California's privacy law was written before generative AI existed in its current form, and its regulator has spent the last two years catching up. The amended regulations that take effect January 1, 2026 are the biggest change yet, and they reach directly into how AI systems make decisions about people. Here is what the CCPA actually requires, why it matters for an AI product specifically, and what the 2026 changes mean in practice.
What the CCPA actually is
The CCPA is the California Consumer Privacy Act, California's state consumer privacy law, later strengthened by the CPRA (California Privacy Rights Act), a ballot measure that expanded consumer rights and created a dedicated regulator, the California Privacy Protection Agency (CPPA). Unlike HIPAA, the CCPA is not sector-specific: it applies broadly to businesses that meet certain size or data-volume thresholds and handle personal information of California residents, regardless of industry.
The CCPA gives consumers a set of rights over their personal information: the right to know what is collected, the right to delete it, the right to correct inaccurate information, the right to opt out of the sale or sharing of personal information, and the right to limit the use of sensitive personal information (categories like precise location, health information, or biometric data). These rights exist regardless of whether the data sits in a traditional database or flows through an AI system.
Why it exists
The CCPA responds to a fairly plain problem: for most of the internet's history, consumers had almost no visibility into what companies collected about them, no reliable way to see it, and no practical way to have it deleted. Data brokers built profiles nobody consented to in any meaningful sense. California's law was a response to that imbalance, giving individuals enforceable rights instead of leaving data practices entirely to a company's own privacy policy. The newer automated decision-making provisions respond to a more specific and newer problem: as companies increasingly let algorithms, including AI systems, make or heavily influence decisions about people's lives, the law is catching up to make sure people know when that is happening and have a way to push back.
Why a company follows it
Enforcement is real. The California Privacy Protection Agency can investigate and act on CCPA violations, and California's attorney general has separate enforcement authority. Beyond direct enforcement, though, most US-facing consumer products end up complying with the CCPA as a practical baseline even for users outside California, because segmenting privacy behavior by state is expensive and error-prone, and other states are converging toward similar requirements anyway. A company that builds real CCPA compliance into its data handling from the start avoids rebuilding it later when the next state law lands.
The 2026 changes that matter most for AI products
Automated decision-making technology (ADMT)
The amended CCPA regulations, approved and effective January 1, 2026, expand the law into automated decision-making technology, AI governance, cybersecurity audits, and risk assessments. Automated decision-making technology (ADMT) refers to a system, including an AI system, that processes personal information to make or substantially replace human decision-making. The most consequential change: by January 2027, businesses using AI or automated systems for decisions with legal or similarly significant effects, meaning things like employment, lending, housing, or healthcare decisions, must give consumers a pre-use notice explaining that ADMT is being used, and must offer an opt-out right. If a consumer opts out, the business must provide a human review alternative before the automated decision gets made.
Consider a mid-size lending platform using an AI model to help screen loan applications. Under the 2026 to 2027 rules, applicants need to be told, before the process runs, that an automated system is part of the decision, and given a real way to request a human reviewer instead, not a buried settings toggle nobody finds. Building that opt-out and human-review path is a product requirement now, not a policy afterthought.
Consumer rights as applied to data an AI agent touches or generates
The right to know, delete, and correct apply to personal information an AI feature touches the same way they apply to a traditional record. If a support agent stores conversation history, generates a customer summary, or retrieves personal data to answer a question, a deletion request has to actually reach and remove that data, not just the row in the primary customer table. This gets harder with AI systems specifically because personal information can end up copied into vector store embeddings, cached prompts, fine-tuning datasets, or logs, each of which needs its own answer to "can we find and delete this person's data here."
Multi-state reality
The CCPA is the most mature and influential US state privacy law, but it is not the only one. Other states have their own laws and their own 2026 updates: Oregon updated its law in 2026, and Connecticut's law had a mid-2026 update. Requirements are not identical state to state. A US-facing AI product handling consumer data across states realistically needs a compliance approach that works across multiple state frameworks, not a California-only checklist, because assuming California's rules are the ceiling everywhere else is a real risk.
What GreyScript AI does, and does not, do here
GreyScript AI builds AI systems designed to align with CCPA and other US state privacy law requirements, including the 2026 ADMT notice and opt-out rules and the standard consumer rights (know, delete, correct, opt out, limit use of sensitive data) as they apply to data an AI feature stores, retrieves, or generates. We do not issue certifications or audit reports. A formal legal compliance determination, including whether a specific feature counts as ADMT under the CCPA's amended regulations, is the reader's own to commission, typically through counsel. See our AI governance and security service for how this fits into a build.
If you are weighing multiple US compliance obligations at once, our explainer on SOC 2-ready logging and access control for AI agents covers the attestation side that often runs alongside state privacy law work for the same product.