CPRA Compliance in 2026: What Privacy Teams Need to Do Now

CPRA compliance in 2026 is an operating requirement, not a future deadline. California’s updated CCPA regulations now set a timetable for risk assessments, cybersecurity audits, and certain uses of automated decision-making technology. At the same time, privacy teams must continue to manage expanded consumer rights, sensitive personal information, workforce data, purpose limitation and opt-out preference signals.

The California Privacy Rights Act did not create a separate law. It amended the California Consumer Privacy Act, so the governing framework is the CCPA as amended by the CPRA. For privacy, legal, security, and compliance teams, the practical task is to translate that framework into repeatable workflows, apply the correct rule to each situation, and preserve a clear record of how decisions were reached. California Department of Justice

This guide explains the five changes that matter most to privacy operations, who is generally in scope, the deadlines teams should map now, and eight actions that can make a multistate privacy program more consistent and defensible.

What does CPRA compliance require in 2026

CPRA compliance in 2026 requires covered businesses to manage the CCPA’s existing consumer rights and data-governance duties while preparing for the new risk assessment, cybersecurity audit, and automated decision-making requirements. The regulations took effect January 1, 2026, but the operational deadlines vary by requirement and applicability.

• Risk assessments must be completed before a covered business begins specified high-risk processing. Covered processing already underway before January 1, 2026, must be assessed by December 31, 2027.
• Information about risk assessments conducted in 2026 and 2027 must be submitted to the California Privacy Protection Agency by April 1, 2028.
• First cybersecurity audit report deadlines are April 1, 2028, 2029, or 2030, depending on the applicable criteria and revenue tier.
• Businesses using covered automated decision-making technology to make significant decisions must comply with the ADMT requirements beginning January 1, 2027.

These deadlines do not apply universally. Each organization should determine which processing activities and regulatory criteria apply to its facts and confirm the analysis with counsel. CPPA final regulations

Five CPRA changes that shape privacy operations

1  Expanded consumer rights and opt-out signals

The CPRA added the right to correct inaccurate personal information and the right to limit certain uses and disclosures of sensitive personal information. It also extended the opt-out framework to the sharing of personal information for cross-context behavioral advertising.

Organizations need intake, identity verification, routing, and fulfillment processes that work across systems. Covered businesses also must recognize valid opt-out preference signals, including Global Privacy Control signals, where the law requires them to do so. A request process is defensible only when the front-end choice triggers the correct downstream action. CPPA consumer and business FAQs

2  Sensitive personal information needs deliberate controls

California identifies categories such as precise geolocation, account credentials, racial or ethnic origin, certain communications, genetic data and information about health, sex life or sexual orientation as sensitive personal information.

The operational question is not only whether the organization collects this information. Teams must understand why it processes it, where it moves, who can access it, how long it retains it, and whether a consumer can limit its use or disclosure. Those answers should be reflected consistently in notices, data inventories, system controls and request workflows. California Attorney General CCPA guidance

3  Workforce and business contact data are in scope

The former CCPA exemptions for employment-related personal information and business-to-business personal information expired December 31, 2022. California residents can therefore have CCPA rights when they are job applicants, employees, independent contractors, or business contacts.

Privacy teams should align human resources, procurement and customer-facing processes instead of treating employee privacy as a separate compliance island. The same core disciplines apply: clear notice, accurate data mapping, controlled access, defined retention and a reliable process for handling applicable rights requests. California DOJ FAQs

4  Purpose limitation, proportionality and retention are enforceable disciplines

The collection, use, retention and sharing of personal information must be reasonably necessary and proportionate to disclosed purposes. The CPPA has emphasized that data minimization also applies when a business processes a consumer’s privacy request.

Clear purpose statements, documented retention logic and controlled downstream use are therefore part of compliance, not optional governance enhancements. Teams should be able to explain what data is necessary, why it is needed, who approved the use, and when the information should be deleted or deidentified. CPPA Enforcement Advisory No. 2024-01

5  Risk assessments, cybersecurity audits and ADMT have firm compliance dates

California’s updated CCPA regulations took effect January 1, 2026, but the compliance dates vary by requirement and applicability. Teams should map each date to the processing activities and business criteria that apply to their organization.

• Risk assessments. A covered business must conduct and document a risk assessment before beginning a processing activity identified by the regulations as presenting significant privacy risk. Covered processing that began before January 1, 2026, and continues afterward must be assessed by December 31, 2027. Information about assessments conducted in 2026 and 2027 is due to the CPPA by April 1, 2028.
• Cybersecurity audits. Businesses that meet the audit criteria face first report deadlines of April 1, 2028, 2029, or 2030, depending on the applicable revenue tier. The audit must be completed by a qualified, objective, and independent professional, whether internal or external.
• Automated decision-making technology. Businesses using covered ADMT to make significant decisions must comply with the ADMT requirements beginning January 1, 2027, including applicable notice, access and opt-out requirements.

The operational priority is to connect each requirement to an owner, an evidence set, an approval path, and a review schedule. Applicability depends on the facts and the regulatory criteria, so teams should confirm coverage with counsel rather than treating every deadline as universal. CPPA 2026 regulations

Who must comply with the CCPA in 2026

The CCPA generally applies to a for-profit business that does business in California, determines the purposes and means of processing consumers’ personal information and meets at least one of these thresholds:

• Gross annual revenue of at least $26.625 million for the preceding calendar year, effective January 1, 2025.
• Buying, selling, or sharing the personal information of at least 100,000 California residents or households.
• Deriving at least 50% of annual revenue from selling or sharing California residents’ personal information.

