CCPA/CPRA
California Consumer Privacy Act, as amended by the California Privacy Rights Act
Recent developments
-
CPPA proposes amendments to CCPA opt‑out preference signal regulations to recognize GPC and expand reporting
The changes would tighten how businesses must honor GPC‑based opt‑out requests, impacting data‑sharing and advertising practices. The California Privacy Protection Agency staff released a package of proposed amendments to the CCPA regulations on opt‑out preference signals (OOPS). The proposal would explicitly recognize the Global Privacy Control (GPC) as a valid opt‑out signal, add new examples for handling OOPS, and broaden annual metrics‑reporting obligations. The agency plans to open a 45‑day public comment period before formal rulemaking.
Source: Covington Inside Privacy. CCPA/CPRA in the regulations library.
-
CalPrivacy Board to hold public meeting on privacy rights and regulatory proposals Nov 5-6, 2026
The meeting signals upcoming regulatory activity that could affect how companies handle privacy notices, disclosures, and opt‑out mechanisms in California. The California Privacy Protection Agency Board will meet on November 5‑6, 2026 to discuss consumer privacy rights, legislative updates, and possible regulatory amendments such as opt‑out preference signals. The meeting will be open to the public in person and via remote access.
Source: Hunton Privacy & Cybersecurity Law Blog. CCPA/CPRA in the regulations library.
-
California Governor signs four privacy bills expanding deletion rights, privacy settings, data‑broker rules and limiting CIPA lawsuits
The new statutes significantly strengthen consumer deletion rights, tighten data‑broker obligations, protect user‑controlled privacy settings, and curtail a class of privacy‑related lawsuits. Governor Gavin Newsom signed SB 923, AB 2561, AB 883 and SB 690 into law during the 2026 session. SB 923 broadens CCPA deletion rights and requires online request mechanisms; AB 2561 bars operating systems and apps from changing privacy settings without consent; AB 883 shortens data‑broker deletion request processing to 30 days and promotes DROP awareness; SB 690 removes the private right of action for certain pen‑register and trap‑and‑trace claims under CIPA.
Effective: not stated.
Source: Covington Inside Privacy. CCPA/CPRA in the regulations library.
-
U.S. AI AGENT Act and California SB 1106 propose definitions and rules for AI agents
The bills signal the first U.S. attempts to regulate AI agents, affecting privacy, data access, and consumer protection. Two legislative proposals introduced in the United States this summer – the federal AI AGENT Act and California Senate Bill 1106 – aim to define “agentic AI” and impose obligations on consumer‑facing agents, with differing scopes and technical criteria.
SB 1106.
Source: Future of Privacy Forum. CCPA/CPRA in the regulations library.
-
California Privacy Protection Agency adopts multiple regulations including Conflict of Interest Code Amendments and Data Broker Registration Fee
Adopted CPPA regulations expand enforcement tools for the CCPA and Delete Act, affecting data brokers and other entities. The CPPA has adopted several regulations, such as the Conflict of Interest Code Amendments Regulation (September 2026) and Data Broker Registration Fee Regulation (December 2025). These were adopted through the Administrative Procedures Act rulemaking process and are now part of the agency’s regulatory framework.
Effective: not stated.
Source: CPPA rulemaking page (change monitor). CCPA/CPRA in the regulations library.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws