CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology (ADMT), and Insurance Regulations
On July 24, 2025, the California Privacy Protection Agency (Agency) Board adopted regulations that (1) updated existing CCPA regulations; (2) implemented requirements for certain businesses to conduct risk assessments and complete annual cybersecurity audits; (3) implemented consumers' rights to access and opt–out of businesses' use of ADMT; and (4) clarified when insurance companies must comply with the CCPA.
Effective Date: January 1, 2026
Status of the Proposal: The rulemaking is complete. On September 22, 2025, the regulations were approved by the Office of Administrative Law and filed with the Secretary of State.
Documents
September 22, 2025 – Final Rulemaking Documents
- Notice of Approval
- Approved Regulations Text
- Final Statement of Reasons and Updated Informative Digest
- Final Statement of Reasons – Appendix A (45-Day Comment Summaries and Responses)
- Final Statement of Reasons – Appendix B (15-Day Comment Summaries and Responses)
- Final Economic and Fiscal Impact Statement (STD 399)
May 9, 2025 – Public Notice of Modifications to Proposed Regulations
- Notice of Modifications to Text of Proposed Regulations and Additional Materials Relied Upon
- Modified Text of Proposed Regulations
January 13, 2025 – Public Notice of Extension of Comment Period
November 22, 2024 – Public Notice of Rulemaking and Related Documents
- Notice of Extension of Public Comment Period and Additional Hearing Date
- Notice of Proposed Rulemaking
- Text of Proposed Regulation
- Initial Statement of Reasons
- Initial Statement of Reasons Appendix A: Standardized Regulatory Impact Assessment
- Economic and Fiscal Impact Statement (STD 399)
Public Comments
Comments received during the initial 45-day comment period are linked below.
- CCPA Updates, Cyber, Risk, ADMT, and Insurance Regulations Written Comments Part 1
- CCPA Updates, Cyber, Risk, ADMT, and Insurance Regulations Written Comments Part 2
- CCPA Updates, Cyber, Risk, ADMT, and Insurance Regulations Written Comments Part 3
- CCPA Updates, Cyber, Risk, ADMT, and Insurance Regulations Written Comments Part 4
- CCPA Updates, Cyber, Risk, ADMT, and Insurance Regulations Written Comments Part 5
- CCPA Updates, Cyber, Risk, ADMT, and Insurance Regulations Written Comments Part 6
- CCPA Updates, Cyber, Risk, ADMT, and Insurance Regulations Written Comments Part 7
- CCPA Updates, Cyber, Risk, ADMT, and Insurance Regulations Written Comments Part 8
- CCPA Updates, Cyber, Risk, ADMT, and Insurance Regulations Written Comments Part 9
- CCPA Updates, Cyber, Risk, ADMT, and Insurance Regulations Written Comments Part 10
- CCPA Updates, Cyber, Risk, ADMT, and Insurance Regulations Written Comments Part 11
- CCPA Updates, Cyber, Risk, ADMT, and Insurance Regulations Written Comments Part 12
- CCPA Updates, Cyber, Risk, ADMT, and Insurance Regulations Written Comments Part 13
- CCPA Updates, Cyber, Risk, ADMT, and Insurance Regulations Written Comments Part 14
Comments received on modified text during the 15-day comment period are linked below.
- CCPA Updates, Cyber, Risk, ADMT, and Insurance Regulations Written Comments – Part 1
- CCPA Updates, Cyber, Risk, ADMT, and Insurance Regulations Written Comments – Part 2
- CCPA Updates, Cyber, Risk, ADMT, and Insurance Regulations Written Comments – Part 3
- CCPA Updates, Cyber, Risk, ADMT, and Insurance Regulations Written Comments – Part 4
Preliminary Rulemaking Activities
The Agency solicited preliminary written comments from the public via an Invitation for Preliminary Comments on Proposed Rulemaking on the following topics: CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology (ADMT), and Insurance Companies from February 10, 2023 through March 27, 2023. That period has closed, and the public comments are available via the links below.