USA – CALIFORNIA Trends and Developments Contributed by: Christina M. Morgan and David M. Liu, Buchalter LLP
(d) other technology that verifies a consumer’s identity or conducts physical or biological iden - tification or profiling of a consumer. The purpose of a risk assessment is to determine whether the risks to consumers’ privacy from the processing outweigh the benefits to consumers, the business, other stakeholders, and the public. The goal is to restrict or prohibit the processing of personal information if the risks to privacy outweigh the ben - efits of processing. Risk assessments must be revisited at least once every three years, or whenever there is a material change relating to the processing activity, to ensure they remain accurate. Businesses must retain their risk assessment for as long as the processing con - tinues or for five years after the completion of the risk assessment, whichever is later. As with cybersecurity audits, certain information about risk assessments must be reported to the CPPA. For risk assessments conducted in 2026 and 2027, the business must submit the required information no lat - er than 1 April 2028. For risk assessments conducted after 2027, the business must submit the required information no later than 1 April of the following year. Automated decision-making technology The new regulations impose additional obligations on businesses that use “automated decision-making technology”, or ADMT, to make a significant deci - sion concerning a consumer. ADMT is defined as any technology that processes personal information and uses computation to replace human decision-making or substantially replace human decision-making. A significant decision is one that results in the provi - sion or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensa - tion, or healthcare services. A business that uses ADMT to make a significant deci - sion must provide consumers with a prominent and conspicuous pre-use notice. Among other things, the pre-use notice must include a link through which con - sumers can opt out of the business’s use of ADMT. There must be two or more methods to opt out of
ADMT. When developing these methods, the business must consider how the consumer ordinarily interacts with the business. The method of opting out must be easy and require minimal steps. In addition, a business must provide consumers with the following information upon request: • the specific purpose for which the business used ADMT; • information about the logic of the ADMT; • outcome of the decision-making process for the consumer, including how the business used the output of the ADMT to make a significant decision with respect to the consumer; and • notice that the business is prohibited from retaliat - ing against consumers who make such requests. Businesses must comply with these ADMT provisions by 1 January 2027. California Has Increased Its Enforcement Activity Since its creation in 2020, enforcement actions have steadily increased in both number and sever - ity. For example, on 30 September 2025, the CPPA announced a record USD1.35 million fine against Tractor Supply. The CPPA alleged that Tractor Supply: • failed to maintain an adequate privacy policy noti - fying consumers of their rights; • failed to provide adequate privacy notices to con - sumers and job applicants; • did not implement effective opt-out mechanisms, including browser-based Global Privacy Control signals; and • lacked CCPA-compliant data sharing agreements with other companies. In addition to the penalty, Tractor Supply was ordered to conduct quarterly scanning of digital properties, update its processes for handling opt-out requests, amend its third-party contracts, and have a senior officer or director certify its compliance with the CCPA annually for the next four years. Soon after, on 11 February 2026, the California Attor - ney General announced a settlement of USD2.75 mil - lion with Disney. The Attorney General alleged that
568 CHAMBERS.COM
Powered by FlippingBook