In a significant step toward strengthening consumer privacy protections, the California Privacy Protection Agency (CPPA) board adopted a comprehensive set of updates to the California Consumer Privacy Act regulations. These long-anticipated regulations — covering cybersecurity audits, risk assessments and automated decision-making technology — mark a pivotal shift in the state’s data privacy enforcement landscape. CPPA staff also revealed that hundreds of active investigations are already underway — many involving businesses that have yet to realize they are under scrutiny.

Read on for a summary of the new and revised regulations and how businesses should prepare for more stringent privacy obligations and heightened enforcement risk.