CCPA/CPRA + ADMT Regulations
California Consumer Privacy Act (CPRA) and CPPA Automated Decision-Making Technology Regulations
California · Cal. Civ. Code § 1798.100 et seq.; Cal. Code Regs. tit. 11, div. 6
- Status
- In effect
- Took effect
- January 1, 2026
- Applies to
- For-profit businesses meeting CCPA thresholds ($25M+ revenue, data on 100k+ consumers, or 50%+ revenue from selling/sharing data)
- Enforced by
- California Privacy Protection Agency; California Attorney General
California's main privacy law gives consumers rights to know, delete, correct, and opt out of the sale or sharing of their personal information. New regulations finalized in 2025 add rights around automated decision-making technology (ADMT): businesses using ADMT for significant decisions (jobs, housing, credit, healthcare) must give pre-use notice, let people opt out, and provide access to how decisions were made.
Who is protected: California residents (consumers, including employees and job applicants)
Legal detail
Cal. Civ. Code § 1798.100 et seq. as amended by Prop 24 (CPRA); CPPA regulations on ADMT, risk assessments, and cybersecurity audits approved Sept. 22, 2025, effective Jan. 1, 2026, with ADMT significant-decision compliance required by Jan. 1, 2027 and risk-assessment documentation by Dec. 31, 2027.
Key facts
| Jurisdiction | California |
|---|---|
| Level | State |
| Strength | Stronger |
| Enacted | June 28, 2018 |
| Citation | Cal. Civ. Code § 1798.100 et seq.; Cal. Code Regs. tit. 11, div. 6 |
| Private right of action | No, agency enforcement only |
| Penalties | Up to $2,500 per violation, $7,500 per intentional violation or violations involving minors |
| Topics | consumer data privacy · automated decision-making · AI disclosure and transparency · consumer protection · AI hiring and employment · data retention |
| Agency page | CPPA: CCPA Updates, Cybersecurity Audits, Risk Assessments, and ADMT Regulations |
More AI rules in California
- CA EO N-6-26 (AI Workforce) · In effect
- California AB 489 (AI healthcare chatbot misrepresentation ban) · In effect
- X.AI v. Bonta (AB 2013 training-data disclosure) · Blocked / in litigation
- CA SB 1168 — data center grid cost allocation · Enacted (not yet in effect)
- California SB 1119 Adam's Law, companion chatbots (2026) · Enacted (not yet in effect)
- California SB 867 AI chatbot toy moratorium (2026) · Enacted (not yet in effect)
Related consumer data privacy rules elsewhere
- Vermont Data Broker Law (H.211) · Enacted (not yet in effect)
- Chatrie v. United States (Fourth Amendment protection for location… · Blocked / in litigation
- House Bill 2512 — Banning surveillance pricing by rideshare companies · Proposed / pending
- Kids Internet and Digital Safety Act (KIDS Act) (H.R. 7757) · Proposed / pending
- Maine LD 61 (employer surveillance disclosure & prohibition) · In effect
- Washington SHB 1672 (employee monitoring notice, ADS restrictions, emotion AI ban) · In effect
See something wrong or out of date? Submit a correction. Every entry must carry a verifiable source.