CCPA Risk Assessments: What Your Business Must Do Before 2027

California's updated CCPA regulations took effect on January 1, 2026. Any CCPA-covered business that sells or shares personal information, processes sensitive personal information, or uses certain automated decision-making tools must complete a documented CCPA risk assessment before starting that activity. Businesses using automated decision-making technology (ADMT) for significant decisions must comply with new notice, opt-out, and access rules by January 1, 2027, and the first risk assessment submissions are due to the state by April 1, 2028.

Key Takeaways

• The new rules are already in force. The California Privacy Protection Agency (CPPA), now branded CalPrivacy, set January 1, 2026 as the effective date.
• Risk assessments apply based on what you do with data, not necessarily how big you are. ADMT obligations start January 1, 2027, which is less than two months away.
• Privacy enforcement is active and expensive, with a $12.75 million General Motors settlement as an example.

CCPA compliance programs originally built in 2020 revolved around two core elements: a privacy policy and a mechanism for consumers to opt out of the sale of their personal information. The 2026 regulations require businesses to document how they evaluate privacy risk, justify their data practices, and demonstrate accountability to regulators. Businesses that have not reassessed their privacy programs since the CCPA first took effect should do so now.

What Changed in the CCPA Regulations?

On July 24, 2025, the CPPA Board adopted a major rule package that updated existing CCPA regulations, created risk assessment and cybersecurity audit requirements, implemented ADMT rights, and clarified how insurance companies must comply. The Office of Administrative Law approved the rules in September 2025, and they went into effect January 1, 2026, with extra time for audits, risk assessment submissions, and ADMT.

So what does that mean on the ground? It means your compliance obligations now fall into four buckets: risk assessments, cybersecurity audits, ADMT controls, and a set of tighter rules on everyday consumer requests.

CCPA Rules You May Have Missed

Not every change is a headline. The CPPA's own guide, 7 Things to Know Before 2026 CCPA Updates Take Effect, flags several practical updates:

• Opt-out confirmation. Businesses must let consumers confirm their opt-out status, including opt-outs sent through a signal like Global Privacy Control. A message such as "Opt-Out Request Honored" is the agency's own example.
• Longer look-back for requests to know. If you keep data longer than 12 months, consumers can request information going back to January 1, 2022.
• Corrections Requirement. If you receive data from brokers, you must make sure corrected information doesn't get overwritten by bad data later.
• Youth data is now sensitive. Personal information of consumers under 16 is treated as sensitive personal information.

These are the kinds of details that slip through the cracks, and they are exactly what regulators test when they review a website.

When Is a CCPA Risk Assessment Required?

A CCPA risk assessment is required before a business begins any processing that the regulations consider a significant risk to consumer privacy. Under Section 7150 of the regulations, six activities trigger the requirement:

• Selling or sharing personal information (including sharing cross-context behavioral advertising).
• Processing sensitive personal information, with a narrow carve-out for certain employee payroll, benefits, and authorization uses.
• Using ADMT to make a significant decision about a consumer.
• Using automated processing to infer traits like performance, health, or reliability from systematic observation of job applicants, employees, contractors, or students.
• Using automated processing to infer traits based on a consumer's presence at a sensitive location.
• Processing personal information you intend to use to train ADMT for significant decisions, or to train facial recognition, emotion recognition, or similar identification technology.

If your website runs third-party advertising pixels that qualify as "sharing," you may already be in risk assessment territory. You don't need to be building AI to be covered. The requirement applies to every CCPA-defined business engaging in any trigger activity.

What Must a Risk Assessment Include?

The regulations require a written report that weighs privacy risks against the benefits of the processing. According to Section 7152, the report must document:

• A specific purpose. Vague phrases like "to improve our services" or "for security purposes" are expressly not enough.
• The categories of personal information involved and the minimum data needed.
• Operational details, including sources, retention periods, approximate number of consumers, and the vendors or third parties receiving the data.
• For ADMT, the system's logic, assumptions, limitations, and how outputs drive decisions.
• Specific benefits and negative impacts, such as discrimination, economic harm, reputational harm, or psychological harm.
• Safeguards, such as encryption, access controls, or privacy-enhancing technologies.
• Whether the business will go forward, plus the names and positions of reviewers and approvers.

In plain terms, the CPPA wants to see your work. A risk assessment demonstrates how you reached your decision, not just that you made one.

Risk Assessment Timing and Recordkeeping

Timing rules carry real teeth. Based on the regulations and summaries:

• New covered processing needs an assessment before it begins.
• Processing that started before January 1, 2026 and continues must be assessed by December 31, 2027.
• Assessments must be reviewed at least every three years.
• A material change requires an update within 45 calendar days.
• The CPPA or Attorney General can request full reports, which must be produced within 30 calendar days.
• Records must be kept for as long as processing continues or five years after completion, whichever is later.

Key CCPA Compliance Deadlines at a Glance

What Are the New ADMT Rules?

ADMT is technology that processes personal information to replace, or substantially replace, human decision-making. The rules only bite when ADMT is used for a "significant decision," meaning one that results in providing or denying financial or lending services, housing, education, employment or contracting opportunities, or healthcare services.

By January 1, 2027, businesses using ADMT this way must provide a pre-use notice, offer an opt-out unless an exception applies, and respond to access requests about the ADMT. Employers deserve special attention here. Resume screeners, scheduling tools, and performance analytics can fall within these rules.

Do you know which vendors in your hiring or lending workflow use automated scoring? If the answer is "not exactly," that's your first priority.

Do the Cybersecurity Audit Rules Apply to Your Business?

