What changed under the 2026 regulations?

“The California Privacy Protection Agency finalized regulations that became applicable in January 2026 covering Automated Decision-Making Technology, with risk assessments, notices, and opt-out rights, annual cybersecurity audits for businesses meeting specific thresholds, and documented risk assessments before high-risk processing. These obligations apply on a staggered basis, with larger businesses subject earlier.”