You're in a compliance team meeting and someone asks, "Do we need a CCPA risk assessment for this?" The question comes up more often now that the January 1, 2026 deadline hit. The honest answer is usually "it depends," but that's not helpful when you're trying to ship a feature or onboard a vendor.
These questions come from real implementation conversations: product teams launching new analytics, marketing adding retargeting pixels, HR evaluating AI screening tools. The regulation (11 CCR §§ 7150-7157) lists six triggers, but mapping your actual work to those triggers isn't always straightforward.
Does Adding a Retargeting Pixel Trigger an Assessment?
Yes, if you're disclosing personal information to a third party for cross-context Behavioural Advertising.
This often surprises teams because you're not selling data in the traditional sense. You're dropping a pixel that lets an ad platform show your ads to visitors on other sites. But under Civil Code § 1798.140(ah), that counts as "sharing" because the platform uses browsing data to target ads across different contexts.
The pixel passes device identifiers, IP addresses, and pages viewed. The ad platform builds a profile and follows that visitor to other websites. That's cross-context Behavioural Advertising, which is the first of the six assessment triggers.
Your assessment would document the specific retargeting purpose, confirm you're not passing sensitive personal information, list which ad platforms receive the data, and weigh the privacy risks against the benefits. It's a short assessment, but it's required.
What if We're Just Using Standard Analytics, Not Ads?
If your analytics service provider processes data solely on your behalf and doesn't use it for their own purposes, you probably don't need an assessment.
The distinction matters: a service provider under the CCPA works under your instructions and can't retain, use, or disclose the data except to perform the services you specified. If your analytics vendor fits that definition and you're not selling or sharing the data, you're outside the triggers.
But watch for scope creep. If the vendor starts using your data to train their models, improve their product, or benchmark across clients, they've stepped outside the service-provider role. That processing might trigger an assessment under the sixth category: processing personal information to train and refine automated decision-making technology.
We're Using AI to Screen Resumes. Does That Count as a "Significant Decision"?
Yes, if the AI substantially replaces human decision-making in hiring.
Under 11 CCR § 7001(e), a tool substantially replaces human judgment when its output is used to make fully automated decisions. If a recruiter reviews the AI's scores but can't realistically override them, or if they don't have access to the underlying reasoning, the tool still counts as substantially automated.
Hiring decisions fit the definition of "significant decisions" in the regulation because they determine employment opportunities. So does using AI to decide whom to interview, not just whom to hire.
Your assessment must document how the AI processes personal information, whether it infers traits like work performance or behavior, what safeguards prevent unlawful discrimination, and whether a human reviewer can genuinely interpret and override the output. If you're recording video interviews and using emotion-recognition software with no human review, that's clearly covered.
The compliance date for existing ADMT uses is January 1, 2027, so you have time to document these systems if they're already running.
Can We Write One Assessment for All Our Ad Pixels?
Yes, if they present similar risks and serve comparable purposes.
Section 7156(a) explicitly allows grouping similar processing activities in one assessment. If you're running retargeting pixels from three different ad platforms, all collecting the same categories of data for the same purpose, you can document them together.
But don't stretch it. If one pixel collects browsing data and another collects purchase history plus inferred financial status, those present different privacy risks. The second one involves sensitive personal information, which is a separate trigger and needs its own assessment.
The grouping rule helps you avoid duplicative paperwork, but the assessment still has to address the specific risks of each activity covered.
Who Actually Has to Sign Off on These?
Someone with authority to decide whether the processing starts.
The regulation requires approval from a reviewer who can take part in the decision, not just document it. That's usually a director or VP who owns the product, the marketing program, or the HR system. Legal counsel's involvement doesn't need to be recorded (11 CCR § 7152(a)(8)), but the business decision-maker's name and position do.
This requirement forces the assessment out of the compliance silo. The executive signing off needs to understand the residual risks after safeguards and confirm that the benefits justify moving forward. If they can't make that call credibly, the assessment isn't ready.
What Happens if We Started the Processing Before 2026?
You have until December 31, 2027, to complete the assessment if the high-risk processing began before January 1, 2026.
That extended deadline gives you time to document existing programs, but it's not a free pass to skip the work. If you're launching new processing that hits one of the six triggers, you need the assessment before you start.
The extended timeline matters most for ADMT systems already in production: hiring tools, fraud-detection algorithms, customer-scoring models. You're required to document how they work, what safeguards are in place, and whether the residual risks justify continued use.
Do Nonprofits and Government Agencies Need These Assessments?
Most don't, because they're not liable under the CCPA.
Under 11 CCR § 7001(v), the law exempts government agencies and many nonprofits from the definition of "business." If you're not subject to the CCPA's main requirements, the risk assessment rules don't apply either.
But if you're a nonprofit that meets the CCPA thresholds (revenue over $26,625,000, or processing 100,000+ consumers' data annually, or deriving half your revenue from selling or sharing personal information), you're covered and the assessment rules apply.
Where to Go for More
The California Privacy Protection Agency publishes the regulations at 11 CCR §§ 7150-7157. The definition of "business" is in Civil Code § 1798.140(d), and the thresholds are adjusted annually for inflation.
For a structured approach to rating residual risks, the EDPB's DPIA template explainer offers a likelihood-and-severity framework that works with California's benefits-versus-risks test, even though it was written for GDPR.
If you're building an intake process to catch triggers before launch, focus on the six categories in the regulation and map your actual data flows to them. The assessment itself is documentation, but the real work is the decision workflow that stops risky processing before it goes live.
