On September 23, 2025, the California Privacy Protection Agency announced that the state’s Office of Administrative Law approved regulations that update existing California Consumer Privacy Act (“CCPA”) regulations and introduce new regulations covering cybersecurity audits, risk assessments, and automated decision-making technology.  The updates to the existing regulations—which take effect on January 1, 2026—expand business obligations under the CCPA and give consumers more control over their personal information.  This blog post highlights key updates to the existing regulations. 

• Mandatory Opt-Out Confirmation.  When a consumer requests to opt-out of the sale or sharing of their personal information, including when the request is made through an opt-out preference signal, businesses will be required to provide confirmation that such a request has been processed.  For example, the updated regulations state that a business may display an “Opt-Out Request Honored” message on its website and indicate the processed opt-out request through a toggle or radio button in the consumer’s privacy settings.  Notably, providing opt-out confirmation is currently optional.
• Enhanced Right to Know.  Currently, businesses are required to provide a method for consumers to submit a request to know.  Under the updated regulations, if a business maintains the personal information of a consumer for longer than 12 months, the method for submitting a request to know must allow the consumer to request access to personal information collected prior to the 12-month period preceding the consumer’s request, going back as far as January 1, 2022.  According to the updated regulations, this can be effectuated by providing the consumer an option to indicate a date range for which the consumer is making the request to know or by permitting the consumer to request all of the personal information that the business has collected about them.
• Clarification on Privacy Policy Disclosures.  Whereas the existing regulations require a business to identify in its privacy policy the categories of personal information disclosed to “third parties” in the previous 12 months, the updated regulations clarify that a business must also identify the categories of personal information disclosed to a “service provider or contractor.”
• Updated Definition of “Sensitive Personal Information.”  The updated regulations amend the definition of “sensitive personal information” to include any personal information belonging to consumers that a business has actual knowledge are less than 16 years old.  
• Expanded Notice of Right to Limit.  The updated regulations will require a business to provide to consumers a notice of their right to limit the business’s use or disclosure of sensitive personal information in the same manner in which it collects the information, subject to exceptions.  The updated regulations also provide examples of how a business can properly provide such a notice in the context of consumer interactions that occur via connected device (e.g., smart televisions) and through augmented or virtual reality.
• Additional Examples of Prohibited Dark Patterns.  The updated regulations provide examples of several practices that may constitute prohibited dark patterns, including:
  • requiring more steps to opt-out of the sale or sharing of personal information than to opt-in;
  • making a “yes” button more prominent than a “no” button (e.g., through sizing or color selection);
  • treating the act of closing or navigating away from a pop-up as a valid form of consumer consent without the consumer first affirmatively selecting “I accept” or an equivalent;
  • selecting by default, or featuring more prominently, the option to participate in a financial incentive program than the option not to; and
  • creating a false sense of urgency that pressures consumers into quickly making a decision about the scope of their consent.