Compliance Stuff

  In July 2025, the California Privacy Protection Agency (CPPA) Board unanimously approved new regulations pursuant to the California Consumer Privacy Act (CCPA) that specifically address the use of automated decisionmaking technologies (ADMTs), requirements for completing risk assessments, and, for businesses processing large amounts of California resident data or engaging in the large-scale sale or sharing of data, mandatory annual cybersecurity audits. While these regulations have been in the drafting process since 2023, they reflect an ongoing trend in California and across the country in favor of heightened, proactive accountability mandates. Quick Hits The CPPA Board recently approved new cybersecurity audit regulations that, pending final approval by the California Office of Administrative Law (OAL), will apply to large CCPA-covered businesses and data brokers. The regulations include extensive independent audit requirements that will, at a minimum, necessitate businesses e...

A bill introduced in the California legislature this session aims to prevent employers from posting job notices for positions that don’t actually exist – a growing trend referred to as “ghost” job postings. If you’re not familiar with this practice, read on to learn about why employers are increasingly taking such actions and the steps California lawmakers are taking to try to put a stop to it. What are “Ghost” Job Postings? Ghost job postings are advertisements for roles employers have no immediate intention to fill. Candidates, often unaware, apply and even interview for these roles, investing significant time and resources only to find the positions never truly existed – or never learned that they have applied for and perhaps interviewed for a fake job. What Would AB 1251 Prohibit? The proposed bill,  AB 1251 , requires private employers to explicitly disclose in job advertisements whether the position advertised is an existing vacancy. Employers failing to provide this disclos...

  Businesses with a website beware: California regulators just warned that the law prohibits your website from making website users jump through hoops or otherwise confusing them as they try to exercise their privacy rights, regardless of whether you intend to have that effect. If your website can be accessed by California residents, regardless of where your business is located, this news may impact your business. The California Privacy Protection Agency published its second Enforcement Advisory warning about the use of “dark patterns” – those interfaces that impair a website user’s ability to make a choice regarding the collection, use, or disclosure of their personal information – on September 4. It reflects the Agency’s focus on how privacy choices, particularly consent to use of cookies and other similar technologies on websites, are presented to consumers in compliance with the California Consumer Privacy Act (CCPA). What are the four steps you should take to ensure you comp...