The most immediate future milestone is 1 January 2027, but it does not postpone duties already in force.
| Future date | Development | Boundary to preserve | Recommended preparation |
|---|---|---|---|
| 1 January 2027 | California’s Opt Me Out Act requires browser businesses to provide configurable opt-out preference-signal functionality. | This is a browser-provider requirement; covered websites already have applicable signal-handling obligations. | Test supplier behaviour with signals enabled and document failures. (privacy.ca.gov) |
| 1 January 2027 | California ADMT requirements begin for covered uses involving significant decisions. | Do not assume every catalogue filter or game recommendation is a significant decision. | Assess any potentially covered use separately from ordinary catalogue functionality. (cppa.ca.gov) |
| 31 December 2027 | Deadline to assess qualifying pre-existing processing continuing after the new California regulations became effective. | This is not a grace period for every new 2026 integration. | Inventory legacy processing and assign assessment owners. (cppa.ca.gov) |
| 1 April 2028 | First California submission deadline for specified risk-assessment information covering 2026–27; earliest cybersecurity certification deadline for the relevant audit cohort. | Assessment, submission and audit obligations have different triggers. | Build records now rather than waiting for filing preparation. (cppa.ca.gov) |
The California agency also lists preliminary work on reducing privacy-rights friction and opt-out preference signals. Its current rulemaking page distinguishes those activities from adopted regulations; preliminary materials should not be reported as final obligations. (cppa.ca.gov)