The law also reaches certain controlled entities and joint ventures and imposes separate obligations on service providers, contractors, and other recipients. Nonprofits and government agencies generally are not covered, and statutory exemptions may apply to particular data or activities. Because the revenue threshold adjusts for inflation in odd-numbered years, review scope regularly rather than deciding it once. Current CPPA monetary thresholds

One important correction to a common misconception: the CCPA does not create a broad private right of action for every privacy violation. Its private action is limited to certain security incidents involving specified personal information and statutory conditions. Regulatory enforcement, contractual exposure, and other privacy laws can still create substantial risk. California DOJ CCPA guidance

How California privacy law differs from other state laws

California remains influential, but it is not a universal template for U.S. privacy compliance. As of June 2026, IAPP reported that 23 states had enacted comprehensive consumer privacy laws. That number is a point-in-time snapshot; the more durable lesson is that state laws continue to differ in their applicability thresholds, exemptions, sensitive-data rules, universal opt-out requirements, assessment duties, cure periods, and enforcement models. IAPP U.S. State Privacy Legislation Tracker

The practical trend is convergence around a common set of operating capabilities, not identical legal requirements. A multistate program needs accurate data inventories, clear processing purposes, repeatable rights workflows, vendor controls, structured assessments, and evidence of consistent decision-making. The legal analysis still must preserve jurisdiction-specific definitions, exceptions, deadlines, and decision criteria.

NIST’s Privacy Framework 1.1 supports this operating model by connecting privacy requirements and controls across executives, business owners and implementation teams. NIST SP 800-61 Revision 3 similarly places incident response within broader cybersecurity risk management. Together, these frameworks reinforce a practical point: privacy governance and incident response work best when ownership, inputs, decisions, safeguards and outcomes are connected and traceable. NIST Privacy Framework 1.1; NIST SP 800-61 Revision 3

Eight actions for a consistent and audit-ready privacy program

1  Reconfirm scope at least annually

Evaluate revenue, processing volumes, revenue sources, corporate relationships, and exemptions for California and every other relevant state. Assign an owner to monitor threshold and rule changes, and record the basis for each scope decision.

2  Inventory and classify personal information

Map consumer and workforce data by category, sensitivity, source, purpose, system, recipient, and retention period. Connect the inventory to actual workflows rather than leaving it as a static spreadsheet.

3  Document purpose and minimize processing

Test whether each collection, use, retention, and disclosure is necessary and proportionate. Replace vague purposes with specific statements that business and technical teams can apply, and document the safeguards that support the decision.

4  Operationalize consumer and workforce rights

Create consistent intake, verification, routing, response, and exception handling. Test correction, deletion, access, opt-out and limitation workflows across front-end and back-end systems, including downstream service providers.

5  Review vendors, contracts and data flows

Confirm that service provider, contractor and third-party terms match actual processing. Define instructions, permitted purposes, assistance duties, security expectations and return or deletion requirements.

6  Use one assessment method with jurisdiction-specific logic

Adopt a structured process for identifying benefits, privacy risks, safeguards, residual risk, and approval authority. Reuse an assessment across laws only when it contains every required element and preserves the rationale behind the decision.

7  Prepare for audits and regulatory submissions

Determine whether the cybersecurity audit and risk assessment criteria apply, identify the first reporting period, and validate auditor independence. Maintain supporting evidence continuously so audit readiness becomes an operating state rather than a deadline scramble.

8  Connect privacy governance to incident response

Capture complete incident facts, apply the correct jurisdiction-specific requirements, determine notification obligations, and preserve an explainable record. Run exercises with privacy, legal, security, human resources, procurement and communications teams so roles and escalation paths are clear before an incident occurs.

Turn regulatory requirements into defensible decisions

Privacy requirements will continue to change across states and jurisdictions. A durable program gives teams a consistent way to capture facts, identify the rules that apply, involve the right reviewers, and preserve the rationale behind each decision. That continuity reduces manual rework and provides stronger proof of diligence when an auditor, regulator, customer, or executive asks how an outcome was reached.

RadarFirst is an AI-forward regulatory risk management platform for privacy and AI incidents. It connects structured intake, assessment, regulatory interpretation, configurable workflows, and documentation so privacy, legal, and security teams can apply consistent logic while retaining control over final decisions. For privacy incidents, teams can map incident facts to applicable laws, determine notification obligations, coordinate response and maintain a complete, audit-ready record. Explore the RadarFirst platform

Ready to make regulatory decisions with greater speed, consistency and defensibility? Request a RadarFirst demo. For self-guided research, use the Radar Privacy Breach Law Library to review global breach laws, notification obligations and reporting requirements.

Sources and editorial references

• California Privacy Protection Agency, Frequently Asked Questions
• California Privacy Protection Agency, Updated Monetary Thresholds in CCPA
• California Privacy Protection Agency, 2026 CCPA regulations and rulemaking materials
• California Privacy Protection Agency, Enforcement Advisory No. 2024-01
• California Department of Justice, California Consumer Privacy Act
• NIST, Using Privacy Framework 1.1
• NIST, Special Publication 800-61 Revision 3
• IAPP, U.S. State Privacy Legislation Tracker

This article provides general information and is not legal advice. Organizations should consult counsel about their specific obligations.