Policy Briefing — California OAL approves final CCPA regulations effective immediately

Executive briefing: OAL’s approval made the AG’s CCPA regulations immediately enforceable, locking in requirements for detailed notices at collection, request intake channels, identity verification procedures, and disclosures for financial incentive programs.^{11 CCR §§999.300–999.337; OAL filing}

Programme steps

• Update notices. Ensure notice templates follow Sections 999.305–999.307, including purpose statements and links to opt-out pages where applicable.
• Harden request workflows. Align intake, verification, and response scripts to Sections 999.312–999.325, documenting methods used to authenticate consumers and to segregate household requests.
• Financial incentives. Review any loyalty or discount programs under Section 999.336 to confirm value calculations and opt-in records are retained for audit.

Sources

• Final Text of CCPA Regulations filed with OAL
• OAL Notice of Approval of Regulatory Action

Related briefings

Curated signals from the same pillar or overlapping topics.

Policy · Credibility 91/100 · July 1, 2020

Policy Briefing — California begins CCPA enforcement on July 1, 2020

The California Department of Justice started enforcing the California Consumer Privacy Act on July 1, requiring businesses to honor access, deletion, opt-out, and notice obligations despite pending regulation approvals.

Policy · Credibility 89/100 · September 29, 2020

Policy Briefing — California extends CCPA employee and B2B exemptions via AB 1281

Governor Newsom signed AB 1281 on September 29, 2020, extending the CCPA’s partial exemptions for employee and business-to-business data until January 1, 2022, preserving limited notice and breach liability duties in the…

Policy · Credibility 88/100 · November 3, 2020

Policy Briefing — California Privacy Rights Act Approved

Detailed implementation playbook for the California Privacy Rights Act, covering new rights, contracting duties, governance models, automated decision-making, and program management through 2023 enforcement.

Policy · Credibility 40/100 · July 1, 2025

Policy Briefing — July 1, 2025

Tennessee’s Information Protection Act takes effect July 1, 2025, requiring controllers to support sale and ad opt-outs, close consumer requests within 45 days, and retain DPIA plus 60-day cure evidence for…

Policy · Credibility 40/100 · July 31, 2025

Policy Briefing — July 31, 2025

Minnesota’s Consumer Data Privacy Act becomes enforceable July 31, 2025, requiring controllers to deliver consumer rights, document DPIAs, and coordinate attorney-general engagement workflows for complaints.

Continue in the Policy pillar

Return to the hub for curated research and deep-dive guides.

Visit pillar hub

Latest guides

• Semiconductor Industrial Strategy Policy Guide — Zeph Tech

  Coordinate CHIPS and Science Act, EU Chips Act, and Defense Production Act programmes with capital planning, compliance, and supplier readiness.

• Digital Markets Compliance Guide — Zeph Tech

  Implement EU Digital Markets Act, EU Digital Services Act, UK Digital Markets, Competition and Consumers Act, and U.S. Sherman Act requirements with cross-functional operating…

• Export Controls and Sanctions Policy Guide — Zeph Tech

  Integrate U.S. Export Control Reform Act, International Emergency Economic Powers Act, and EU Dual-Use Regulation requirements into trade compliance, engineering, and supplier…