California Privacy Protection Agency adopts multiple regulations including Conflict of Interest Code Amendments and Data Broker Registration Fee

What happened

The CPPA has adopted several regulations, such as the Conflict of Interest Code Amendments Regulation (September 2026) and Data Broker Registration Fee Regulation (December 2025). These were adopted through the Administrative Procedures Act rulemaking process and are now part of the agency’s regulatory framework.

Why it matters for trust and compliance

• Its status is published. It is enacted but may not be in force yet. Check the effective date before planning around it.
• Adopted CPPA regulations expand enforcement tools for the CCPA and Delete Act, affecting data brokers and other entities.
• It relates to CCPA/CPRA. The regulations library explains what that law requires.

Who is affected

Recommended actions

1. Check that privacy notices describe the practices this addresses.
2. Confirm access, correction, deletion and opt-out requests are handled within the required time.
3. Inventory where this data is shared or sold and whether opt-outs are honoured.
4. Map the security requirements to existing controls and close gaps.
5. Inventory AI or automated decision systems in scope and their assessments.
6. Schedule or refresh the risk or impact assessments this calls for.