Deadline Facts

California CPPA rules — ADMT, risk assessments, audits

Applies to Businesses subject to the CCPA that use automated decisionmaking technology to make significant decisions about consumers

Regulations in effect

1 Jan 2026

Risk-assessment duties begin

1 Jan 2026

ADMT rules, existing uses

1 Jan 2027

First risk-assessment submissions

1 Apr 2028

First cyber audits (revenue over $100M)

1 Apr 2028

Enforced by California Privacy Protection Agency

Status reviewed 27 Sep 2026