On September 23, the CPPA announced that the California Office of Administrative Law approved final regulations covering cybersecurity audits, risk assessments, automated decision-making technology, insurance companies, and updates to existing California Consumer Privacy Act (CCPA) regulations. The regulations are set to take effect January 1, 2026, but businesses have additional time to comply with certain requirements, including those related to cybersecurity audits, risk assessments, and automated decision-making technologies. As previously covered by InfoBytes, the CPPA initially released its regulations in July 2025 following the expiration of the 45-day comment period.

The agency noted that supporting materials and final regulations would be posted on the CPPA website once they were processed.