Sexual Harassment Training: Rules and How to Run It

Search this topic and you land almost entirely on two kinds of page: a state government portal, and a vendor selling you a course. Both are useful. Neither answers the questions a small-business owner is actually asking: do I have to do this, what exactly does it have to contain, what will it cost me, and how do I run it when there is nobody here whose job this is?

This guide answers all four. It covers the state-by-state requirements, who has to be trained and on what cycle, what the training must include, the delivery options (including the free ones), and the records you need to be able to produce. It also takes on the question most vendors avoid: whether this training actually reduces harassment, and what the evidence says makes that more likely.

I build the onboarding and training assignment workflows this runs on at FirstHR. This is general information rather than legal advice, and harassment law is an area where a short conversation with an employment attorney is genuinely worth the money, particularly if you have employees in more than one state.

What Is Sexual Harassment Prevention Training?

Sexual harassment prevention training is instruction provided to employees on what sexual harassment is, what conduct is prohibited, how to report it, and what the company will do in response. Where it is mandated, the statute usually specifies a minimum duration, a set of required topics, and a schedule.

Two terms circulate for the same thing. Vendors and most employers say sexual harassment training. State statutes tend to say sexual harassment prevention training, and several state portals use that exact phrase. They refer to the same obligation, and where a state uses the statutory phrase it is worth matching it in your own policy so the connection is obvious to anyone reviewing your documents.

Every version of the training has to explain that harassment takes two legally distinct forms. Quid pro quo harassment is a trade: a job benefit is conditioned on submitting to sexual conduct, or a job detriment follows from refusing. A hostile work environment is created when unwelcome conduct is severe or pervasive enough to alter the conditions of employment.

Hostile work environment harassment is far more common and far harder for people to recognize in the moment, which is precisely why examples matter more than definitions.

It is also worth separating this from compliance training generally. Harassment prevention is one of several topics that carry a legal mandate, alongside things like workplace violence prevention in some states, and it is the one most likely to be examined closely after something goes wrong.

What Federal Law Actually Requires

Federal law prohibits sexual harassment and makes employers liable for it. It does not require you to train anyone.

The prohibition sits in Title VII of the Civil Rights Act, enforced by the Equal Employment Opportunity Commission (EEOC), and it applies to employers with fifteen or more employees. Smaller employers frequently fall under state anti-discrimination laws with lower thresholds, so being under fifteen is not the exemption it sounds like.

Training still matters federally because of liability. According to the EEOC, an employer has a recognized defense in certain circumstances if it can show two things: that it took reasonable care to prevent and promptly correct harassment, and that the employee unreasonably failed to use the process the employer provided. Training is one visible piece of that reasonable care, and its absence is one of the first things a plaintiff points at.

That defense has a hard limit. It is generally unavailable when the harassment came from a supervisor and resulted in a tangible employment action, such as a firing, demotion, or reassignment. In that situation the employer is liable no matter how good its program was, which is the concrete reason supervisor training is treated differently from everyone else's.

Learn what an EEOC complaint involves before you ever face one, because the process starts long before anything reaches a court.

Which States Require Sexual Harassment Training

Six states have broad private-sector mandates: California, Connecticut, Delaware, Illinois, Maine, and New York. Washington covers specific industries, and Chicago and New York City layer their own requirements on top. Whether you have an obligation at all depends on where your employees work, and the rules differ enough that a single generic course does not automatically satisfy all of them.

Washington is the odd one out, because its rule is industry-specific rather than universal. Hotel, motel, retail, and security guard employers, along with property services contractors, must adopt a sexual harassment policy, train isolated employees (janitors, security guards, housekeepers, and room service attendants who mostly work alone) and their managers, hand out panic buttons, and give workers a resource list under RCW 49.60.515, part of the Revised Code of Washington.

Two more jurisdictions reach employers without appearing in that table. The District of Columbia requires training at businesses that employ tipped workers, every two years and through a trainer its Office of Human Rights has certified. Virginia requires annual training from contractors on public contracts where the contractor has more than five employees.

Massachusetts, Rhode Island, and Vermont take a different route: their statutes encourage employers to run a training program within a year of hire rather than requiring one. Oregon requires a written anti-discrimination policy instead of training. A recommendation still counts for something: in those states, having trained is evidence you took reasonable steps.

California deserves separate attention if you employ anyone there. Its rules are the most detailed, and its threshold hides a trap: the five-employee count includes employees anywhere, not only in California. An employer headquartered elsewhere with one California employee can be covered. The California requirements are worth reading in full rather than in summary.

