California's consumer privacy regime, materially rewritten by the CPRA, which added the California Privacy Protection Agency as a dedicated enforcement body, a sensitive personal information category and a right to correct. Anyone describing the CCPA as it stood in 2018 is describing a regime that no longer exists. New regulations on risk assessments, cybersecurity audits and automated decision-making took effect on 1 January 2026 with obligations phasing in through 2030, so confirm which requirements bite for a given business.