Compliance Radar · Privacy and consent
California finalizes CCPA rules on automated decisions, risk assessments and cybersecurity audits
California's CCPA now requires risk assessments, with audits and decision-making rules phased in.
- Status
- In force, phased
- Takes effect
- Assessments: January 1, 2026 (existing processing by December 31, 2027, attestations April 1, 2028). ADMT: January 1, 2027. Audits: April 1, 2028, April 1, 2029 or April 1, 2030.
- Announced
- Sep 23, 2025 (approved)
- Type
- rule
What changed
Selling or sharing data for ads now needs a written risk assessment, and sites must show when they've honored an opt-out signal, for example 'Opt-Out Request Honored'.
Who it affects
CCPA businesses that sell or share data, process sensitive data, or use automated decision tools.
What to do
- Show GPC visitors that their opt-out was honored.
- Start risk assessments for ad pixels and tags.
- Calendar your audit date by revenue.
What ComplyMo already handles
Page audits and daily re-checks: Growth and up. Everything else: every plan, from $19 a month.
Sources
- CPPA: California finalizes regulations to strengthen consumers' privacy (opens in a new tab)
- CPPA: CCPA updates and new regulations (opens in a new tab)
- Nelson Mullins: showing opt-outs were honored (opens in a new tab)
- Thompson Coburn: 2026 CCPA regulations (opens in a new tab)
Summary of public sources, not legal advice.