See who hasn't signed yet

Signature Tracking lists every document still waiting for someone, overdue first, with who signed and who hasn't.

Start free trialSee how e-signatures work

Signature TrackingTrack and manage employee document signatures#Document NameRecipientCategoryDeadline1Remote Work AgreementRecipientJim HalpertSales RepresentativeCategoryEmploymentDeadlineOct 6, 20262Employee Handbook AcknowledgmentRecipientPam BeeslyOffice AdministratorCategoryEmploymentDeadlineOct 14, 20263Forklift Safety PolicyRecipientDarryl PhilbinWarehouse ForemanCategoryComplianceDeadlineOct 20, 20264Customer Data AgreementRecipientKelly KapoorCustomer Service RepresentativeCategoryComplianceDeadlineOct 24, 2026

Who Must Be Trained, and How Often

In a mandate state, the answer is generally everyone, with longer training for supervisors in several states and a renewal cycle that is most often annual or every two years. Three groups get missed reliably, even though the mandates cover each of them.

Part-time and seasonal employees are the largest gap. State mandates generally cover all employees rather than full-time staff only, and California explicitly extends to temporary and seasonal workers with an accelerated deadline. These are the people who churn fastest and who sit outside whatever onboarding habit the business has settled into.

Remote employees are the second. The obligation follows where the employee works, not where the company is registered, so one remote hire can pull you into a mandate you have never encountered. This is now common enough that it should be a standard question when you approve a remote role.

Supervisors are the third, and the most consequential. Several states require them to complete longer or additional training, and the substantive reason is that supervisor conduct is where employer liability concentrates. A supervisor who receives a complaint and sits on it converts a manageable incident into a documented failure to act.

On timing, new hires generally have their own deadline, ranging from within six months in California and Connecticut to within a year in Maine and Delaware. Attach the assignment to your onboarding process rather than to a calendar reminder, because a calendar reminder does not know when someone joined.

What the Training Has to Cover

Content requirements vary by state, and some prescribe topics in statute. Across the mandates, a consistent core appears.

Two of those deserve emphasis because they are the ones generic content handles worst. The complaint procedure has to be your actual procedure, with your actual names and routes, not a placeholder telling people to contact HR when there is no HR.

The retaliation section matters more than its length suggests. Retaliation claims are frequently easier to prove than the underlying harassment claim, and they are a common way a defensible situation becomes an indefensible one.

Whatever course you use, the training has to sit on top of a written anti-harassment policy that has actually been distributed. Most of the states that mandate training also require a policy or notice separately from it, and a training module referring to a policy nobody has seen is a gap that shows up immediately under scrutiny.

Distribution means something specific here, and a shared folder does not count. Several states expect the policy to be provided to each employee, in writing, at hire and periodically afterward, and some require it in the employee's primary language where that language is common enough in the workforce. Keeping it in the employee handbook with a signed acknowledgment is the simplest way to prove distribution rather than assert it.

Does Workplace Harassment Training Have to Cover More Than Sexual Conduct?

In California, yes, by statute. Everywhere else it is still the sensible way to build the program. Title VII prohibits harassment on every protected basis, so a course that stops at sex leaves race, color, religion, and national origin unaddressed, along with the age and disability harassment that separate federal statutes cover.

California Government Code section 12950.1 requires the same one-hour and two-hour sessions to include prevention of abusive conduct (in plain terms, workplace bullying) as a component. The sessions must also cover harassment based on gender identity, gender expression, and sexual orientation, with practical examples in those areas rather than a passing mention.

So buy or build one course that covers harassment on every protected basis, and treat the sexual harassment deadline in your state as the clock that drives it. Splitting the material into two modules doubles the assignment work and leaves people guessing which set of rules applies to the thing they just witnessed.

What Sexual Harassment Training Costs

The direct cost is lower than most owners assume, and can be zero.

Several states publish free training that satisfies their own mandate. California's Civil Rights Department offers both the one-hour and two-hour versions at no cost in several languages. New York City publishes free training that satisfies both state and city requirements. If your entire team works in one of those places, the licensing cost of compliance is nothing.

Paid courses are priced per employee per year, commonly ranging from a few dollars to a few tens of dollars per seat depending on volume, state coverage, and whether supervisor versions are included. Live sessions with an attorney or professional trainer run into the hundreds or low thousands per session, which is poor value for a whole small team and reasonable value for supervisors specifically.

