Cookies, "Significant Risk," And 2026 CCPA Assessments

Is a risk assessment on your 2026 roadmap? If your website uses cookies to serve behavioral or cross context advertising, it may need to be. As many who deal with California's privacy law are aware, in several situations using the vendors needed to serve behavioral advertising cookies can be viewed as “selling” personal information to those entities. And if selling personal information in a manner that presents significant risk to consumers, CCPA regulations require written privacy risk assessments. These assessments are also required if engaging other activities that are viewed as posing a “significant risk” to covered individuals' privacy. Those include processing sensitive information (and information of children under 16 is sensitive where the business has actual knowledge of the consumer's age). Also included is if the company uses automated decision making technology or profiling to make high risk decisions about people.