CCPA risk assessment requirements, section by section

What Article 10 requires

The CPPA board adopted the regulations on July 24, 2025. The Office of Administrative Law approved them in September 2025, and they took effect on January 1, 2026. Article 10 sits at §§ 7150–7157 of Title 11 of the California Code of Regulations.

A risk assessment is a structured look at one processing activity. You document what you collect and why, how it flows, who receives it, what could go wrong for consumers, and what you do about it. Then someone with authority decides whether the processing goes ahead. The result is a written risk assessment report.

When you need a risk assessment

Section 7150(b) lists six processing activities that present significant risk to consumers' privacy. Any one of them requires an assessment before you start.

• Selling or sharing personal information. Sharing has a specific meaning under the CCPA: making personal information available to a third party for cross-context behavioral advertising, paid or not. Website ad tags are a common source. See our guide to ad tracking and cross-context behavioral advertising.
• Processing sensitive personal information. There is a narrow exception for employee and contractor data used solely for payroll, employment authorization, benefits, legally required accommodations, or wage reporting.
• Using ADMT for a significant decision. A significant decision results in the provision or denial of financial or lending services, housing, education, employment or contracting opportunities or pay, or healthcare services.
• Automated inferences about applicants, students, employees, and contractors based on systematic observation, such as inferring performance, health, or behavior.
• Automated inferences based on presence in a sensitive location. The regulations list healthcare facilities, pharmacies, domestic violence shelters, food pantries, housing and emergency shelters, educational institutions, political party offices, legal services offices, union offices, and places of worship.
• Training technology with personal information. Processing personal information you intend to use to train ADMT for significant decisions, or to train facial-recognition, emotion-recognition, or other identity or profiling technology.

The regulations give four examples in § 7150(c): a hiring process that uses emotion-recognition on interview video, a dating app that sends precise geolocation, ethnicity, and medical details to an analytics provider, a budgeting app that targets payday-loan ads on other websites based on users' finances, and a company that extracts faceprints from photos to train facial recognition.

Not sure which apply to you? Use the applicability check.

Who takes part

Employees whose jobs involve the processing must be included (§ 7151(a)). If someone decides how the data will be collected, for example, they must give that information to the people running the assessment.

You may also bring in outside parties (§ 7151(b)): service providers, contractors, experts in detecting and mitigating bias in ADMT, a subset of affected consumers, or groups that represent consumers, such as advocacy organizations.

What the assessment must cover

Section 7152(a) sets out nine elements. Most must be written into the risk assessment report itself.

1. The specific purpose of the processing, not a generic one like "to improve our services."
2. The categories of personal and sensitive personal information, including the minimum needed for the purpose.
3. Operational elements: how data is collected, used, disclosed, and retained, and from what sources; retention per category; how you interact with consumers; roughly how many consumers are affected; what disclosures you make and how; the service providers, contractors, and third parties involved and why; and, for ADMT, its logic and output.
4. The benefits to the business, consumers, other stakeholders, and the public.
5. The negative impacts to consumers' privacy and their sources and causes, such as unauthorized access, discrimination, impaired control over their information, coercion through dark patterns, and economic, physical, reputational, or psychological harm.
6. The safeguards you will use to address those negative impacts.
7. Whether you will start the processing.
8. The people who provided information for the assessment, except legal counsel giving legal advice.
9. The review and approval date, and the names and positions of reviewers and approvers.

Our risk assessment template turns these into fields you can copy into your own document.

One more rule applies to vendors. A business that makes ADMT available to another business for significant decisions must give that business the facts it needs to run its own assessment (§ 7153).

The core test: do the risks outweigh the benefits?

Section 7154 states the goal plainly: restrict or prohibit the processing if the risks to consumers' privacy outweigh the benefits to the consumer, the business, other stakeholders, and the public. An assessment that never changes a decision is missing the point the CPPA wrote into the rule.

Deadlines, updates, and retention

• Before you start. New processing listed in § 7150(b) needs a completed assessment first (§ 7155(a)(1)).
• Existing processing. If it began before January 1, 2026 and continues after that date, assess it by December 31, 2027 (§ 7155(b)).
• Every three years. Review and update as needed (§ 7155(a)(2)).
• Within 45 calendar days of a material change. A change is material if it creates new negative impacts, makes existing ones more likely or severe, or weakens your safeguards (§ 7155(a)(3)).
• Retention. Keep every version for as long as the processing continues or five years after completion, whichever is later (§ 7155(c)).

Combining and reusing assessments

One assessment can cover a comparable set of processing activities, meaning similar activities with similar risks (§ 7156(a)). An assessment prepared for another purpose, such as another state's data protection assessment, also counts if it contains everything § 7152 requires or you add what is missing (§ 7156(b)).

Submitting to the CPPA

For assessments conducted in 2026 and 2027, you submit summary information to the CPPA by April 1, 2028, then by April 1 each year after that. A member of executive management attests to it under penalty of perjury. The CPPA or the Attorney General can ask for the full reports at any time, and you have 30 calendar days to provide them. Read the submission guide for the full list.

Where browser evidence fits

Several § 7152 elements are questions of fact about how your website or app actually behaves: how data is collected, what disclosures consumers see, which third parties receive data, and whether safeguards like opt-outs work. Interviews and tag inventories describe the intended setup, which can differ from what actually runs in a browser.

Papaya's AI agents run real reject-all, accept-all, and Global Privacy Control journeys on your site and record cookies, network requests, screenshots, and every step. Your team cites that evidence in the report. Your counsel makes the legal calls.

Sources

• CPPA, CCPA regulations effective January 1, 2026 (Cal. Code Regs. tit. 11, §§ 7000 et seq.), PDF
• CPPA, CCPA updates, cybersecurity audits, risk assessments, and ADMT rulemaking
• CPPA, California finalizes regulations to strengthen consumers' privacy (September 23, 2025)
• California Consumer Privacy Act of 2018, as amended (Civ. Code § 1798.100 et seq.), PDF
• White & Case, CPPA finalizes rules on ADMT, risk assessments, and cybersecurity audits requirements under the CCPA (September 25, 2025)

This guide summarizes the regulations for planning purposes. It is not legal advice. Papaya provides technical evidence; your counsel makes the legal calls.