CCPA/CPRA
California Consumer Privacy Act, as amended by the California Privacy Rights Act
Recent developments
-
California Governor signs four privacy bills expanding deletion rights, privacy settings, data‑broker rules and limiting CIPA lawsuits
The new statutes significantly strengthen consumer deletion rights, tighten data‑broker obligations, protect user‑controlled privacy settings, and curtail a class of privacy‑related lawsuits. Governor Gavin Newsom signed SB 923, AB 2561, AB 883 and SB 690 into law during the 2026 session. SB 923 broadens CCPA deletion rights and requires online request mechanisms; AB 2561 bars operating systems and apps from changing privacy settings without consent; AB 883 shortens data‑broker deletion request processing to 30 days and promotes DROP awareness; SB 690 removes the private right of action for certain pen‑register and trap‑and‑trace claims under CIPA.
Effective: not stated.
Source: Covington Inside Privacy. CCPA/CPRA in the regulations library.
-
U.S. AI AGENT Act and California SB 1106 propose definitions and rules for AI agents
The bills signal the first U.S. attempts to regulate AI agents, affecting privacy, data access, and consumer protection. Two legislative proposals introduced in the United States this summer – the federal AI AGENT Act and California Senate Bill 1106 – aim to define “agentic AI” and impose obligations on consumer‑facing agents, with differing scopes and technical criteria.
SB 1106.
Source: Future of Privacy Forum. CCPA/CPRA in the regulations library.
-
California Privacy Protection Agency adopts multiple regulations including Conflict of Interest Code Amendments and Data Broker Registration Fee
Adopted CPPA regulations expand enforcement tools for the CCPA and Delete Act, affecting data brokers and other entities. The CPPA has adopted several regulations, such as the Conflict of Interest Code Amendments Regulation (September 2026) and Data Broker Registration Fee Regulation (December 2025). These were adopted through the Administrative Procedures Act rulemaking process and are now part of the agency’s regulatory framework.
Effective: not stated.
Source: CPPA rulemaking page (change monitor). CCPA/CPRA in the regulations library.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws