Skip to main content

CCPA risk assessments built on real browser evidence.

Article 10 of the CCPA regulations requires a documented risk assessment before you sell or share personal information, process sensitive data, or use automated decisionmaking for significant decisions. Papaya's AI agents run your site's real consent journeys and capture the facts your report has to state.

Book a risk assessment walkthroughCheck if you need one

Processing that began before 2026 must be assessed by December 31, 2027.

Risk assessment evidence · example.com

Sharing for cross-context behavioral advertising

Trigger § 7150(b)(1)Selling or sharing
Reject allAccept allGPC signal
  • § 7152(a)(3)(A)
    How personal information is collectedCookies set and network requests sent on every journey
    Captured by Papaya
  • § 7152(a)(3)(E)
    What consumers were told, and howScreenshots of the banner, notices, and opt-out link at each step
    Captured by Papaya
  • § 7152(a)(3)(F)
    Third parties that receive dataReceiving domains, before and after each consent choice
    Captured by Papaya
  • § 7152(a)(6)
    SafeguardsWhether reject-all and GPC actually stop the sharing
    Captured by Papaya
  • § 7152(a)(4)
    Benefits of the processingWritten by your team
    Your team

Papaya records what happened. Your team and counsel draw the conclusions.

The clock started on January 1, 2026.

The CPPA's risk assessment rules apply to any business covered by the CCPA. These are the dates that shape your plan.

  • Jan 1, 2026

    Article 10 takes effect. New high-risk processing needs an assessment before it starts.

    § 7155(a)(1)
  • Dec 31, 2027

    Deadline to assess processing that began before 2026 and is still running.

    § 7155(b)
  • Apr 1, 2028

    First submission to the CPPA, attested by an executive under penalty of perjury.

    § 7157(a)
  • 45 days

    Time to update an assessment after a material change. Review every one at least every three years.

    § 7155(a)(2)–(3)

Six activities require a risk assessment.

Section 7150(b) lists the processing that presents significant risk to consumers' privacy. Doing any one of them is enough.

Take the applicability check

Selling or sharing personal information

Includes sharing for cross-context behavioral advertising, which ad pixels and retargeting tags can trigger.

If your site runs advertising tags, start here.

§ 7150(b)(1)
  • § 7150(b)(2)

    Processing sensitive personal information

    Precise geolocation, health, financial account log-ins, and more. A narrow exception covers some HR uses.

  • § 7150(b)(3)

    ADMT for significant decisions

    Automated decisionmaking that grants or denies lending, housing, education, employment, or healthcare.

  • § 7150(b)(4)

    Inferences about applicants, students, and workers

    Automated profiling based on systematic observation of applicants, students, employees, or contractors.

  • § 7150(b)(5)

    Inferences from sensitive locations

    Automated inferences based on presence at places like clinics, pharmacies, shelters, or places of worship.

  • § 7150(b)(6)

    Training ADMT or identity technology

    Using personal information to train ADMT for significant decisions, or facial, emotion, or identity recognition.

For most companies, the first trigger is on their website.

Under the CCPA, sharing means making personal information available to a third party for cross-context behavioral advertising, paid or not. Ad pixels, retargeting tags, and audience tools on your site can do exactly that.

Your assessment has to describe that processing as it really runs: what is collected, who receives it, and whether opt-outs work. A tag manager export can't tell you that. A browser that actually clicks the buttons can.

Ask Composer

Does example.com stop sharing visitor data with ad platforms after reject-all and GPC, under CCPA?

Journeys the agents will run

  • Reject all, then browse the site
  • Accept all, as a baseline
  • Global Privacy Control signal on
  • Post-consent journey through checkout

Each run records cookies, network requests, screenshots, and agent steps.

What § 7152 asks for, and where the evidence comes from.

The regulations list what every risk assessment must document. Some of it is judgment only your team can supply. The rest is a question of fact about how your site behaves, and that is where Papaya does the work.

  • § 7152(a)(1)

    Specific purpose of the processing

    Your team
  • § 7152(a)(2)

    Categories of personal and sensitive personal information

    Papaya evidence

    Cookies and requests show what each page sends, and to whom

  • § 7152(a)(3)

    Operational elements: collection, disclosures, recipients

    Papaya evidence

    Journeys, banner screenshots, and receiving domains per consent state

  • § 7152(a)(4)

    Benefits to the business and consumers

    Your team
  • § 7152(a)(5)

    Negative impacts, including impaired consumer control

    Papaya evidence

    Tags that keep firing after reject-all or GPC, with the requests as proof

  • § 7152(a)(6)

    Safeguards

    Papaya evidence

    Rerunnable tests that show opt-outs and GPC handling still work

  • § 7152(a)(7)–(9)

    Decision to proceed, contributors, approval

    Your team

From question to evidence in agentic minutes.

  • Ask a compliance question

    Describe what you need to know in plain language. Composer turns it into browser tests for reject-all, accept-all, GPC, and the journeys that matter, like checkout.

  • Agents run the real journeys

    Papaya's AI agents use your site like a visitor would and record cookies, pixels, network requests, screenshots, and every step they take.

  • Attach the evidence to your report

    Findings come mapped to CCPA and CPRA requirements, ready for your team and counsel to cite in the operational, impact, and safeguard sections.

Rerun after every tag change. A material change means updating the assessment within 45 calendar days. Running the same journeys again shows whether your safeguards still hold.

Live customers and pilots like

  • Mozilla AI
  • Superset
  • Bluesky Privacy
  • DataPilots

Backed by early-stage venture investors like 1616 Ventures, Ritual Capital, and Night Capital. Winner of accelerators like Launch powered by KPMG and the Social New Venture Challenge at Chicago Booth.

Article 10, in plain words.

Guides written from the CPPA's final text, with the section numbers so your counsel can check our reading.

Questions, answered.

It is a documented analysis, required by Article 10 of the CCPA regulations (Cal. Code Regs. tit. 11, §§ 7150–7157), of whether the privacy risks of a processing activity outweigh its benefits. A business must complete one before it starts any processing that presents significant risk to consumers' privacy, and restrict or stop the processing if the risks win.

Get your evidence in place before December 31, 2027.

Tell us about your site and the processing you need to assess. We'll show you the consent journeys Papaya would run and how the evidence fits your report.

  • A live run of reject-all, accept-all, and GPC journeys on your site
  • How each piece of evidence maps to the fields in § 7152
  • Which of your vendors receive data in each consent state
Which processing do you need to assess?

We use your details only to reply about your request.