California and CCPA Compliance Advisory Services

Under California’s Consumer Privacy Act (CCPA) regulations, a covered business that sells or shares personal information online must treat user‑enabled opt-out preference signals, such as the Global Privacy Control (GPC), as a valid consumer opt‑out request for the sale or sharing of personal information. This includes covered businesses that use commonplace online advertising technologies.  

This means that if a business is already subject to the CCPA’s opt‑out requirements because it sells or shares personal information and meets the thresholds of the law, it must read and correctly process GPC signals. 

The California Privacy Protection Agency has finalized regulations that require certain businesses to conduct independent annual cybersecurity audits if their processing of personal information presents a significant risk to consumer security. These audits must assess the effectiveness of cybersecurity programs and identify gaps.  

Businesses that process personal information in a manner that presents significant risk to consumers’ privacy must conduct risk assessments. This requirement applies to “selling” and “sharing”—a common business activity—as well as processing sensitive data and other circumstances. Businesses must start conducting risk assessments in 2026, and need to submit information about those assessments to the California Privacy Protection Agency no later than April 1, 2028. 

Under the updated CCPA regulations, businesses that use Automated Decision‑Making Technology (ADMT) to make “significant decisions” about consumers must comply with new transparency and consumer rights obligations, beginning January 1, 2027. These include providing pre‑use notices about ADMT, offering consumers the right to opt out of ADMT processing, and, in some cases, allowing consumers to access information about how automated decisions were made.

The updated CCPA regulations are effective January 1, 2026, but compliance deadlines are staggered. Cybersecurity audit requirements have phased deadlines, with the earliest audits due by April 1, 2028, for the largest businesses. Businesses need to conduct risk assessments going forward from January 1, 2026, and be prepared to submit required information to the California Privacy Protection Agency no later than April 1, 2028. The ADMT requirements for significant decision‑making are scheduled to begin January 1, 2027.