Ronald Sarian

California’s Privacy Protection Agency (CPPA) — known now as CalPrivacy — has entered full enforcement mode. Contact me to assess your CPPA readiness and build a compliance plan before the 2026 rules hit. CalPrivacy is the first U.S. regulator dedicated solely to data-protection. As 2026 approaches, the CPPA is finalizing new rules, issuing record fines, and launching tools that will reshape compliance for any business handling Californians’ data. 1. New CCPA Regulations Effective January 1 2026 On July 24 2025, the CPPA approved major updates to the CCPA regulations, certified by the Office of Administrative Law and taking effect January 1 2026. Key requirements: - Cybersecurity audits and risk assessments for high-risk data uses. - Automated Decision-Making Technology (ADMT) transparency and opt-out rights. - Updated data-retention and notice obligations for employment and consumer data. These changes move California privacy from disclosure-based to accountability-based. Businesses must operationalize continuous risk evaluation, documentation, and demonstrable safeguards. 2. The DROP Regulation: Delete Request & Opt-Out Platform Also effective January 1 2026, the CPPA’s DROP Regulation under the Delete Act requires data brokers to connect to a centralized Delete Request and Opt-Out Platform. Consumers can submit a single deletion or opt-out request through the CPPA portal; all registered brokers must comply. Implications: - Data brokers must integrate technically and verify fulfillment. - Businesses relying on brokered data must ensure vendor compliance. DROP marks a shift toward universal, one-click privacy control — likely to influence other states. 3. Enforcement Momentum The CPPA is now enforcing at scale: - Tractor Supply Co. paid $1.35 million in 2025 for mishandling job-applicant data — the agency’s largest penalty. - Over 100 active investigations, many targeting failure to honor Global Privacy Control (GPC) signals. - Joint sweeps with Colorado and Connecticut regulators target “sale/share” non-compliance. Bottom line: California privacy violations now carry real financial and reputational consequences. 4. Business Priorities for 2026 By January 1 2026, covered entities must: - Complete risk assessments and cybersecurity audits where required. - Offer opt-outs for automated decision systems affecting hiring, credit, or profiling. - Implement technical compliance with GPC and DROP requests. - Update vendor contracts and maintain audit-ready documentation. 5. What’s Next The CPPA is drafting guidance on audit templates, ADMT standards, and data-broker oversight. 2026 will be the first year of full-scale enforcement under California’s new privacy architecture — a model likely to inform national policy. ⚖️ Bottom Line With new rules, the DROP platform, and active enforcement, 2026 marks California’s transition from privacy policy to privacy accountability.

3

CPDA Executive Director Kate Chatfield spoke to Law.com about the California Supreme Court’s decision to conduct a sanctions review of Nevada County District Attorney Jesse Wilson after he allegedly falsified AI citations to file a case. “Courts are taking the issue of lawyers using AI very seriously,” said Kate Chatfield, executive director of the California Public Defenders Association. The organization sent a letter urging the Supreme Court to grant Kjoller’s petition as did others in the legal community. “The stakes are higher when a prosecutor, whether using AI or not, misleads the court on what the case law is,” Chatfield said. “Here in this case you have those two things coming together.” Read more here (paywalled): https://lnkd.in/gG6949up 

2

❗Jam City Settlement in the Superior Court of California: Enforcement of CCPA Requirements for Mobile Apps- This marks the sixth enforcement action by Attorney General Rob Bonta under the CCPA, highlighting the focus on ensuring companies comply with CCPA requirements and provide consumers with easy-to-use, consumer-friendly mechanisms to opt out of the sale or sharing of personal data, rather than burying the process in complex documentation or requiring request emails. Opt-out mechanisms should be straightforward and readily accessible Importantly, the settlement also emphasizes protecting children’s personal information, ensuring that mobile apps implement sufficient privacy safeguards for minors. These enforcement actions send a clear message: mobile gaming companies must prioritize consumer privacy, especially for younger users. ➡ Read my full article here: https://lnkd.in/gm-EKTBB Link to the press release provided in the comments #CCPA #PrivacyLaw #DataPrivacy #TechLaw #ConsumerPrivacy #CyberLaw #MobileApps #ChildrenPrivacy #PrivacyCompliance #AttorneyGeneral #CaliforniaLaw #DataProtection

