California privacy regulator unveils new cyber, risk, and automation rules
By 
Adrianne Appel2025-08-22T19:05:00
Businesses operating in California will need to meet new, first-in-the-nation privacy requirements for cybersecurity, risk assessments, and automated decision-making technology (ADMT), under a large expansion of rules by the state.
The rules, unanimously approved July 24 by the California Privacy Protection Agency (CPPA), significantly broaden the panel’s oversight of businesses that handle personal data of customers, employees, and the public. These new guidelines aim to strengthen protections for consumers while balancing business concerns, including scaled-back compliance requirements and phased reporting deadlines.
Related articles
-
ArticleCalifornia may create whistleblower program to root out privacy law violations
A California privacy agency plans to seek a whistleblower law, to encourage corporate employees and others to step forward with complaints about egregious privacy violations at their workplaces.
-
ArticleTractor Supply Company hit with $1.35M fine for alleged California privacy violations
Tractor Supply Company has agreed to get into compliance with California’s consumer privacy law and to pay a $1.35 million fine—the largest yet by California—to settle allegations it violated the privacy rights of customers and job applicants.
-
ArticleSeven years in, GDPR faces growing challenges from AI and ‘consent or pay’ models
Europe’s pioneering data protection legislation turned seven years old in May, but the compliance and enforcement difficulties that have dogged the rules since they came into force look set to present both companies and data regulators with fresh headaches for some time to come.
More from Regulatory Policy
-
ArticleNew regulatory regimes for U.K. and EU ESG ratings firms could increase compliance costs
Environmental ratings are becoming big business as companies seek proof of sustainable and socially beneficial conduct. Firms that issue ratings on environmental, social and governance (ESG) performance are set to be regulated in the EU and U.K.
-
ArticleFRC’s plans for more flexible enforcement gains support
Plans to give the U.K.’s audit regulator more options to regulate firms for sloppy work have been largely well received by experts, who believe the current system is “inflexible,” “cumbersome,” and “slow.”
-
News BriefFDIC eases leverage rules for banks, citing lower risk burdens
The U.S. Federal Deposit Insurance Corporation issued a final rule to change the leverage capital requirements for both large and community banks. The agency said the modification will ”reduce disincentives a banking organization may have to engage in lower-risk activities.”