Hashed & Salted: Vol. 4, Issue 4

Hashed & Salted | A Privacy and Data Security Update

California Gets Regulations In Under the Wire, But Legislation Stalls!

As the Summer of Privacy fades into fall, California is—unsurprisingly—in the privacy news. The California Privacy Protection Agency (CPPA) succeeded in finalizing proposed regulations under the California Consumer Privacy Act (CCPA) at its scheduled board meeting July 24, narrowly avoiding a November 2025 reset of the rulemaking process.

As we noted in our last issue, the agency voted in November 2024 to commence formal rulemaking on the regulations, starting the clock running. After a public comment period from Nov. 22, 2024, to Feb. 19, 2025, and a number of rounds of revisions, the agency in May approved amendments to the proposed regulations covering automated decision making technology (ADMT), cybersecurity audits, risk assessments and insurance, as well as updates to the existing CCPA regulations. The resulting comment period closed