California's Revised Risk Assessment Regulations

Under prior draft regulations, the CPPA will require every business whose processing of consumers' personal information presents a significant risk to consumers' privacy to conduct a risk assessment before starting that processing.¹

The CPPA then listed the following processing activities that present a significant risk to consumers' privacy:²

1. Selling or sharing of personal information.
2. Processing sensitive personal information, excluding the processing of sensitive personal information in the context of employee benefits.
3. Using automated decision technology that results in a legal or significant effect on the consumer, involves profiling or involved profiling in the context of behavior advertising.