After launching a California privacy program, monitor four things: request response deadlines, opt-out handling including browser signals, your data inventory and vendor contracts, and the new regulatory dates for risk assessments, cybersecurity audits and automated decisionmaking. There is no certificate to hold, so the evidence is your running log.
What changes the compliance picture after launch?
The California Consumer Privacy Act, amended by Proposition 24 (the CPRA), is enforced by the California Privacy Protection Agency, which the agency's site calls CalPrivacy, alongside the Attorney General. The agency's regulations took effect on 1 January 2026. Its announcement adds that some requirements phase in later: cybersecurity audits, risk assessments and automated decisionmaking technology rules.
Your products, vendors and data uses will change faster than the law. Monitoring is how you notice.
What should you check every month?
Consumer requests. The Attorney General's guidance says businesses must respond to requests to know, delete and correct within 45 calendar days, extendable by another 45 days (90 total) with notice. Track open requests by age, and review ones nearing day 30.
Opt-outs. For requests to opt out of sale or sharing, the guidance says respond as soon as feasible and within 15 business days at most. The same guidance states that a user-enabled global privacy control, such as the Global Privacy Control (GPC), is a valid opt-out signal. Test it monthly: send a browser with GPC on to your site, and confirm that tags and advertising partners stop receiving data.
Links and notices. If you sell or share personal information, a working "Do Not Sell or Share My Personal Information" link must exist, and two or more request methods must be offered where required. Click through the live links and forms.
Third party code. New marketing pixels and SDKs appear without a privacy review. Scan your sites and apps for new trackers and compare against the approved list.
What should you check every quarter?
- Compare the vendor list from finance with your register of service providers and contractors, and check each agreement contains the required terms.
- Re-run your data inventory for new fields, new systems and new purposes.
- Review a sample of closed requests for correctness: identity checks, scope of search, completeness of response.
- Check training records for the staff who handle requests.
- Review security incidents for any that involved personal information.
What should you do every year?
- Update your privacy policy. Review it against actual practice.
- Re-validate the data inventory with every system owner.
- Review service provider terms, and retention periods against actual deletion.
- Revisit applicability: the monetary thresholds used to decide whether the Act applies to your business are published by the agency and updated, so check the current figure.
- Test the full request process end to end with a mock consumer.
Which dates are on the calendar?
The CPPA's announcement of the final regulations gives these dates:
- Risk assessments: compliance begins 1 January 2026. By 1 April 2028, businesses subject to the requirement must submit an attestation that the assessments were completed and a summary of the information.
- Cybersecurity audits: businesses required to complete them must submit certifications by 1 April 2028 if revenue exceeds 100 million dollars, 1 April 2029 if between 50 and 100 million, and 1 April 2030 if under 50 million.
- Automated decisionmaking technology: businesses using it for significant decisions must comply starting 1 January 2027.
Whether each applies to you depends on your activities and size, so read the regulation text or take legal advice. Put the relevant dates and the preparation lead time on the calendar now. A cybersecurity audit needs months of evidence, so evidence habits started this year help later.
What evidence should the program produce?
- Request log with receipt, verification, decision and response dates.
- GPC test results, dated.
- Tracker scan reports and approvals.
- Vendor register with agreement review dates.
- Data inventory change log.
- Training records.
- Risk assessment records, where required.
- Incident log entries touching personal information.
What mistakes recur?
- Counting days from the wrong date.
- Honouring the opt-out link but ignoring GPC.
- New pixel added by marketing and nobody reviews it.
- Service provider contracts signed once and never reviewed.
- Privacy policy describing last year's practice.
- No owner, so monthly checks lapse.
What to do
- Name an owner for each monthly and quarterly check.
- Build a request tracker with age alerts at day 30 and day 40.
- Add a GPC test and a tracker scan to the monthly list.
- Reconcile vendors quarterly against payments.
- Calendar the regulatory dates that apply to you, with preparation milestones.
- Review the privacy policy yearly against real behaviour.
Quick check
How long does a business have to respond to a request to delete?
The California Attorney General's guidance says 45 calendar days, extendable by another 45 days with notice to the consumer.
Do browser opt-out signals count?
Yes. The Attorney General's guidance states a user-enabled global privacy control such as GPC is a valid way to submit an opt-out request.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring keeps running between reviews, which saves the team time. Technical evidence comes from your real code and dependencies: scans, SBOMs and reachability show which components, including third party libraries, run in the services that handle personal information. Safeguard's agent can open tested fix pull requests for vulnerable dependencies and other findings. It is off by default, every category starts on Manual, and you choose which categories run automatically and the approval level. Safeguard helps prepare and keep evidence ready. It does not provide legal advice or make you compliant. Book a call.
Sources
- California Attorney General, CCPA
- California Privacy Protection Agency, laws and regulations
- CPPA announcement on the final regulations, 23 September 2025
This is general information, not legal advice.
Last reviewed: 18 October 2026.
