payroll at all — a customer who makes sexual comments every time they visit a retail location, a client who sends racially degrading messages to a service provider's staff, a delivery vendor who makes unwanted physical contact, a patient who repeatedly targets a healthcare worker based on national origin.

These situations share a common feature: the employer did not initiate the conduct and did not employ the harasser. Under California law, neither fact provides a defense.

What Is Third-Party Harassment Under California FEHA

Third-party harassment occurs when a non-employee — a customer, client, patient, student, vendor, contractor, or visitor — engages in unwelcome conduct directed at an employee because of a protected characteristic, creating a hostile work environment or conditioning a tangible benefit on submission to the conduct.

The harasser has no employment relationship with the victim's employer, but the employer bears legal responsibility for the work environment in which the harassment occurs.

Government Code § 12940(j)(1) imposes liability on employers who fail to take immediate and appropriate corrective action once they know or should know of harassment by a non-employee. The statute does not require the employer to have caused the conduct. It requires the employer to have known about it and failed to stop it.

Before 2019, this provision covered only sexual harassment by non-employees. Senate Bill 1300, which took effect January 1, 2019, expanded third-party liability to every protected characteristic covered by FEHA — race, national origin, religion, disability, age, gender identity, sexual orientation, pregnancy, and all others.

A customer who directs racial slurs at a Black employee, a vendor representative who mocks an employee's accent, a client who makes repeated comments about an employee's disability — each scenario now carries the same legal exposure as a supervisor's sexual harassment.

How Third-Party Liability Compares to Internal Harassment

The liability standard for third-party harassment differs from the standard for supervisor and coworker harassment. Understanding where the standards converge and diverge is essential for both employees building a claim and employers assessing exposure.

Harasser Type	Knowledge Required	Corrective Action Defense	Personal Liability
Supervisor (tangible action)	Not required — strict liability	❌ No defense available	Yes (individual)
Supervisor (hostile environment)	Not required — strict liability	❌ No defense available	Yes (individual)
Coworker	Knew or should have known	✅ Prompt action limits exposure	Yes (individual)
Third party (non-employee)	Knew or should have known	✅ Prompt action limits exposure	Entity may be liable under Raines

The third-party standard tracks coworker harassment: the employer is not strictly liable, but becomes liable once it has actual or constructive knowledge and fails to take proportionate corrective action. The harassing individual cannot be sued under FEHA directly (they are not the employer), but the business entity they represent may face independent liability under the Raines framework discussed below.

The Legal Standard: Knowledge Plus Inaction

The employer's liability in third-party harassment cases turns on two elements. First, the employer must have known or should have known about the conduct. Second, the employer must have failed to take immediate and appropriate corrective action.

Knowledge is established either through actual notice — the employee reported the harassment to a supervisor or HR — or through constructive notice, meaning the conduct was sufficiently open and repeated that a reasonably attentive employer would have discovered it. A customer who harasses an employee in front of other staff, or a vendor representative whose conduct is widely known among the team, satisfies the constructive notice standard even without a formal complaint.

Immediate and appropriate corrective action is evaluated on specific facts. California courts do not require employers to achieve perfect outcomes — they require prompt and proportionate responses.

Depending on the severity and the employer's relationship with the third party, appropriate action may include warning the third party in writing, restricting their access to the premises or to the affected employee, requiring the vendor to substitute personnel, suspending or terminating the business relationship, or where conduct rises to criminal activity, notifying law enforcement.

Minimal or performative action that allows harassment to continue after notice, thereby establishing liability.

Government Code § 12940(k) independently requires all California employers to take all reasonable steps to prevent harassment — a continuous affirmative obligation that exists before any complaint is filed. Employers operating in environments with known third-party contacts who fail to establish preventive protocols can face liability even before a specific incident is reported.

When the Third Party Is a Business Entity: Raines and Vendor Liability

California courts extended third-party liability further in Raines v. U.S. Healthworks Medical Group (2023) 15 Cal.5th 519, where the California Supreme Court held that a business-entity agent with five or more employees can be held directly liable as an employer under FEHA when that entity carries out FEHA-regulated activities on the employer's behalf.

In Raines, the third-party entity was a pre-employment medical screening company — but the principle extends to any vendor, staffing agency, or contractor that exercises employment-related authority or provides employment-adjacent services in connection with California employees.

The practical implication: a staffing agency that places employees who harass the host employer's workers, a third-party HR vendor who discriminates in a screening process, or a contractor whose personnel create a hostile environment on a client's worksite — each of these arrangements can give rise to FEHA liability for the third-party entity itself, not only for the contracting employer.

Employees facing this situation may have direct claims against both the employer that failed to act and the business entity whose personnel committed the harassment.

Industries Where Third-Party Harassment Is Most Common

Third-party harassment claims occur at elevated rates in industries characterized by direct contact with customers or clients.

Retail workers face harassment from shoppers. Restaurant and hospitality workers face harassment from guests. Healthcare workers face harassment from patients and family members.

Social service workers face harassment from the populations they serve. Drivers, delivery personnel, and field service workers face harassment from members of the public at destinations. Teachers and instructors face harassment from students or parents.

In each of these environments, the employer cannot eliminate the third-party contact — it is the nature of the work. What the employer can and must do is establish written protocols for reporting third-party harassment, respond promptly to complaints, document its corrective actions, and reassign employees away from identified harassers when the business relationship cannot be immediately terminated.

