Involved parties: The CPPA enforces the rules, targeting businesses meeting CCPA thresholds (e.g., $25M+ revenue, 100K+ CA consumers, or 50%+ revenue from data sales/sharing) that collect personal information via cookies for sale or sharing.[2][6][13] No specific companies or individuals named; law firms like Sheppard Mullin and Butler Snow provide compliance guidance.[1][4]
Context and timeline: CCPA (2018) evolved via CPRA (2023 amendments adding "share" for cross-context ads) and prior enforcements (e.g., fines since 2022 for opt-out failures).[3][5] 2024 advisories addressed dark patterns; 2025 final rules expanded requirements for risk assessments, cybersecurity audits, automated decision-making tech (ADMT), opt-out confirmations, and broadened "sensitive personal information" (e.g., health data, minors under 16).[6][8][9][11] Key: opt-out model (not GDPR-style opt-in), mandatory "Do Not Sell or Share" links, GPC signal recognition since 2023, and DROP platform launch January 2026 for data broker deletions.[3][10][15]
Newsworthy now: Headline flags urgency pre-deadline (March 22, 2026, story amid ~2-month compliance window), as non-compliant websites risk CPPA fines; updates demand immediate audits, policy tweaks, and tech changes for millions of CA-impacted businesses amid rising US privacy laws (20 states by 2026).[1][2][14]