USA – CALIFORNIA Trends and Developments Contributed by: Christina M. Morgan and David M. Liu, Buchalter LLP
Buchalter LLP 655 West Broadway
Suite 1600 San Diego California 92101 USA
Tel: +1 (619) 219 5335 Fax: +1 (619) 219 5344 Email: cmorgan@buchalter.com Web: www.buchalter.com
The California Consumer Privacy Act of 2018 Remains One of the Strictest Consumer Privacy Laws in the Nation The California Consumer Privacy Act of 2018 (CCPA), as amended, gives consumers the following rights: • the right to limit the use and disclosure of sensitive personal information collected about them; • the right to opt out of the sale of their personal information and the right to opt out of the shar - ing of their personal information for cross-context behavioural advertising; • the right to correct inaccurate personal information that businesses have about them; • the right to know what personal information busi - nesses have collected about them and how they use and share it; • the right to equal treatment (ie, non-discrimination); and • the right to delete personal information, subject to some exceptions. Businesses must provide methods by which consum - ers can exercise these rights. The CCPA imposes cer - tain disclosure obligations, including the posting of a notice at collection and a privacy policy. California Created the First, and Only, Privacy Enforcement Agency in the United States In 2020, California voters approved the California Pri - vacy Rights Act of 2020, which amended the CCPA. Among other things, the California Privacy Rights Act created a new agency to implement and enforce
the CCPA – the California Privacy Protection Agency (CPPA). The CPPA is responsible for: • promoting public awareness of consumers’ rights and businesses’ responsibilities under the CCPA; • adopting regulations in furtherance of the CCPA; • enforcing the CCPA through investigations, audits, and enforcement actions; • co-operating with other agencies with jurisdiction over privacy laws to ensure consistent application of privacy protections; and • providing technical assistance and advice to the legislature with respect to privacy-related legisla - tion. With New Regulations Come Increased Compliance Obligations On 23 September 2025, the CPPA announced the approval of new regulations. Most notably, the new regulations require businesses to complete annual cybersecurity audits and conduct risk assessments before certain processing activities. The new regula - tions also require that consumers be given the oppor - tunity to opt out of the business’s use of automated decision-making technology. The new regulations, described below, went into effect on 1 January 2026. Cybersecurity audits Every business whose processing of consumers’ per - sonal information presents a significant risk to con - sumers’ security is required to complete an annual
566 CHAMBERS.COM
Powered by FlippingBook