In 2018 the California legislature enacted one of the most comprehensive privacy statutes in the United States, the California Consumer Privacy Act (CCPA). Since 2018 businesses have had to contend with the complex compliance burdens imposed by the CCPA and various changes and amendments to the law itself.
In September 2025, the California Privacy Protection Agency (CPPA) finalized new regulations under the CCPA that create new compliance requirements surrounding the areas of: (i) conducting cybersecurity audits; (ii) privacy risk assessments (PRAs); and (iii) regulations governing access and opt-out requirements when a business uses “automated decision-making technology” (ADMT).
The requirements imposed under these new regulations could create significant new compliance burdens on many financial institutions. Institutions will need to understand clearly when and whether their processing activities or use of technologies qualifying as ADMT may trigger new disclosure requirements. The new regulations were effective on January 1, 2026, but companies have extended compliance deadlines by which to comply with its requirements.
This one-and-a-half hour Webinar will provide a detailed discussion of the regulatory requirements surrounding PRAs and the use of ADMT under the new CCPA regulations. There will be plenty of time for questions and answers.
