California Adopts CCPA Regulations on Risk Assessments and Cybersecurity

CPPA California Privacy Rulemaking

Published January 1st, 2026

Detected March 13th, 2026

Summary

The California Privacy Protection Agency has adopted final regulations updating the CCPA. These regulations implement requirements for risk assessments, annual cybersecurity audits, and consumers' rights regarding automated decision-making technology, effective January 1, 2026.

View original document View source feed page

What changed

The California Privacy Protection Agency (CPPA) has finalized new regulations under the California Consumer Privacy Act (CCPA). These updates, effective January 1, 2026, introduce mandatory requirements for certain businesses to conduct risk assessments and annual cybersecurity audits. Additionally, the regulations clarify consumers' rights to access and opt-out of the use of Automated Decisionmaking Technology (ADMT) by businesses, and provide specific guidance on when insurance companies must comply with the CCPA.

Businesses operating in California that meet the criteria for these new requirements must prepare to implement these changes by the effective date. This includes establishing processes for conducting risk assessments and cybersecurity audits, and updating systems and policies to accommodate consumer rights related to ADMT. Compliance with these updated regulations is crucial to avoid potential enforcement actions by the CPPA.

What to do next

Review updated CCPA regulations for applicability to business operations.
Develop and implement processes for conducting risk assessments and annual cybersecurity audits.
Update systems and policies to address consumer rights regarding Automated Decisionmaking Technology.

Source document (simplified)

Home
Regulations
CCPA Updates

CCPA Updates, Cybersecurity Audits, Risk Assessments,

        Automated Decisionmaking Technology (ADMT), and Insurance Regulations

On July 24, 2025, the California Privacy Protection Agency (Agency) Board adopted regulations that (1)
updated existing CCPA regulations; (2) implemented requirements for certain businesses to conduct risk
assessments and complete annual cybersecurity audits; (3) implemented consumers' rights to access and
opt–out of businesses' use of ADMT; and (4) clarified when insurance companies must comply with the
CCPA.

Effective Date: January 1, 2026

Status of the Proposal: The rulemaking is complete. On September 22, 2025, the regulations
were approved by the Office of Administrative Law and filed with the Secretary of State.

Documents

September 22, 2025 – Final Rulemaking Documents

Notice of Approval
Approved Regulations Text
Final Statement of Reasons and Updated Informative Digest
Final Statement of Reasons – Appendix A (45-Day Comment Summaries and Responses)
Final Statement of Reasons – Appendix B (15-Day Comment Summaries and Responses)
Final Economic and Fiscal Impact Statement (STD
399)
May 9, 2025 – Public Notice of Modifications to Proposed Regulations
Notice of Modifications to Text of Proposed
Regulations and Additional Materials Relied Upon
Modified Text of Proposed Regulations
January 13, 2025 – Public Notice of Extension of Comment Period
Notice of Extension of Public Comment Period and Additional Hearing
Date
November 22, 2024 – Public Notice of Rulemaking and Related Documents
Notice of Extension of Public Comment Period and Additional Hearing
Date
Notice of Proposed Rulemaking
Text of Proposed Regulation
Initial Statement of Reasons
Initial Statement of Reasons Appendix A:
Standardized Regulatory Impact Assessment
Economic and Fiscal Impact Statement (STD
399)

Public Comments

Comments received during the initial 45-day comment period are linked below.

Preliminary Rulemaking Activities

The Agency solicited preliminary written comments from the public via an Invitation for Preliminary Comments on Proposed
Rulemaking on the following topics: CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated
Decisionmaking Technology (ADMT), and Insurance Companies from February 10, 2023 through March 27, 2023.
That period has closed, and the public comments are available via the links below.