California Adopts Hotly Debated Privacy Act Rulemaking Package

What’s the current status of these monumental regulations and why are they relevant to businesses nationwide?

After nearly a full year of controversial deliberation and a window for public comments, the California Privacy Protection Agency (CPPA) unanimously adopted sweeping new rules pertaining to cybersecurity audits, risk assessments, and automated decisionmaking technology (ADMT).

The rules now sit before the California Office of Administrative Law (OAL) for review under the Administrative Procedure Act’s six standards for enforceable law. In its review, the OAL is likely to scrutinize the necessity, clarity, and authority of the new rules closely.

If ratified, this significant rulemaking package, which falls under the California Consumer Privacy Act (CCPA), will be implemented in phases. Effective dates and deadlines are:

• ADMT regulations become effective January 1, 2027.
• Deadlines for cybersecurity audits are based on company revenue tiers. For companies grossing more than $100 million in revenue, the deadline is April 1, 2028. The deadline extends to April 1, 2030, for companies generating less.
• Compliant risk assessment reports must be submitted by April 21, 2028, although the deadline for companies engaged in high-risk activities may be sooner.

The phased implementation timeline reflects the CPPA's recognition of the substantial operational changes required for compliance. The staggered deadlines for cybersecurity audits based on revenue tiers acknowledge that larger organizations typically have greater resources to implement these requirements while smaller businesses need additional time to develop the necessary infrastructure and expertise.

The rules will have significant and swift implications for businesses that operate in California and could ultimately emerge as the new standard for the nation’s data privacy and security landscape. Most notably, California’s progressive regulations will incur changes to cyber, risk, auditing, and ADMT protocols that were previously deemed acceptable.

The rules seem close to passing their final hurdle with OAL, so businesses nationwide would be wise to review and understand the implications and takeaways for their respective industries.

Legal Framework

For ADMT requirements, businesses must comply if they use automated decisionmaking technology, defined as “any technology that processes personal information and uses computation to replace human decisionmaking or substantially replace human decisionmaking.” Further, “substantially replace human decisionmaking” means that a business uses the technology’s output to make a decision without human involvement.

According to the rules, “human involvement” requires the human reviewer to:

• Know how to interpret and use the technology’s output to make the decision;
• Review and analyze the output of the technology, and any other information that is relevant to make or change the decision; and
• Have the authority to make or change the decision based on their analysis in subsection (B).

Critically, the regulations specify that if a human reviews the technology's output and retains authority to make or alter the decision, the technology does not qualify as ADMT. If a company relies on ADMT in this way, it must give consumers certain protections: clear notice that ADMT is being used, the option to opt out, and the opportunity to challenge or appeal ADMT decisions.

The ADMT provisions mandate human oversight when significant decisions are involved. A “significant decision” is one connected to financial or lending services, housing, education, employment, or healthcare.

The CPPA also updated some of the existing rules under the CCPA, such us:

• Requiring that exercising rights using the “Do Not Sell or Share My Personal Information” link should be the same or fewer than the number of steps for submitting a request to opt-in to the sale of personal information where the business offers a link for consumers to learn more about opting-in to the business’s sale or sharing of their personal information. While only minors under 16 are required to provide opt-in consent before sales can occur, this principle ensures that for all consumers, opting out remains at least as simple and accessible as opting in.
• Toggles or buttons must clearly indicate the consumer’s choice. A consumer’s silence or failure to act affirmatively does not constitute consent.
• Conspicuous link required under the CCPA must be on any webpage that collects personal information, not only homepage(s).

Here is a high-level breakdown of the most noteworthy waves of potential impact.

• Proactive governance:
  The rules drive mandates forward for privacy-by-design and risk-by-design. Companies must think ahead about potential risks and plan accordingly.
• Escalated risk definition:
  The rules dictate procedures for “significant risk.” Activities previously considered common may now fall into the “significant” category of risk under these new standards.
• Transparency for increased consumer protections:
  The rules will enact new obligations for businesses to inform and educate consumers more overtly while providing provisions for them to opt out of or appeal automated systems.
• Burdens of innovation:
  While the rules create new cost and operational burdens for companies, they also aim to create greater cushions and conveniences for businesses as they work to adopt new and emerging technologies.

In the absence of an overarching federal consumer privacy law, these developments from California and other states signal an increasing focus on data protection and consumer privacy rights at the state level. For businesses, this patchwork of data privacy regulations requires nuanced compliance strategies and operational adjustments tailored to the legal frameworks of each state. At the same time, the interaction between federal and state privacy laws remains somewhat uncertain, especially given the Administration’s recent effort to impose a moratorium on new state AI laws. While that initiative failed, similar proposals may resurface, adding further complexity to the regulatory landscape.

At Rikka, we are at the forefront of these regulatory changes, guiding companies to adapt and succeed in this evolving and challenging legal framework. Our team is always working quickly to decode legal developments so we can offer sophisticated, tailored solutions to our clients. Contact us today to ensure your company is prepared for these changes.