California's new CCPA rules: what applies now and what starts in 2027

California's privacy regulator finished a major rulemaking in September 2025. The new rules sit in Title 11 of the California Code of Regulations, starting at section 7000, and add three sets of duties: privacy risk assessments, yearly cybersecurity audits, and rules for automated decisionmaking technology.

They have been in force since January 1, 2026, but the deadlines are spread over four years.

This article sets out the dates as the regulation text states them, what has already started, and what we checked for changes up to September 25, 2026.

Who made these rules, and when did they take effect?

The California Privacy Protection Agency made them. The agency now calls itself CalPrivacy on its own website. Its Board adopted the package on July 24, 2025, and the Office of Administrative Law approved it on September 22, 2025.

The agency's rulemaking page gives the effective date as January 1, 2026 and says "The rulemaking is complete."

The rules apply to any "business" under the California Consumer Privacy Act. In short, that is a for-profit company doing business in California that meets one of three tests: annual gross revenue over $25 million as adjusted for inflation (currently $26,625,000), buying, selling or sharing the personal information of 100,000 or more consumers or households, or earning half or more of its revenue from selling or sharing personal information.

The agency adjusts the revenue figure every odd-numbered year.

What already applies in 2026?

The duty to assess before starting. Under section 7155, a business must "conduct and document a risk assessment" before it begins any of the processing activities listed in section 7150. So a covered activity launched on or after January 1, 2026 needs its assessment first.

The listed activities are the ones the regulation says present "significant risk to consumers' privacy".

Each assessment must weigh the privacy risks against the benefits, and the stated goal is "restricting or prohibiting the processing" where the risks outweigh the benefits. A business must review each assessment at least once every three years and update it within 45 calendar days of a material change.

It keeps each version for as long as the processing continues or five years after completion, whichever is later.

When are risk assessments due for activities that started before 2026?

By December 31, 2027. Under section 7155(b), a covered activity that began before January 1, 2026 and continues after that date must be assessed and documented by that date.

The first filing to the agency follows. For assessments conducted in 2026 and 2027, a business must submit the required information "no later than April 1, 2028". After that, the filing is due each April 1 for the previous year's assessments.

The filing is a summary, not the full report: a contact, the period covered, how many assessments were done for each type of activity, which categories of personal information were involved, and an attestation made "under penalty of perjury" by a member of the executive management team.

The full reports stay with the business, but the agency or the Attorney General can demand them at any time, and they must be handed over within 30 calendar days.

Who needs a cybersecurity audit, and when is the first one due?

A business needs one if it earns half or more of its revenue from selling or sharing personal information, or if it is over the revenue threshold and, in the preceding calendar year, processed the personal information of 250,000 or more consumers or households or the sensitive personal information of 50,000 or more consumers. That is section 7120.

Section 7121 phases in the first audit reports by revenue. The revenue year that decides the tier is different for each tier.

After April 1, 2030, a business that met the section 7120 test in the preceding year, as of January 1, audits the next 12 months and completes the report by the following April 1. For each year it is required to complete an audit, it must also file a written certification with the agency by April 1, signed by an executive under penalty of perjury.

The auditor must be "qualified, objective, independent" and may be internal or external, but may not have built or run the program being audited. Findings must rest on evidence, not mainly on management's own statements. The regulation says an existing audit can be used if it meets the requirements, giving the NIST Cybersecurity Framework 2.0 as an example.

The business and the auditor keep audit records for at least five years.

What starts on January 1, 2027 for automated decisionmaking?

The ADMT rules in Article 11. Section 7200 says a business that uses ADMT for a significant decision before January 1, 2027 "must be in compliance with the requirements of this Article no later than January 1, 2027", and any use after that date must comply from the start.

ADMT means technology that processes personal information and "uses computation to replace human decisionmaking or substantially replace human decisionmaking". A human stays meaningfully involved only if the reviewer knows how to read the output, actually reviews it with other relevant information, and has authority to change the decision.

A significant decision is one that grants or denies financial or lending services, housing, education, employment or contracting opportunities or pay, or healthcare services. Advertising is expressly excluded.

Three duties follow. A pre-use notice must explain the specific purpose, the opt-out and access rights. Consumers must be offered at least two ways to opt out, unless an exception applies, such as a real appeal to a human reviewer with authority to overturn the decision.

And a consumer who asks must be told the purpose, the logic of the ADMT and how its output was used in their case.

Has anything changed since the rules were approved?

Not that we found. On September 25, 2026, the agency's regulations page states: "The Agency does not have any proposed regulation packages at this time." It lists five topics under preliminary rulemaking: data broker audits, employee data, notices and disclosures, reducing friction in privacy rights, and opt-out preference signals.

Their comment periods closed between April 6 and May 20, 2026. The agency says these "have not yet advanced to formal rulemaking", so none of them changes a date in this article.

The agency's 2026 news releases announce enforcement actions, mostly against data brokers, and a sectoral audit of gig economy platforms. None announces a delay to the risk assessment, audit or ADMT rules.

What are others saying?

These are the pieces we found best argued. Each takes a position of its own, and none of them is the basis for a fact in this article; every fact rests on the sources listed below.

What we could not verify

How businesses will file. Sections 7124 and 7157 say certifications and risk assessment information go through the agency's website, but on September 25, 2026 we found no filing form or instructions published on cppa.ca.gov or privacy.ca.gov.

Whether the revenue threshold will change on January 1, 2027. The agency adjusts it every odd-numbered year, and no 2027 figure has been posted.

Whether any bill passed by the Legislature in 2026 amends these rules. The Governor's signing period was still open on the date we checked, and we did not review every pending bill.

Whether any federal action on state AI laws will affect these ADMT rules. We found no court order, federal statute or agency action that suspends them, but we did not review every federal document on the subject.

How the audit tiers treat a business whose revenue moves between bands from year to year. The agency's September 23, 2025 announcement summarizes the tiers by revenue alone, while the rule text ties each tier to a specific year, and neither addresses that case.