The honest framing is that the free option costs administration instead of money, and administration is the scarcer resource at a small company. For a very small team in one state, free is fine. Once the team grows or spreads across states, the tracking is what you are paying for, and it is usually worth it.

Where to Find Free Online Harassment Training for Employees

The free material worth using comes from state agencies rather than from vendors advertising a free tier. Because the state wrote it, it satisfies that state's own content rules by definition. What differs between them is the format, and how much assembly work is left on your side.

New York State gives you a video, a model slide deck, a script, and a fillable answer sheet, and it says plainly that the video by itself is not interactive enough. You have to ask employees questions, take questions back, or collect the answer sheet.

Illinois publishes a model program you can download as slides or run as a video in English or Spanish. Its Department of Human Rights also runs free virtual sessions, taught by its own certified trainers and open to anyone, that an individual can attend to satisfy the requirement.

Connecticut goes further than publishing a course. Its statute makes the Commission on Human Rights and Opportunities provide the training at no cost, and it lets you credit an employee who already took the commission's training at another employer within the previous two years.

Maine and Delaware are the two mandate states that publish no course at all. Maine has its Department of Labor build a compliance checklist instead, and Delaware has its Department of Labor produce an information sheet every employer distributes, which leaves the interactive training itself for you to source.

If you are outside every mandate state, a free state course is still a sensible way to train people. The state-specific parts will not match your jurisdiction, but the definitions, the examples, and the reporting content are common to all of them, and having trained is the evidence you want if a complaint ever arrives.

Choosing How to Deliver It

You have three delivery routes, and most small employers end up combining two of them.

The combination I would suggest for a small team: an online course for everyone, and a live session for supervisors, either annually or when someone is promoted into a supervisory role. Supervisors are where the liability is, live sessions are where questions actually get asked, and the number of supervisors is small enough that the per-head cost stays sane.

One delivery detail that is not optional in several states: the training must be interactive. Playing a video in a room while people check their phones does not satisfy an interactivity requirement, and neither does a module nobody has to respond to. If you run it live, build in questions and a way for people to ask them, including a way to ask privately.

Running One Program Across Multiple States

Once you have employees in two mandate states, the naive approach of handling each one separately stops scaling almost immediately. Two rules simplify it enormously.

First, train everyone on the shortest applicable cycle. If any of your people are in an annual state, run the whole company annually. Yes, you are over-complying for the two-year states. You are also maintaining one schedule instead of several, and the marginal cost of the extra sessions is small compared to the cost of a missed deadline.

Second, use the state-specific version where the state prescribes content, and default to the strictest standard everywhere else. A course marketed as multi-state compliant is only useful if it explicitly names the states it covers and provides distinct versions where the content differs. Ask for that in writing.

Does Sexual Harassment Training Actually Work?

Partly. The standard compliance module tends to teach people what the rules are, and the evidence that it changes behavior is much weaker. Almost nobody selling training will say so plainly, which is a reason to.

This is not a fringe view. The EEOC's own 2016 task force report on workplace harassment concluded that much of the training delivered over the preceding decades had been ineffective, and had been oriented toward limiting legal liability rather than toward actually preventing harassment. The task force did not conclude that training is useless. It concluded that the prevailing form of it needed to change.

The task force's review of the research shows where training helps and where it stops. Training tended to increase knowledge of what counts as harassment, was less likely to change attitudes, and in some experiments drew a negative reaction from the participants most inclined to harass.

Later work points the same way. In a 2019 study in the Proceedings of the National Academy of Sciences covering 805 companies, Frank Dobbin and Alexandra Kalev found that employee training built around forbidden behaviors was followed by fewer women in management, while manager training that taught intervention was followed by more.

None of that is an argument for skipping the training. Where it is mandated you have no choice, and where it is not, it is still part of the reasonable care the federal defense looks for. It is an argument for not stopping at the module.

What Makes Training Effective

The approaches with better evidence behind them share a common feature: they treat most of the room as part of the solution rather than as suspects.

Bystander intervention is the one with the strongest support and the one most often missing from cheap compliance content. It comes from research on preventing sexual violence in other settings. It works by giving the majority of people, who will never harass anyone, something specific and low-risk to do when they see something.

Chicago requires a full hour of bystander training every year, on top of the hour every employee gets and the two hours every supervisor gets.

