Which California privacy changes actually affect AI visibility monitoring?

Start with the data and processing purpose. Do not assume that buying an AI tool automatically creates a regulated automated-decision system. California’s final regulations distinguish risk assessments from the separate ADMT rules. They also expressly exclude advertising to a consumer from the definition of a significant decision. (cppa.ca.gov)

For a B2B software marketing team, we recommend assessing two workflows separately:

• Public-information benchmarking: proposed category questions, published product facts and recorded public answers.
• Customer-data analysis: uploaded sales calls, CRM exports, support conversations, named prospects or individual-level attribution data.

Do not let a supplier describe both simply as “prompt research”. Record the information involved and the intended use before deciding which obligations apply.

Which implementation dates matter?

The CPPA states that risk-assessment compliance begins from 1 January 2026, while covered ADMT requirements begin on 1 January 2027. The first risk-assessment attestation and summary submission is due on 1 April 2028; cybersecurity-audit certifications are phased from 2028 to 2030 for businesses subject to those requirements. These are different duties, not interchangeable grace periods. (cppa.ca.gov)

The regulations identify risk-assessment triggers including selling or sharing personal information and processing sensitive personal information. For qualifying processing started before 1 January 2026 and continuing afterwards, the assessment deadline is 31 December 2027. Do not apply that legacy timetable indiscriminately to a new implementation. (cppa.ca.gov)

What should procurement ask the monitoring vendor?

Our recommended questions are:

1. What personal information will enter prompts, uploads, logs and exports?
2. Which companies receive it, and for which purposes?
3. Is it used to train or improve models or to build cross-customer benchmarks?
4. What retention and deletion controls are available?
5. Can the service operate with redacted examples instead?
6. How are consumer requests passed through relevant vendors?
7. Which party is responsible for assessing the proposed processing?

Require a data-flow diagram and an implementation-specific answer—not only a generic security certificate.

What does recent enforcement add?

On 11 February 2026, California’s Attorney General announced a $2.75 million Disney settlement resolving allegations that opt-outs were not fully applied across associated devices and streaming services. This was not an AI visibility case. Its practical lesson for an attribution programme is to test the operation of privacy choices across the data connections the programme actually uses. (oag.ca.gov)

Buyer action: before connecting AI referrals to advertising audiences or CRM identities, ask privacy and analytics owners to approve the linkage and test the relevant opt-out behaviour. Do not treat a dashboard’s ability to join records as permission to do so.