What the Employer Must Do: The Corrective Action Obligation

When an employee reports third-party harassment, the employer's obligation to take immediate and appropriate corrective action activates immediately — not after a multi-week investigation, not after consulting outside counsel, and not after the next scheduled management meeting.

Appropriate corrective action in the third-party context is calibrated to the employer's actual leverage:

For customer harassment, the employer can bar the customer from the location, require the customer to work with a different employee, instruct management to intervene directly in real time, or issue a formal warning that the business relationship will be terminated if the conduct continues.

For vendor or contractor harassment, the employer can require the vendor to substitute the individual involved, suspend or terminate the vendor relationship, or negotiate personnel-level controls into the contract.

In professional services environments where the client relationship has economic significance, the employer still cannot use the value of the relationship as a basis for exposing employees to harassment. The weight of California case law makes clear that the economic cost of losing a client is not a defense to a harassment claim.

For patient harassment in healthcare settings, employers must balance FEHA obligations under Government Code § 12940 against care obligations to patients. The California Civil Rights Department has established that healthcare employers are not exempt from third-party harassment obligations and must develop specific protocols — including behavioral agreements with patients, staff reassignment, and security measures — to comply with FEHA while maintaining care standards.

What Employees Should Do

If a customer, vendor, client, or other non-employee engages in harassing conduct directed at you because of a protected characteristic, report it to your supervisor or HR in writing as soon as possible. The reporting creates the employer's legal obligation to act and begins the evidentiary record establishing the employer's knowledge.

Document specific incidents — dates, locations, what was said or done, witnesses present, and any existing evidence such as messages or security footage. If the conduct continued after you reported it, document that as well, including what your employer's response was or was not.

Under FEHA, an employer's failure to take immediate and appropriate corrective action after receiving your report is itself a violation of Government Code § 12940(j) — independent of the harasser's own conduct. Your claim is against your employer for failing to protect you from a known hazard in your work environment.

File a complaint with the California Civil Rights Department or reach them at (800) 884-1684. You have three years from the most recent harassing act to file. See our California workplace harassment guide for the full employer liability framework and damages available under FEHA.

Frequently Asked Questions

Can I sue the customer or vendor who harassed me directly?

Generally, no, not under FEHA. The California Fair Employment and Housing Act imposes liability on employers for failing to address third-party harassment — the claim runs against your employer, not against the individual customer or vendor. However, the harassing individual may face civil liability under other theories depending on the conduct: sexual battery under Civil Code § 1708.5, intentional infliction of emotional distress, or assault and battery. An employment attorney can evaluate whether parallel claims exist against the third party directly alongside your FEHA employer claim.

Does the harassment have to happen on my employer's property?

No. The employer's duty to maintain a harassment-free work environment extends to any location where you perform your work — a client's office, a customer's home, a job site, a vehicle, or a remote work setting. If the harassing conduct occurs in connection with your employment and your employer has the ability to intervene or take corrective action, the location of the harassment does not eliminate the employer's obligation.

What if my employer says they cannot control what customers do?

This is one of the most common employer defenses — and one California law expressly rejects. Government Code § 12940(j) does not require employers to control the harasser; it requires employers to take immediate and appropriate corrective action once they know or should know harassment is occurring. Depending on the circumstances, this means reassigning the employee, restricting the third party's access, terminating the business relationship, or other proportionate steps. The employer's inability to guarantee the third party's future behavior is not the standard — the standard is whether the employer took reasonable steps to protect the employee.

Does my employer's anti-harassment policy protect them from liability for third-party harassment?

A written policy alone does not create a defense. California courts evaluate whether the employer actually implemented the policy — whether it was communicated to employees, whether employees understood how to report third-party harassment, whether reports were investigated promptly, and whether corrective action was taken. An employer whose policy is never enforced, or who treats third-party harassment reports differently from internal harassment complaints, does not earn protection from liability merely by having distributed a handbook.

What if I work in healthcare and the harasser is a patient?

Healthcare employers face a recognized tension between their duty to employees under FEHA and their duty to patients under state licensing and patient rights frameworks. California law does not exempt healthcare employers from the obligation to address patient-directed harassment. The California Civil Rights Department recognizes that healthcare employers must develop specific protocols — including behavioral agreements with patients, reassignment of staff, security protocols, and, in extreme cases, transfer of care — to comply with FEHA while maintaining patient care standards. If your healthcare employer has failed to develop or implement such protocols after being made aware of patient harassment, it is exposed to the same liability as any other employer.

Can I be fired for complaining about a customer who harassed me?

No. Reporting harassment — including third-party harassment — is protected activity under FEHA. Government Code § 12940(h) prohibits retaliation against any employee who opposes harassment, files a complaint, or participates in a CRD investigation. If your employer terminated you, reduced your hours, changed your schedule, or took any other adverse action because you reported that a customer, vendor, or client harassed you, you have an independent retaliation claim in addition to the underlying harassment claim. See our California workplace harassment guide for the full framework on FEHA retaliation protections.

DISCLOSURE: This article is published by 1000Attorneys.com, a California State Bar Certified Lawyer Referral and Information Service, LRIS Certificate No. 0128, accredited by the American Bar Association and established in 2005. The information on this page is for general educational purposes only and is not legal advice. 1000Attorneys.com is not a law firm and does not provide legal representation. For legal advice about your specific situation, consult a qualified California attorney.