Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 15 OCTOBER 2025

New CCPA Regulations Receive Final Approval

Ballard Spahr LLP
Ballard Spahr LLP
Contributor
Ballard Spahr LLP

Ballard Spahr LLP

Ballard Spahr LLP, an AmLaw 100 law firm with 19 US offices, serves clients in more than 50...

View firm profile
Explore more from Ballard Spahr LLP

On September 23, 2025, the California Privacy Protection Agency (CPPA) announced the approval of final regulations under the California Consumer Privacy Act (CCPA) covering cybersecurity audits...

United StatesPrivacy
Gregory Szewczyk
Gregory Szewczyk
Mudasar Pham-Khan
Mudasar Pham-Khan
Author LinkedIn connections

On September 23, 2025, the California Privacy Protection Agency (CPPA) announced the approval of final regulations under the California Consumer Privacy Act (CCPA) covering cybersecurity audits, risk assessments, and automated decisionmaking technology (ADMT). The new rules, effective January 1, 2026, introduce significant new compliance obligations for businesses subject to the CCPA/CPRA, with phased deadlines for certain requirements.

Key requirements include:

  • Cybersecurity Audits: Businesses must conduct annual, independent cybersecurity audits if they (1) derive 50% or more of annual revenue from selling or sharing consumers' personal information, or (2) meet the annual gross revenue threshold in the CCPA and process the personal information of 250,000 or more consumers or the sensitive personal information of 50,000 or more consumers. Audit certifications are due to the CPPA on a phased schedule: April 1, 2028 (for businesses with over $100 million in

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

SB 54 Is In Effect: What California’s New Packaging Law Means For Your Business

Although being challenged by an injunction filed on August 20, 2026, by a coalition of 17 states, California’s SB 54 Plastic Pollution Prevention and Packaging Producer Responsibility Act is now in effect, and companies that sell, distribute, import, or ship packaged products into California should be evaluating whether they have compliance obligations.
United StatesPrivacy
Wilson Elser Moskowitz Edelman & Dicker LLP
Wilson Elser Moskowitz Edelman & Dicker LLP
Article

California's Fall 2026 Privacy Roundup: Expanded CCPA Deletion Rights And More

California Governor Gavin Newsom has signed several significant privacy bills that will reshape how businesses handle consumer data, including expanded deletion rights under the CCPA, shortened data broker response cycles, and sweeping new insurance sector privacy requirements. While one landmark bill banning the sale of sensitive personal information was vetoed, the approved legislation requires companies to update their deletion workflows...
United StatesPrivacy
McDermott Will & Schulte
McDermott Will & Schulte
Article

Eleventh Circuit Developments: Decisions On Florida And Georgia Social Media/Minor Laws And New Alabama Law

Legal risk intensifies for companies offering online interactive features to minors across Georgia, Florida, and Alabama as the Eleventh Circuit vacates preliminary injunctions against state social media laws. With Florida's HB 3 and Georgia's SB 351 now enforceable and Alabama's HB 161 set to take effect January 1, 2027, businesses face divergent compliance requirements including age verification, parental consent mechanisms, and account deletion protocols.
United StatesPrivacy
Taft, Stettinius & Hollister LLP
Taft, Stettinius & Hollister LLP
Article

California’s 2026 Legislative Session Wraps: A Wave Of Privacy And AI Bills Reaches The Governor, With Key Child Safety And AI Measures Signed Into Law

California's 2026 legislative session concluded with Governor Newsom signing several landmark privacy and AI bills into law, including comprehensive child safety measures, AI auditor oversight frameworks, and expanded data protection requirements. How will these new regulations reshape digital advertising, workplace AI deployment, and online platform obligations for businesses operating in California?
United StatesPrivacy
Kelley Drye & Warren LLP
Kelley Drye & Warren LLP
Article

SEC Charges WhatsApp-Driven Crypto Fraud Schemes Totaling Over $15 Million

The SEC has charged two offshore entities with orchestrating sophisticated investment confidence scams that defrauded over 2,000 retail investors of at least $15.3 million through fake AI-powered crypto trading platforms. Using WhatsApp group chats, impersonated investment professionals, and fabricated regulatory filings, the defendants created elaborate schemes that promised guaranteed returns while stealing investor funds through shell companies and blocking withdrawal attempts with demands for additional
United StatesCriminal Law
Ballard Spahr LLP
Ballard Spahr LLP
Article

New York City’s Proposed POWER Act Would Create An Expansive Municipal Private Right Of Action For Unfair And Abusive Business Practices, Unfair Methods Of Competition, And Unlawful Acts

New York City's proposed POWER Act would create one of the most expansive municipal consumer-protection regimes in the country, introducing a sweeping private right of action that permits injured persons and nonprofit organizations to sue businesses for unfair, deceptive, abusive, or unlawful practices. The legislation has sparked intense debate between business groups warning of litigation exposure and consumer advocates arguing it fills critical enforcement gaps left by resource-constrained agencies. The
United StatesConsumer Protection
Ballard Spahr LLP
Ballard Spahr LLP
Article

FinCEN Proposes To Designate Banque Misr UAE As A Primary Money Laundering Concern And Revoke Correspondent Banking Access

The Financial Crimes Enforcement Network has proposed revoking Banque Misr UAE's correspondent banking access to U.S. financial institutions, designating it as a financial institution of primary money laundering concern. This action stems from Treasury's Operation Economic Outcast, which aims to sever financial channels Iran uses to evade sanctions and fund terrorist activities through shadow banking networks.
GlobalGovernment, Public Sector
Ballard Spahr LLP
Ballard Spahr LLP
Article

Senate Banking Committee Advances Brian Johnson’s Nomination To Lead CFPB

The Senate Banking Committee has advanced Brian Johnson's nomination to lead the Consumer Financial Protection Bureau in a party-line vote, setting the stage for a full Senate confirmation. With the Senate's pre-election recess looming and Mark Paoletta currently serving as Acting Director, the timing of Johnson's potential confirmation could determine whether the CFPB has Senate-confirmed leadership before the November midterm elections.
United StatesGovernment, Public Sector
Ballard Spahr LLP
Ballard Spahr LLP
Article

AI Learning Or AI Copying? Ninth Circuit Weighs In

The Ninth Circuit held that GitHub Copilot's AI-generated code did not violate DMCA's copyright management information (CMI) removal provisions, even when output resembled source code, because the system generated new works through probabilistic patterns rather than retrieving and stripping information from existing copies. This decision establishes a critical distinction between AI systems that learn and generate versus those that retrieve and reproduce, with significant implications for how courts evaluat
United StatesIntellectual Property
Ballard Spahr LLP
Ballard Spahr LLP
Article

Colorado Sues EarnIn, Alleging Its “Earned Wage Access” Product Is Really A High-Cost Loan

Colorado Attorney General Philip Weiser has filed a lawsuit against EarnIn, challenging whether its direct-to-consumer earned wage access product constitutes a high-cost loan subject to state lending laws. The case examines EarnIn's Cash Out product, which advanced approximately $300 million to Colorado consumers between January 2023 and July 2025, and questions whether the company's tips and expedited-transfer fees should be classified as interest charges.
United StatesConsumer Protection
Ballard Spahr LLP
Ballard Spahr LLP