While the California Privacy Protection Agency, in concert with the Attorney General's office, has already begun enforcing the existing regulations, the agency expects the next batch of regulations focusing on, among other things, cybersecurity audits, risk assessments, and automated decision-making technology (which would include AI features) to be finalized in the next year.

With the new regulations, we can expect the focus of enforcement and advisories—currently centering on data collection disclosures and practices, as well as compliance with consumers' rights requests—to expand.