California’s New Privacy Rules Preparing for the Next Wave of Compliance Requirements By Mark Sanborn, Senior Product and Regulatory Counsel, ComplyAuto California dealerships will soon face new privacy compliance obligations under the California Consumer Privacy Act (CCPA). Regulations adopted by the California Privacy Protection Agency (CPPA) establish three broad new requirements: risk assessments, automated decision-making technology (ADMT) and cybersecurity audits. Each has different triggers, exceptions and implementation deadlines. 1. Risk Assessments CCPA-covered businesses must conduct risk assessments for processing activities presenting significant privacy risks, regardless of business size. Given the types of information dealerships process, most dealers will likely be subject to these requirements. Covered activities include selling or sharing personal information, processing sensitive personal information, using ADMT for significant decisions, certain employee and applicant profiling, and training specified automated technologies. Limited exceptions apply. Each of these activities can be somewhat complicated, but the bottom line is that most dealers will engage in them, so the risk assessment will be required. Assessments must identify the processing purpose, information involved, how it is collected and used, relevant third parties, anticipated benefits and potential privacy harms. Businesses must evaluate safeguards and determine whether the benefits outweigh the risks. An individual with decision-making authority must review and approve the assessment. Assessments generally must be reviewed every three years and updated within 45 days of material processing changes. Businesses conducting covered activities before the regulations took effect have until Dec. 31, 2027, to complete initial assessments. Beginning in 2028, businesses must submit specified assessment summaries to the CPPA. 2. ADMT Requirements The ADMT regulations apply when automated technology (such as an LLM or other AI tool) replaces or substantially replaces human decision-making in significant areas, including lending, employment, housing, education and healthcare. For dealerships, automated decisions involving pricing, consumer financing, hiring, employee compensation and other employment-related decisions warrant particular attention. Human involvement does not automatically exempt a system. To qualify as meaningful human decision-making, the reviewer must understand the automated output, independently consider relevant information, and have authority to make or change the decision. If a business meets these requirements, it triggers notice requirements explaining the technology’s purpose, consumers’ rights, and how the technology influences decisions. In addition, consumers generally have the right to access information about ADMT decisions and to opt out of covered uses. These requirements take effect Jan. 1, 2027, including for businesses already using covered technology. 3. Cybersecurity Audits Cybersecurity audits have narrower applicability. Covered businesses include those deriving at least 50% of annual revenue from selling or sharing personal information, and businesses meeting the CCPA’s revenue threshold that process information concerning at least 250,000 consumers or households, or sensitive information concerning at least 50,000 consumers, annually. Consequently, these requirements are more likely to affect larger dealership groups. Audits must be conducted by qualified, independent professionals using accepted standards. Importantly, dealers may use qualified internal personnel, provided they satisfy the regulations’ independence and objectivity requirements. Audits evaluate cybersecurity programs, including access controls, authentication, encryption, vulnerability management, employee training, incident response and vendor oversight. Reports must identify deficiencies and remediation plans, with supporting documentation generally retained for five years. Many required safeguards are already addressed through dealerships’ existing GLBA Safeguards Rule compliance programs. Covered dealers may therefore be able to leverage existing solutions, documentation, and internal personnel rather than starting from scratch or hiring outside auditors. Implementation is phased: ▶ April 1, 2028: Businesses with 2026 annual revenue exceeding $100 million. ▶ April 1, 2029: Businesses with 2027 revenue between $50 million and $100 million. ▶ April 1, 2030: Other qualifying businesses with 2028 revenue below $50 million. Dealers Should Begin Evaluating Their Obligations Now These requirements should be evaluated separately. Risk assessments apply broadly across processing activities; ADMT obligations depend on how technology influences significant decisions; and cybersecurity audits primarily affect larger or higher-volume businesses. Dealers should begin identifying covered activities, reviewing automated technologies and evaluating existing cybersecurity safeguards. Early preparation will help determine applicable obligations and address compliance gaps before the deadlines arrive. ComplyAuto will help dealers navigate these evolving requirements by providing privacy compliance tools and guidance to identify potential risks, manage consumer privacy obligations and prepare for upcoming deadlines. 22
RkJQdWJsaXNoZXIy MTg3NDExNQ==