CCPA 2026 Consumer Rights: What Organizations Should Know About the Updated Rules

For organizations operating in California, privacy compliance has meant responding to consumer requests, posting disclosures, and honoring opt-outs. Beginning January 1, 2026, that posture is no longer sufficient. Updates to the California Consumer Privacy Act (CCPA) alter the consumer privacy environment, representing a key shift through both new and updated regulatory requirements. Organizations should implement key changes to demonstrate that consumers can meaningfully exercise their privacy rights. As the first of two articles, the following covers what changed, who is affected, and five concrete steps to get into compliance.

Key Takeaways

• The 2026 CCPA regulatory updates expand consumer rights beyond the original framework.
• The CCPA applies to for-profit organizations in or doing business in California that meet at least one of the outlined thresholds.
• Businesses must visibly confirm when a consumer’s opt-out has been honored
• Data belonging to consumers under 16 is now classified as sensitive personal information.
• EisnerAmper's cyber risk team helps organizations assess CCPA applicability, audit consent flows for dark pattern violations, and build compliant data governance programs across the 2026 and 2027 regulatory phases.

What Is the CCPA and Who Does It Apply To?

Effective January 1, 2020, the CCPA became the first comprehensive privacy law in the United States, giving California consumers broad rights over their personal data and imposing obligations on organizations that collect, use, or sell data. Now, stricter regulations are taking effect, making businesses:

• Meet formal audit requirements
• Perform mandatory risk assessments
• Adhere to AI governance obligations
• Meet enhanced transparency standards

Learn More About the new CCPA regulatory additions

The CPPA makes it clear that the updates will be enforced, making it important for businesses to start building a compliance program rooted in documented processes, independent oversight, and the right governance structure. Discover if the CCPA applies to your organization.

The CCPA applies to for-profit organizations doing business in California, regardless of where headquartered, and that meet at least one of the following thresholds.:

• Annual global gross revenue exceeding $26.625M
• Buy, sell, or share the personal information of 100,000 or more consumers or households annually
• Derive 50% or more of annual revenue from selling or sharing consumers' personal information

What Changed: 2026 CCPA Regulatory Updates

Privacy Enhancements

Privacy policies must now disclose personal information shared with service providers and contractors, not just third parties. Mobile apps must include a privacy policy link in their settings menu in addition to a link on the download or landing page. Businesses operating connected/ AR-VR devices need to show opt-out notices before data collection begins, not after.

Best Practices

• Audit your current privacy policy against the updated disclosure requirements
• Add a dedicated section listing categories of personal information shared with service providers and contractors
• For mobile apps, verify your settings menu includes a direct privacy policy link
• Confirm accurate disclosures as they are a high-visibility compliance gap

Opt-Out Confirmation and Global Privacy Control (GPC) Compliance

Businesses must visibly confirm when a consumer’s data opt-out of sale or sharing has been honored. This applies to both direct opt-out requests and signals received through the Global Privacy Control (GPC). Silent background processing is no longer sufficient. Organizations must provide a status indicator or mechanism, such as a toggle or radio button, to confirm the opt-out request status.

Best Practices

• Update the website and privacy settings interface to display opt-out confirmation status
• Review your GPC detection systems
• Make sure all systems are operationally effective across all platforms

Cookie Consent and Dark Patterns

These updates make clear that passive consumer behavior does not equal consent. Closing a pop-up, clicking outside a banner, or navigating away from a page cannot be treated as an agreement to data collection. Opt-in and opt-out options must be equally prominent, require the same number of steps, and consumers must be able to withdraw consent at any time. Consumers must take an active, unambiguous action such as clicking "Accept" or "Allow" for consent to be valid. When a consumer withdraws consent, businesses must cease processing their personal information within 15 business days of receiving that request.

Best Practices

• Audit all consent banners and flows on desktop, mobile, and apps to confirm active and visual symmetry across the interface
• Eliminate any mechanism that treats inaction as consent
• Map the step count from opt-out to completion against the opt-in process and remediate any imbalance

Consumer Request Handling: Expanded Rights

The updates refine and expand how businesses must respond to consumer rights requests with new obligations around data access, corrections, and how authorized agents are handled. Consumers can now request data from January 1, 2022. Correction requests require businesses to identify or notify the data source, and corrected data must stay corrected. Businesses can no longer require a consumer to submit a request directly when they have already designated an authorized agent to act on their behalf. If a business denies a health-related correction request, consumers may submit a 250-word statement per contested item; this statement must be shared with anyone who previously received the disputed information.

Best Practices

• Review your rights request’s workflows
• Make sure your data access processes have the capacity to retrieve records from 2022.
• Update your correction workflows to include source identification
• Train your team on the new authorized agent rules to avoid procedural noncompliance on intake.

Sensitive Personal Information

Data for consumers under 16 is now classified as sensitive personal information. Organizations collecting data from youth should re-evaluate their data handling processes. If an organization knows or willfully ignores the signs that the user is under 16, they must review existing notices, implement the Notice of Right to Limit, and corresponding opt-out mechanisms.

Best Practices

• Conduct a full review of your data pipeline if you collect age information during sign-up or onboarding or have reason to know its users are under 16.
• Understand that the “willful disregard” standard means ignorance and is not a defense
• Integrate proactive age awareness processes to maintain compliance

Five Strategies for CCPA Compliance

1. Assess applicability: Confirm whether your business meets CCPA thresholds and which new obligations apply.
2. Inventory processing activities: Map all data flows to identify risk assessment triggers, and review privacy policies, consent banners, opt-out mechanisms, and mobile app settings against new requirements.
3. Evaluate AI and ADMT tools: Identify any automated decision-making used in significant decisions and proactively begin planning for 2027 compliance.
4. Engage cross-functional teams: Compliance, IT/InfoSec, HR, legal, and marketing all have roles, especially for cybersecurity audits and ADMT governance.
5. Consult counsel: Executive liability on risk assessment attestations makes legal guidance essential.

Maintaining Compliance with EisnerAmper

EisnerAmper’s cyber risk team helps organizations comply with CCPA requirements, protect their cyber infrastructure, and adapt to the evolving regulatory environment. Our cross-functional team works across service lines and industries to help you maintain compliance with confidence. To learn more or to understand how this update affects your organization, contact us below.