California Consumer Privacy Act in 2026: New Obligations, Phased Deadlines, and Where to Start

If your organization processes data on California consumers, employees, or website visitors, the updated California Consumer Privacy Act (CCPA) regulations that took effect January 1, 2026, likely apply to you, regardless of where you are headquartered, and you will want to attend our upcoming webinar.

The 2026 updates introduce three new obligations: independent cybersecurity audits, formal privacy risk assessments, and governance requirements for automated decision-making technology (ADMT), a category that covers AI and any tool that replaces human judgment in a significant decision. They also revise the everyday rules for disclosures, cookie consent, opt-out confirmation, consumer rights requests, and data belonging to consumers under 16.

Join us for this one-hour session, where we cover who falls within scope, what changed, what is new, when each obligation comes due, and where to focus first. You will leave with a practical view of how the phased deadlines through 2030 apply to your own organization.

What you will be able to do afterward:

• Identify the revenue and data volume thresholds that bring an organization within CCPA scope, along with the additional thresholds that trigger the mandatory cybersecurity audit obligation
• Determine which of the three new requirements (cybersecurity audits, privacy risk assessments, and ADMT governance) apply to your organization, and identify the compliance deadline attached to each
• Determine which updated consumer rights and consent obligations apply to your privacy notices, consent banners, opt-out mechanisms, and rights request workflows.

This course qualifies for 1.0 CPE credit in Specialized Knowledge.