AI Compliance Vendors
RegulationIn force; ADMT rules apply from Jan 1, 2027United States - California

California Consumer Privacy Act / California Privacy Rights Act

The California Consumer Privacy Act, as amended by the California Privacy Rights Act (CPRA), applies to for-profit businesses that do business in California and meet at least one threshold: gross annual revenue over $25 million; buy, sell, or share personal information of 100,000+ California residents/households; or derive 50%+ of annual revenue from selling California residents' personal information. The California Privacy Protection Agency (CPPA) has issued draft regulations governing Automated Decision-Making Technology (ADMT), risk assessments, and cybersecurity audits under CCPA authority. Enforcement is shared between the CPPA and the California Attorney General.

Jurisdiction

United States - California

Enforcement

January 1, 2023

Maximum penalty

Civil penalties of up to $2,500 per violation and up to $7,500 per intentional violation or violation involving a minor. Consumers may recover statutory damages of $100 to $750 per incident, or actual damages, whichever is greater, for certain data breaches (Cal. Civ. Code §1798.150; §1798.155).

Current status & key dates

In force; ADMT rules apply from Jan 1, 2027

  1. Office of Administrative Law approves the CPPA regulations

  2. Regulations take effect; risk-assessment duties begin

  3. Today ·

  4. · 76 days

    ADMT requirements apply to existing ADMT uses

  5. · 532 days

    First risk-assessment submissions due; first cybersecurity audit certifications (revenue over $100M)

Deadline Facts

California CPPA rules — ADMT, risk assessments, audits

ADMT rules apply

76 days

Applies to Businesses subject to the CCPA that use automated decisionmaking technology to make significant decisions about consumers

Regulations in effect
1 Jan 2026
Risk-assessment duties begin
1 Jan 2026
ADMT rules, existing uses
1 Jan 2027
First risk-assessment submissions
1 Apr 2028
First cyber audits (revenue over $100M)
1 Apr 2028

Enforced by California Privacy Protection Agency

Read the rules →Official source ↗

Status reviewed 27 Sep 2026

Journalists: embed this countdown →

Status reviewed 27 Sep 2026. Sources: California Privacy Protection Agency — CCPA updates, ADMT, risk assessments and cybersecurity audits; White & Case — CPPA finalizes rules on ADMT, risk assessments and cybersecurity audits. Not legal advice.

Key obligations

  • 01Provide notice at or before the point of collection describing personal-information categories and purposes
  • 02Respond to consumer requests to know, delete, correct, and opt out of sale/sharing
  • 03Honor Global Privacy Control (GPC) opt-out signals for sale and sharing
  • 04Limit use and disclosure of sensitive personal information upon consumer request
  • 05Provide a Do Not Sell or Share My Personal Information link on the homepage
  • 06Enter into contracts with service providers, contractors, and third parties restricting use of personal information
  • 07Conduct risk assessments for high-risk processing (per pending CPPA regulations)
  • 08Conduct annual cybersecurity audits for high-risk businesses (per pending CPPA regulations)
  • 09Provide pre-use notice and opt-out for Automated Decision-Making Technology (per pending CPPA ADMT regulations)

Vendors that support CCPA/CPRA

Sorted by coverage level. Full coverage shown first.

0 vendors

No vendor in the directory has a confirmed attestation on file yet.

Compare across industries

See which vendors support CCPA/CPRA in your sector.

CCPA/CPRA in Defense & National SecurityCCPA/CPRA in EducationCCPA/CPRA in Employment & HRCCPA/CPRA in Energy & UtilitiesCCPA/CPRA in Financial ServicesCCPA/CPRA in Government & Public SectorCCPA/CPRA in HealthcareCCPA/CPRA in InsuranceCCPA/CPRA in Legal ServicesCCPA/CPRA in ManufacturingCCPA/CPRA in Media & EntertainmentCCPA/CPRA in Retail & E-commerceCCPA/CPRA in SaaS & TechnologyCCPA/CPRA in Telecommunications

Legal status reviewed September 27, 2026. Informational summary only — not legal advice. Consult qualified counsel for specific obligations.