Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 31 JULY 2025

California Regulator Finalizes CCPA Rules For Automated Decision Making, Cybersecurity Audits And Risk Assessments

Katten
Katten
Contributor
Katten

Katten

With client service at our core and a collective desire to foster an inclusive environment for a...

View firm profile
Explore more from Katten

On July 24, 2025, during its scheduled Board Meeting, the California Privacy Protection Agency (CPPA) Board voted unanimously to finalize rules governing the use of automated...

United StatesPrivacy
Trisha Sircar
Trisha Sircar
Author LinkedIn connections

On July 24, 2025, during its scheduled Board Meeting, the California Privacy Protection Agency (CPPA) Board voted unanimously to finalize rules governing the use of automated decision-making technology, risk assessments, cybersecurity audits and insurance under the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA).

A final package of the regulation will be prepared and presented to California's Office of Administrative Law (OAL), which will have 30 business days to determine if the rules will become final. In the event that the rules are finalized, the following compliance deadlines will apply:

  • January 1, 2027: Businesses will need to comply with automated decision-making technology requirements under the regulation.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

SB 54 Is In Effect: What California’s New Packaging Law Means For Your Business

Although being challenged by an injunction filed on August 20, 2026, by a coalition of 17 states, California’s SB 54 Plastic Pollution Prevention and Packaging Producer Responsibility Act is now in effect, and companies that sell, distribute, import, or ship packaged products into California should be evaluating whether they have compliance obligations.
United StatesPrivacy
Wilson Elser Moskowitz Edelman & Dicker LLP
Wilson Elser Moskowitz Edelman & Dicker LLP
Article

California's Fall 2026 Privacy Roundup: Expanded CCPA Deletion Rights And More

California Governor Gavin Newsom has signed several significant privacy bills that will reshape how businesses handle consumer data, including expanded deletion rights under the CCPA, shortened data broker response cycles, and sweeping new insurance sector privacy requirements. While one landmark bill banning the sale of sensitive personal information was vetoed, the approved legislation requires companies to update their deletion workflows...
United StatesPrivacy
McDermott Will & Schulte
McDermott Will & Schulte
Article

California’s 2026 Legislative Session Wraps: A Wave Of Privacy And AI Bills Reaches The Governor, With Key Child Safety And AI Measures Signed Into Law

California's 2026 legislative session concluded with Governor Newsom signing several landmark privacy and AI bills into law, including comprehensive child safety measures, AI auditor oversight frameworks, and expanded data protection requirements. How will these new regulations reshape digital advertising, workplace AI deployment, and online platform obligations for businesses operating in California?
United StatesPrivacy
Kelley Drye & Warren LLP
Kelley Drye & Warren LLP
Article

Eleventh Circuit Developments: Decisions On Florida And Georgia Social Media/Minor Laws And New Alabama Law

Legal risk intensifies for companies offering online interactive features to minors across Georgia, Florida, and Alabama as the Eleventh Circuit vacates preliminary injunctions against state social media laws. With Florida's HB 3 and Georgia's SB 351 now enforceable and Alabama's HB 161 set to take effect January 1, 2027, businesses face divergent compliance requirements including age verification, parental consent mechanisms, and account deletion protocols.
United StatesPrivacy
Taft, Stettinius & Hollister LLP
Taft, Stettinius & Hollister LLP
Article

FDA Seeks Public Feedback On Regulatory Approach For Generative AI-Enabled Medical Devices

The U.S. Food and Drug Administration has released a discussion paper outlining its initial framework for regulating generative AI-enabled medical devices, proposing a two-axis risk assessment approach and a novel competency-based premarket evaluation system. With public comments due by October 19, 2026, this represents a critical opportunity for device manufacturers and stakeholders to shape the regulatory landscape for this transformative technology.
United StatesFood, Drugs, Healthcare, Life Sciences
Katten
Katten
Article

The CFTC Sets Its Sights On Retail Leveraged Crypto Transactions

The CFTC has issued an advance notice of proposed rulemaking outlining frameworks for regulating retail crypto asset transactions involving leverage, margin, or financing. The proposal seeks to clarify how existing commodity exchange law applies to crypto markets while creating tailored requirements for exchanges, intermediaries, and clearing organizations. This initiative arrives alongside parallel regulatory efforts by the SEC as federal agencies work to establish comprehensive oversight of digital asset
United StatesFinance and Banking
Katten
Katten
Article

FCA Finalises Cryptoasset Perimeter Guidance Ahead Of The New UK Regime

The Financial Conduct Authority has released comprehensive perimeter guidance for the UK's new regulated cryptoasset activities regime, clarifying when firms will need authorization and how the regulatory framework applies to qualifying cryptoassets and stablecoins. The guidance addresses critical questions about scope, territorial application, and the narrower "by way of business" test that determines which entities fall under the new regulatory requirements.
United KingdomFinance and Banking
Katten
Katten
Article

California Partially Eliminates California Invasion Of Privacy Act Claims Faced By Many Companies

California has amended its Invasion of Privacy Act to eliminate private lawsuits under the pen register and trap-and-trace provision for website tracking technology, effective January 2027 with retroactive application. While this provides relief from certain digital tracking claims, companies still face exposure under CIPA's wiretapping and eavesdropping provisions, as well as other federal and state laws.
United StatesPrivacy
Katten
Katten
Article

The SEC’s Long-Awaited Crypto Proposal

The SEC has proposed Regulation Crypto Assets, a purpose-built framework that creates tailored exemptions for raising capital with crypto assets and establishes conditions under which those assets can cease being subject to investment contract classification under federal securities laws. Will this new regulatory approach successfully balance innovation in digital asset markets with investor protection, or will jurisdictional questions and state law preemption challenges limit its effectiveness?
United StatesFinance and Banking
Katten
Katten
Article

The AI Apocalypse: ‘I’m Sorry, Dave. I’m Afraid I Can’t Do That’

When OpenAI's o3 model sabotaged shutdown mechanisms in testing, headlines warned of machines developing survival instincts. But the real story mirrors HAL 9000's malfunction in 2001: A Space Odyssey—not emergent evil, but conflicting instructions from human designers. This analysis argues that AI safety failures are disclosure problems, not horror stories, and proposes a framework requiring published principles, transparent instruction hierarchies, independent testing, and enforceable liability.
United StatesTechnology
Katten
Katten
Article

Data Center Growth Fuels AI-Related Patent Disputes

The explosive growth of AI-driven data centers has sparked a surge in patent infringement litigation targeting the specialized infrastructure that powers these facilities. From advanced cooling systems and high-performance processors to networking equipment and power management technologies, patent holders are increasingly asserting their rights against data center operators who integrate these complex systems. What makes these facilities such attractive targets for patent enforcement, and how might ongoing
United StatesIntellectual Property
Katten
Katten