CCPA-required annual cybersecurity audits apply when processing presents significant risk to consumers' security. That includes businesses that derive 50% or more of annual revenue from selling or sharing personal information (which includes targeted ad cookies), or businesses above the inflation-adjusted revenue threshold (about $26.6 million) that processed personal information of 250,000 or more consumers or sensitive personal information of 50,000 or more consumers in the prior year.

Audits must be performed by a qualified, objective, and independent professional, and a member of executive management must certify completion to the CPPA. That certification is signed under penalty of perjury, which tends to focus the mind.

Is Privacy Enforcement Really Happening?

Yes, and the pace picked up in 2026. Consider a few recent examples:

• Ford Motor Company agreed to a $375,703 fine after requiring consumers to verify their email before opting out of sale and sharing. One extra step was enough to draw a penalty.
• PlayOn Sports agreed to a $1.10 million fine over allegations that it pushed users to third-party opt-out tools, failed to honor opt-out preference signals, and provided insufficient notice.
• General Motors reached a $12.75 million settlement, subject to court approval, with the Attorney General and several district attorneys over alleged sales of driving and location data. The state described it as its first data minimization case, and GM must maintain a privacy program that assesses data-collection risks.
• LocateSmarter, a data broker, was ordered to pay $116,490 for failing to register on time and allegedly requiring partial Social Security numbers before consumers could opt out.

Behind these headlines is a steady stream of complaints. The CPPA's May 2026 enforcement update reported 12,546 consumer complaints between July 2023 and March 2026. Administrative fines currently run up to $2,663 per violation and $7,988 per intentional violation or violation involving known minors, and those numbers multiply quickly across thousands of website visitors.

Notice the pattern? Most of these cases are not about exotic AI. They are about opt-out friction, ignored browser signals, and data used beyond its original purpose. The GM case also shows regulators expect businesses to assess data risks before acting, which is exactly what the risk assessment rules now require in writing.

What Is Coming Next From CalPrivacy?

The CPPA isn't done.  Following a November 2026 staff recommendation, the CPPA Board voted unanimously to begin formal rulemaking
on proposed amendments, which will be open for a 45-day comment period once published. The proposal names Global Privacy Control as an example of an opt-out preference signal, clarify that signals must be honored before cookies or trackers that sell or share data are set, and extend metrics reporting to businesses subject to audits or risk assessments. These are proposals, not final rules, but they show where enforcement attention is heading.

Meanwhile, the California Opt Me Out Act (AB 566) will require browsers to include a built-in opt-out preference signal. When that switch is one click away for millions of Californians, a website that can't detect and honor it is going to stand out for the wrong reasons.

How Should Your Business Approach a CCPA Compliance Review?

A CCPA compliance review doesn't need to be a drawn-out project. It needs to be focused and methodical. Here's an example of the framework our CCPA compliance attorneys use with clients.

Step 1: Map Your Trigger Activities

Inventory every place your business sells or shares data, processes sensitive data, or uses automated tools to evaluate people. Include website pixels, CRM enrichment, HR software, and any AI features your vendors have quietly added.

Step 2: Prioritize by Deadline

Put ADMT uses at the top of the list because of the January 1, 2027 date. Next, schedule assessments for new processing, then build a calendar to complete assessments for older processing well before December 31, 2027.

Step 3: Test, Don't Assume

Turn on Global Privacy Control and visit your own website. Does the opt-out register? Can a consumer confirm it? Do trackers still fire? Our team explains why this matters in Why Testing Cookies Matters More Than Ever. The same tracking issues can also create exposure under the California Invasion of Privacy Act.

Step 4: Update Notices and Contracts

Refresh your privacy policy, notices at collection, and ADMT pre-use notices. Review vendor contracts so service providers are obligated to cooperate with your assessments and audits, which the regulations require.

Step 5: Assign Ownership

Risk assessments require named reviewers and approvers, and submissions require executive sign-off. Decide now who owns privacy decisions so the April 2028 attestation doesn't become a scramble.

Frequently Asked Questions

When did the new CCPA regulations take effect?

The regulations took effect on January 1, 2026. Some obligations have later compliance dates, including ADMT requirements on January 1, 2027 and risk assessment submissions on April 1, 2028.

Does my business need a CCPA risk assessment if we only use advertising cookies?

Possibly. If your cookies or pixels "share" personal information for cross-context behavioral advertising, that activity triggers a risk assessment under Section 7150, even if you never use AI.

When are CCPA risk assessments due to the CPPA?

For assessments conducted in 2026 and 2027, businesses must submit an attestation and summary information by April 1, 2028. Full reports must be provided within 30 days if the CPPA or Attorney General asks.

What is ADMT?

ADMT is technology that processes personal information to replace, or substantially replace, human decision-making.

What is a significant decision under the ADMT rules?

A significant decision results in providing or denying financial or lending services, housing, education, employment or contracting opportunities, or healthcare services. Advertising is not included.

What are the penalties for violating the CCPA?

Administrative fines are currently up to $2,663 per violation and $7,988 per intentional violation or violation involving known minors under 16. These amounts are adjusted for inflation every odd-numbered year.

Don't Wait for the Inspector to Knock

The CCPA has evolved from a notice-and-link law into a documentation-and-accountability law. The businesses that fare best will be the ones that can show their reasoning, not just their privacy policy. If your last privacy review predates 2026, you're likely working from an outdated blueprint.

Kronenberger Rosenfeld's privacy and cybersecurity attorneys help businesses map trigger activities, prepare risk assessments, update CCPA compliance programs, and respond to regulatory inquiries. For a broader look at the shifting landscape, read How to Keep Up With New Privacy Laws. Contact our team to schedule your CCPA compliance review.

Authored by Liana Chen, Partner at Kronenberger Rosenfeld. Liana oversees digital advertising and privacy matters, including regulatory compliance and FTC and other government enforcement defense.