US CPRA CPPA Regulations Tracker

The CPPA's March 2023 regulations became effective on March 29, 2023. They operationalize notices, consumer requests, verification, opt-out preference signals, service-provider and contractor relationships, non-discrimination, training, and recordkeeping under the CCPA as amended by the CPRA.

A second completed rulemaking was adopted by the CPPA Board on July 24, 2025, approved by the Office of Administrative Law and filed with the Secretary of State on September 22, 2025, and became effective January 1, 2026. It updates existing rules and adds risk assessments, annual cybersecurity audits, and consumer rights concerning ADMT used for significant decisions, plus insurance-related clarifications.

The January 1, 2026 effective date does not make every operational deadline immediate. Use the final text to record the trigger, whether processing existed on the effective date, the revenue tier where relevant, and the applicable compliance, submission, report, or certification date.

For risk assessments, a business must assess new covered processing before it begins. Covered processing initiated before January 1, 2026 and continuing afterward must be assessed by December 31, 2027. Review assessments at least every three years and update one after a material processing change as soon as feasibly possible, no later than 45 calendar days after the change. Retain original and updated versions while the processing continues or for five years after completion, whichever is longer. Information for assessments conducted in 2026 and 2027 is first submitted to the Agency by April 1, 2028; later submissions follow the regulatory schedule.

Cybersecurity-audit reports phase in by annual gross revenue for businesses that meet the audit trigger: April 1, 2028 if 2026 revenue exceeded $100 million; April 1, 2029 if 2027 revenue was at least $50 million and no more than $100 million; and April 1, 2030 if 2028 revenue was below $50 million. The audit must be independent, with the auditor free to make decisions and communicate results without influence from the business being audited. The annual certification is due by April 1 following a year in which an audit is required.

A business using ADMT for a significant decision before January 1, 2027 must comply with the applicable ADMT article by January 1, 2027. For a later use, complete the applicable pre-use notice and rights implementation before deploying the covered use.

Separate the statute, final regulations, nonbinding Agency guidance, enforcement advisories, and rulemaking history. Board adoption alone is not the same as OAL approval and filing. A draft, notice, public comment, or statement of reasons can explain history but does not replace the operative regulatory text.

Record effective date and compliance date separately. A regulation can be binding while giving a business time to complete an existing-processing assessment, first audit report, first submission, or ADMT implementation.

Do not use the Data Broker Registry as evidence that an ordinary CCPA duty applies. The Delete Act and DROP have their own definitions, regulations, registration cycle, processing start date, and reporting obligations.

Review the CPPA regulation hubs and final documents on a scheduled cadence and when the Agency announces rulemaking or enforcement guidance. Save the final public URL and record what changed, which controls are affected, who approved the interpretation, and when implementation is due.

Do not overwrite historical rows. Mark a draft or superseded text as historical, link it to the final text, and preserve the prior decision only when it explains work completed under the earlier status.