5

3 Comments

Happy New Year — This New Year Comes with New Privacy The California Privacy Protection Agency has finalized a comprehensive package of CCPA regulations that will reshape privacy compliance over the next several years. With the first major phase taking effect January 1, 2026, the new year brings significant new obligations for businesses subject to the CCPA. **What’s Coming January 1, 2026:** The updated regulations introduce significant new obligations across core CCPA rights and operations: • **Privacy risk assessments** for high-risk processing activities including sensitive data, targeted advertising, selling/sharing personal information, and automated decision-making • **Expanded definition of sensitive personal information** to include data from consumers under age 16 • **Enhanced opt-out transparency**, requiring businesses to display opt-out status directly to consumers • **Extended Right to Know**, now reaching back to January 1, 2022 (not just 12 months) for businesses retaining data longer • **Strengthened correction rights and data integrity requirements**, including obligations to notify third-party sources of incorrect information • **Health data correction provisions**, allowing consumers to submit statements (up to 250 words) contesting accuracy that must be shared with downstream recipients **Beyond 2026: Automated Decision-Making Technology (ADMT) Regulations** This package also introduces groundbreaking regulations for automated decision-making technology, including: • **ADMT risk assessments** for systems that make consequential decisions about consumers (employment, housing, credit, education, healthcare access, and more) • **Pre-deployment assessments** required before deploying or significantly modifying ADMT systems • **Ongoing performance monitoring** and documentation obligations • **Implementation timeline** extending through 2028-2030, with businesses needing to begin planning now Additionally, the package includes new cybersecurity audit requirements, further strengthening California’s position as the leader in comprehensive privacy protection. **The Bottom Line:** These aren’t just policy updates. They require operational and technical changes across data systems, vendor relationships, internal workflows, and consumer-facing interfaces. Privacy and legal teams should be conducting gap assessments now, prioritizing high-risk processing activities, and building roadmaps for phased compliance. The clock is ticking on January 1, 2026 — and the work extends well beyond. #CCPA #DataPrivacy #PrivacyLaw #CaliforniaPrivacy #Compliance #PrivacyEngineering #CPRA #PrivacyRegulation

6

📢 Global Privacy & AI Laws Evolving Fast! Here's a quick rundown of key recent developments you need to know: 👇 California's CIPA & Chat Communications: The Ninth Circuit Court of Appeals has clarified that California's Invasion of Privacy Act (CIPA) Section 631(a) only applies to telephone communications, not internet-based chats. This is a significant ruling for businesses using website chat functionalities, affirming that services like Salesforce operating such chats don't violate this specific section of CIPA. 📞💬 EU Copyright Law & Generative AI: A new study from the European Parliament Research Services (EPRS) sheds light on a critical issue: only works with identifiable human input can gain copyright protection in the EU, leaving AI-generated content in a legal grey area. The study also highlights challenges with AI training on copyrighted data and unclear opt-out mechanisms. Lawmakers are urged to clarify rules to keep pace with generative AI. 🤖✍️🇪🇺 California's New AI Employment Rules: Big news for HR and tech! California is set to enforce new rules prohibiting the use of AI tools in employment decisions if they lead to discrimination based on protected traits like age, gender, or disability. This applies to everything from resume screening to job ads, aiming to ensure fair AI usage and uphold anti-discrimination laws. 💼⚖️🚀 Spanish DPA Fines ASNEF for GDPR Breach: The Spanish data protection authority (AEPD) has fined ASNEF €200,000 for unlawful processing of personal data and failing to respond to an erasure request under GDPR. This underscores the importance of proper data notification, accurate record-keeping, and fully honoring individuals' data rights. A stark reminder for all organizations! 🇪🇸🔒💰 #DataPrivacy #AILaw #GDPR #California #EUCopyright #EmploymentLaw #TechRegulation #LegalUpdate #StayInformed #PrivacyCompliance #DPO #LegalHead

6