Workplace civility training is the other approach the EEOC task force highlighted as promising. It addresses everyday conduct and respect rather than starting from the legal definition, and it tends to be better received precisely because it is not framed as an accusation.

What worked for me

The first time we ran this, I sent the link, everyone completed it, I filed the certificates, and I felt done. What I noticed afterward was that nobody had asked a single question, which at the time I read as the training being clear. Later I understood it differently: a module you complete alone at your desk gives nobody a reason to ask anything. The change that mattered was small. I started doing fifteen minutes with the whole team after the module, going through the reporting route out loud, naming the second person to go to if I was the problem, and saying I would rather hear about something early and be wrong than late and be right. Questions came in that session that had never come up in two years.

Nick Anisimov, FirstHR founder

Signature Tracking

Jim HalpertRemote Work AgreementOct 6

Pam BeeslyHandbook AcknowledgmentOct 14

Darryl PhilbinForklift Safety PolicyOct 20

Templates

Offer LetterVerified

Employee HandbookVerified

Remote Work AgreementReview

Employee Records

Kelly KapoorCustomer ServiceUp to Date

Darryl PhilbinWarehouseNeeds Attention

Ryan HowardSalesUp to Date

E-signatures

Signed online, filed for you

Send a PDF or Word file to one person or several, and the signed PDF lands in the person's file.

Start free trial

How to Run This With No HR Department

Without an HR department, three things need solving: who receives a complaint, who investigates it, and who tracks completion. Most guidance on this topic assumes an HR function exists and skips all three.

The first is who receives a complaint. Training tells people to report, and at a small company the obvious recipient is the owner. That works until the complaint concerns the owner, a peer of the owner, or the owner's relative, at which point the route you trained people on is the route they will not use.

The fix is to name a second, independent recipient: an outside attorney, an external HR consultant, or a hotline service. It costs little, and it is the single most useful thing a small employer can do here.

The second is who investigates. A workplace investigation done badly is worse than one not started, and doing it yourself when you are close to both parties is difficult even with good intentions. Decide in advance, in writing, at what threshold you bring in an outside investigator, and have a name ready before you need it.

The third is who tracks completion. This is administration, not judgment, and it is the part that silently fails. Assignment, reminders, and records belong in whatever system already knows who works for you and when they started, alongside the rest of your HR records, rather than in a spreadsheet somebody maintains until they stop.

Records, Certificates, and Proof

The training is half the obligation. Being able to prove it happened is the other half, and it is the half that fails.

The reason to keep the state version in the record is that it is the field you will not think of until you need it. An investigator asking whether your California employees received California-compliant training is not satisfied by a certificate showing a generic course was completed.

Storage matters as much as capture. These records belong with your confidential personnel documentation, retrievable in one export rather than assembled from an email folder. If your answer to a records request would involve searching your inbox, you do not have records. You have hope. A training matrix that shows who is due for what is the minimum useful version of this.

The Part Training Cannot Do

Training addresses knowledge. It does not, on its own, address the two things that determine whether a harassment problem becomes a legal problem: whether people report, and what happens when they do.

What turns an incident into a lawsuit is usually the response rather than the original conduct. A complaint that is received, investigated promptly, documented, and acted on consistently rarely ends up in litigation. The same complaint met with delay, informality, or an obvious reluctance to believe it frequently does, and it often brings a retaliation claim with it.

Underreporting is the other half. The EEOC task force found that roughly 70 percent of people who experienced harassment never even talked to a supervisor, manager, or union representative about it. The reasons it recorded were fear: of disbelief, of inaction, of blame, and of social or professional retaliation. Training that instructs people to report without changing any of those expectations does not move the number.

What a good response looks like is not complicated, which is part of why failing at it is so damaging. It comes down to five steps, taken in order.

The practical implication for a small employer is that the module is the cheapest part of the program and the least decisive. The written policy, the second reporting route, the decision about when to bring in an outside investigator, and the visible consistency of how complaints are handled are what the training is supposed to point at. If those are not in place, the training points at nothing.

Mistakes That Create Liability

The failures here are predictable and mostly avoidable at no cost.

One more mistake belongs on the list without needing a warning icon: running the training once and never again. Several mandates are annual, and others run on a two-year cycle.

An employer whose last completion record is three years old is in a worse position than one who never started, because the record establishes that the obligation was understood. Put the renewal on the same compliance calendar as everything else with a date attached.

Send your first document for signature

4.7 on G2

Start free trial

Employee HandbookSigned

Remote Work AgreementWaiting

Frequently Asked Questions