For covered businesses, privacy assessment now belongs in integration approval—not only in the privacy-policy update. California’s completed regulation package became effective 1 January 2026 and addresses existing CCPA requirements, risk assessments, cybersecurity audits and automated decisionmaking technology. Applicability and deadlines differ between those areas. (cppa.ca.gov)
Which assessment dates matter?
Under the approved regulations, specified processing—including selling or sharing personal information—triggers risk-assessment requirements. Assessments are required before initiating covered new processing. Qualifying activities begun before the effective date and continuing afterwards have a 31 December 2027 assessment deadline. (cppa.ca.gov)
For a demo integration, our recommended screening questions are:
- Does an advertising or analytics arrangement constitute sale or sharing?
- Is sensitive information involved?
- Is the proposed supplier merely providing a service, or using data for its own purposes?
- Does a replacement endpoint materially change the assessed processing?
The regulations require review at least every three years and updates following material changes, generally no later than 45 calendar days after the change. The assessment decision therefore needs a named owner beyond the initial procurement. (cppa.ca.gov)
Is every publisher required to buy an annual cybersecurity audit?
No. The regulations establish separate eligibility conditions for cybersecurity audits. For businesses that must comply, the agency describes phased certification deadlines beginning 1 April 2028, followed by 2029 or 2030 depending on the applicable revenue band. Do not confuse CCPA coverage with automatic eligibility for every audit requirement. (cppa.ca.gov)
Recommended action: record four separate determinations: CCPA business coverage, risk-assessment triggers, cybersecurity-audit eligibility and significant-decision ADMT use. A supplier’s generic “CCPA compliant” statement does not answer those questions for the publisher.
What does recent enforcement show about privacy controls?
On 21 November 2025, California announced a $1.4 million settlement with mobile-game company Jam City, addressing alleged deficient opt-out methods and protections concerning younger users. The Attorney General’s enforcement register describes required in-app opt-out mechanisms and restrictions on selling or sharing information of users aged at least 13 but under 16 without affirmative consent. (oag.ca.gov)
On 11 February 2026, California announced a $2.75 million Disney settlement concerning alleged failures to effectuate opt-outs across devices and services associated with consumer accounts. These settlements are company-specific, but illustrate why testing only the presence of a privacy link is inadequate. (oag.ca.gov)
Recommended acceptance test: capture requests and storage before and after an opt-out, repeat the test across relevant pages and account states, and ask the supplier to explain any continuing data flows. Do not label every remaining request unlawful; classify its purpose and applicable legal treatment.