California Consumer Privacy Act Regulations Take Effect

Implementation Date: January 1, 2026

Beginning January 1, 2026, employers subject to the California Consumer Privacy Act (CCPA) must begin complying with updated regulations covering cybersecurity audits, risk assessments, automated decision-making technology (ADMT) and updates to some key existing CCPA rules.

Although ADMT requirements do not begin until January 1, 2027, employers must determine if they are utilizing ADMT and begin conducting risk-assessments January 1, 2026. 

Additional site updates are forthcoming. 

11 CCR § 7120 et seq.