California privacy regulator unveils new cyber, risk, and automation rules
By 
Adrianne Appel2025-08-22T19:05:00
Businesses operating in California will need to meet new, first-in-the-nation privacy requirements for cybersecurity, risk assessments, and automated decision-making technology (ADMT), under a large expansion of rules by the state.
The rules, unanimously approved July 24 by the California Privacy Protection Agency (CPPA), significantly broaden the panel’s oversight of businesses that handle personal data of customers, employees, and the public. These new guidelines aim to strengthen protections for consumers while balancing business concerns, including scaled-back compliance requirements and phased reporting deadlines.
Related articles
-
ArticleSeven years in, GDPR faces growing challenges from AI and ‘consent or pay’ models
Europe’s pioneering data protection legislation turned seven years old in May, but the compliance and enforcement difficulties that have dogged the rules since they came into force look set to present both companies and data regulators with fresh headaches for some time to come.
-
News BriefStates like New York, Pennsylvania stepping up to fill regulatory void left by federal agencies
As the Consumer Financial Protection Bureau steps back from its core mission of protecting American consumers, states like New York and Pennsylvania are stepping up to fill the regulatory void.
-
PremiumWhat’s on tap for CPPA from its deputy director of enforcement
Michael Macko, deputy director of enforcement at the California Privacy Protection Agency, described priorities for the agency now and in the near future during a recent board meeting.
More from Regulatory Policy
-
ArticleU.K. enforcement appetite over off-channel comms grows as U.S. wanes
The U.K’.s financial regulator has given a strong indication that financial firms’ use of unauthorized devices and apps is under scrutiny and that policies around off-channel communications need to be tightened up.
-
ArticleFinCEN seeks to lighten the regulatory load on casinos
Regulatory relief from anti-money laundering rules is in the cards for casinos, insurance companies and other non-bank financial institutions, the U.S. Treasury Department’s Treasury’s Financial Crimes Enforcement Network (FinCEN) said Monday.
-
ArticleProsecutions of bribery, health fraud and market tampering are DOJ top priorities
Serious bribery, health care fraud and crimes that threaten U.S. investors are top enforcement priorities of the Trump Department of Justice, (DOJ), according to the acting head of the Department of Justice’s Criminal Division.