Lexology July 28, 2025
On July 24, 2025, the California Privacy Protection Agency (CPPA) took a step forward in rulemaking under the California Consumer Privacy Act (CCPA) by adopting regulations governing automated decision-making technology, risk assessments, and cybersecurity audits. The CPPA proposed rules in early 2023 and the version adopted this week was revised in May 2025.
The CPPA board voted 5-0 to adopt the regulations and authorized staff to submit the final rulemaking package to the Office of Administrative Law (OAL). The OAL has 30 working days to process and approve the regulations, at which point the rules will take effect.
With this approval, the CPPA has fulfilled its mandate under Proposition 24 to clarify and expand the CCPA by creating enforceable rules...
Today's Sponsors
Today's Sponsor