California CCPA ADMT, risk assessment, and cybersecurity regulations
California finalized privacy regulations addressing automated decisionmaking technology, risk assessments, and cybersecurity audits, with the rules effective January 1, 2026 and some compliance deadlines phased later.
California · Effective · Effective Jan 1, 2026
What it is
- What changed
- California's privacy regulator finalized rules that affect automated decisionmaking, privacy risk assessment, and cybersecurity audit obligations.
- Why it matters
- Caregiving tools that use profiling, automation, sensitive data, or digital health workflows may need stronger notices, rights handling, and risk governance.
- Who it touches
- Family caregivers, People using AI and digital health tools, People receiving care, Businesses and agencies that must complycare recipients using digital services, family caregivers, consumer health app users, technology vendors, privacy teams
- What it does
- Requires something of providers, companies or agencies
- Topics
- Caregiving AI
Sources
- California Privacy Protection Agency FAQ
- California CCPA updates, cyber, risk, and ADMT regulation text
Last reviewed Jun 19, 2026. This is information, not legal advice; check the source for the current text.