Correction — October 2, 2026: An earlier version described a June 2026 amendment vote, named the wrong agency, and misstated consumer rights and compliance dates. This article replaces those claims with the approved regulation package and official guidance. The original URL remains available so existing links still work.
Which Agency and Which Law?
California's privacy regulator is the California Privacy Protection Agency (CPPA). The California Public Utilities Commission (CPUC) is a different agency.
The California Privacy Rights Act amended the California Consumer Privacy Act; it did not replace it with a separate law. The CPPA's regulation package covers updates to existing rules, cybersecurity audits, privacy risk assessments, automated decisionmaking technology (ADMT), and insurance companies. Its board adopted the package on July 24, 2025. The Office of Administrative Law approved it on September 22, 2025.
The Actual Timeline
The regulations became effective January 1, 2026, but some obligations have later compliance dates:
Risk assessments: covered businesses must begin compliance January 1, 2026. Required attestations and summaries are due to the agency by April 1, 2028.
ADMT: covered businesses using automated decisionmaking for significant decisions must comply with these requirements beginning January 1, 2027.
Cybersecurity audits: certification deadlines are April 1, 2028 for businesses making over $100 million, April 1, 2029 for those making between $50 million and $100 million, and April 1, 2030 for those making less than $50 million, where the audit requirements apply.
These are separate obligations. A regulation's effective date is not necessarily the deadline for every requirement in it. Consult the approved text for coverage and exceptions.
Rights That Already Exist
California residents already have rights to know, delete, and correct personal information; opt out of sale and sharing; limit certain uses of sensitive information; and receive equal treatment when exercising those rights. The CPRA amendments establishing additional rights took effect in January 2023. Correction rights and biometric or precise-location protections were not first introduced by a June 2026 vote.
Start with the business's privacy policy and designated request methods. Keep a copy of your request and its response. The CPPA FAQ explains how to exercise each right and where exceptions can apply.
Data Brokers Have a Separate Deletion Process
Under the Delete Act, data brokers must register annually. Starting August 1, 2026, covered brokers must access the DROP deletion mechanism at least every 45 days and process deletion requests, subject to exceptions. This is distinct from the ADMT and cybersecurity timelines above.
See the data broker guide for a starting point, then verify current instructions on the official DROP pages before submitting a request.
When Can a Consumer Sue?
The CCPA does not give consumers a general private right to sue over every privacy violation. The Attorney General describes a limited right for qualifying breaches involving specified unencrypted and unredacted personal information and inadequate reasonable security. That remedy already exists; this regulation package did not newly create it.
For other suspected violations, the official agency pages explain complaint options. The linked approved regulations and agency guidance are the sources to check for the requirements that apply to a particular situation.