California Consumer Privacy Act (CPRA) and CPPA Automated Decision-Making Technology Regulations
California · Cal. Civ. Code § 1798.100 et seq.; Cal. Code Regs. tit. 11, div. 6
California's main privacy law gives consumers rights to know, delete, correct, and opt out of the sale or sharing of their personal information. New regulations finalized in 2025 add rights around automated decision-making technology (ADMT): businesses using ADMT for significant decisions (jobs, housing, credit, healthcare) must give pre-use notice, let people opt out, and provide access to how decisions were made.
Technical detail
Cal. Civ. Code § 1798.100 et seq. as amended by Prop 24 (CPRA); CPPA regulations on ADMT, risk assessments, and cybersecurity audits approved Sept. 22, 2025, effective Jan. 1, 2026, with ADMT significant-decision compliance required by Jan. 1, 2027 and risk-assessment documentation by Dec. 31, 2027.
Who is protected: California residents (consumers, including employees and job applicants)
Who must comply: For-profit businesses meeting CCPA thresholds ($25M+ revenue, data on 100k+ consumers, or 50%+ revenue from selling/sharing data)
Key facts
| Jurisdiction | California |
|---|---|
| Level | State |
| Status | In effect |
| Protection strength | Stronger protection |
| Effective date | 2026-01-01 |
| Enacted | 2018-06-28 |
| Citation | Cal. Civ. Code § 1798.100 et seq.; Cal. Code Regs. tit. 11, div. 6 |
| Enforced by | California Privacy Protection Agency; California Attorney General |
| Private right of action | No — agency enforcement only |
| Penalties | Up to $2,500 per violation, $7,500 per intentional violation or violations involving minors |
| Topics | consumer data privacy · automated decision-making · AI disclosure and transparency · consumer protection · AI hiring and employment · data retention |
| Last verified | 2026-08-10 |
| Official source | CPPA: CCPA Updates, Cybersecurity Audits, Risk Assessments, and ADMT Regulations ↗ |
More AI rules in California
- CA EO N-6-26 (AI Workforce) · In effect
- California AB 489 (AI healthcare chatbot misrepresentation ban) · In effect
- X.AI v. Bonta (AB 2013 training-data disclosure) · Blocked / in litigation
- CA SB 1298 (2012 AV authorization) · In effect
- CA AB 856 (2015 drone trespass) · In effect
- California Bot Disclosure Act (bots must self-identify in sales/election messaging) · In effect
Related consumer data privacy rules elsewhere
- Vermont Data Broker Law (H.211) · Enacted (not yet in effect)
- Chatrie v. United States (Fourth Amendment protection for lo · Blocked / in litigation
- House Bill 2512 — Banning surveillance pricing by rideshare · Proposed / pending
- Kids Internet and Digital Safety Act (KIDS Act) (H.R. 7757) · Proposed / pending
- Maine LD 61 (employer surveillance disclosure & prohibition) · In effect
- Washington SHB 1672 (employee monitoring notice, ADS restrictions, emotion AI ban) · In effect
See something wrong or out of date? Submit a correction — every entry must carry a verifiable official source.